Noteproof privacy policy

Effective October 30, 2026

What Noteproof keeps, and where

Everything below is kept in Chrome's storage for the extension, on your computer only.

• Notes: their text, earlier versions of each note (version history), when each was last edited, and where each one shows: a page, a whole site or a pattern of addresses. Deleted notes stay in Recently deleted for 60 days, then go the next time Noteproof opens.
• Locked items: crypto addresses with their network and memo or tag, bank details (IBANs, BICs, account numbers with their routing number, sort code, BSB, or transit and institution numbers), exchange user IDs, payment handles (an email, a phone number or a tag for PayPal, Venmo, Cash App, Revolut, Wise or Zelle), ID numbers (such as a Social Security number, ITIN, EIN, passport number, Medicare number, National Insurance number, SIN, TFN, health insurance member ID or frequent-flyer number), and the names and notes you give them.
• Private notes: notes you lock with your password.
• Settings: the sites you turned the paste guard on for, the size and place of the pop-out window, and choices like which tab the panel last showed.

Locked items and private notes are encrypted (AES-GCM, with a key made from your password by PBKDF2-SHA256 at 600,000 rounds). Your password itself is never stored. While Locked is unlocked, the key is held in Chrome's memory for the extension until 15 minutes without use, until you press Lock, or until Chrome closes. Nobody, us included, can reset or recover your password.

While Locked is unlocked, the paste guard also keeps a copy of your saved addresses, bank details, exchange user IDs and payment handles in that same memory, to check what you paste. Of your ID numbers it keeps only each one's length and last few letters or digits, to hide one if it's pasted. When Locked locks itself after 15 minutes, the guard keeps that copy, so it goes on checking, until you press "Lock those too" or Lock, or Chrome closes.

ID numbers show only their last few letters or digits until you press Show. When you copy one, Noteproof tries to empty the clipboard 30 seconds later, if its window is still open, and says so if Chrome doesn't let it. It can't see copies you make in other apps meanwhile, so it may empty one of those instead, and a clipboard history app may keep its own copy.

What Noteproof reads, and why

• The current page's address, when you open the side panel on it or click the toolbar icon, to show that page's notes. If you choose "Follow every page", Chrome asks you for one more permission, and then the panel also reads the address of each tab you switch to while it's open.
• What you paste or type into text fields on a website, only on sites you turn the paste guard on for. Before you turn it on, Noteproof explains what it reads there and Chrome asks you for access to that one site. It compares crypto addresses, bank details, exchange user IDs and payment handles with your saved ones, and reads the fields and menus beside them that it needs for that check (such as the network menu, or the routing number beside an account number). When you press the page's send button, it reads those fields again, including what the page itself put in them, to catch a swap. It keeps the results of its checks (what was pasted, which saved item it looks like, and the page's address) in Chrome's memory for the extension, to show them in the side panel and keep a warning up until it's resolved; they're gone when Chrome closes. The check runs in Noteproof's own script inside that site's tab, which Chrome keeps apart from the page itself: it holds your saved addresses, bank details, user IDs and handles, and of your ID numbers only each one's length and last few letters or digits (to hide one if it's pasted), never the numbers. On those sites Noteproof also sees the address of each page you open, to count its notes on the toolbar icon and show them in the panel.
• Text you select on a page, when you ask to add it to a note (the right-click menu, the shortcut, or the actions menu). Noteproof never reads password fields.

Noteproof refuses recovery phrases and private keys in Locked, and when you paste, drop or add one to a note. One you type into a note by hand stays there, flagged until you delete it: it's kept out of version history and Markdown exports, and the note's title is hidden wherever it would show.

What Noteproof never does

• Send anything over the network. It has no servers, no account, no analytics and no ads.
• Sell, share or transfer your data to anyone, for any purpose.
• Use your data for anything except the features described here, or to decide creditworthiness or lending.
• Read your clipboard. The paste guard sees only what you paste into a guarded page, as you paste it.

Noteproof's use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Backups and exports

Backups and Markdown exports are files you choose to save to your computer. Backups are encrypted with your Locked password. A Markdown export is plain text: ID numbers in it stay masked, and notes that seem to hold a recovery phrase or key are left out. Where those files go after that is up to you.

Permissions, in plain words

Deleting your data

Delete notes and Locked items in the extension at any time. A deleted note waits in Recently deleted for 60 days, where you can restore it; after that it's deleted for good the next time Noteproof opens. Removing Noteproof from Chrome deletes everything it kept at once. Files you saved (backups, exports) stay where you saved them.

Changes

If this policy changes, the new version will be posted here with a new date. A change that reads or keeps more than this page says will ask you first in the extension.

Questions

Write to the contact email on Noteproof's Chrome Web Store page.

Noteproof's code ships readable and not minified, so anyone can check what it does.