Sidenote privacy policy

Updated October 31, 2026 · covers version 1.5

Your notes live in your own browser. Nothing leaves it unless you turn on sync or share a notepad, and even then your notes are encrypted on your device first, so the sync service cannot read them. Sidenote has no accounts, no analytics and no ads, and sells or shares nothing.

What Sidenote stores

Sidenote is a Chrome extension for writing notes in the side panel. It stores two things, both on your device:

• Your notepads and settings, in chrome.storage.local. This is local browser storage. Chrome does not sync it to your Google account or anywhere else.
• Which notepad each tab is showing, in chrome.storage.session. Chrome clears this when the browser closes.

With sync and sharing off (the default), Sidenote makes no network requests of its own. It has no accounts, no analytics, no advertising and no third-party code.

Sync and sharing (optional)

You can turn on sync in the full view's settings, under Sync & devices, or share a single notepad with Copy share key in its menu. Both work with keys instead of accounts:

• A sync key links your own computers. A share key gives someone access to one notepad and its subpads: an edit key lets them change it, a view-only key lets them read it but never change it. Keys are made at random on your device. Anyone who has a key can read and edit what it covers, so treat keys like passwords.
• What is sent. The notepads covered by your keys (title, text, colour and place in your list) and, with sync on, a small index of which notepads you have, which you starred or archived, their order and your look settings. All of it is encrypted on your device with AES-256-GCM, using a key derived from your Sidenote key, before it is sent.
• What the service sees. The sync service at sidenote-sync.netlify.app, run by the developer on Netlify, stores the encrypted data under an identifier that is a one-way hash of your key, with a revision number and a time. Your keys themselves never leave your device, so the service cannot decrypt anything. Like any website, Netlify keeps standard request logs, which include IP addresses, under Netlify's privacy policy.
• What it is used for. Only to keep your notepads in step between your devices and the people you shared them with. It is never read, analysed, sold or used for anything else.
• Deleting. Deleting a notepad you made replaces its stored copy with an encrypted deletion marker on the next sync, which removes it from every device that has it. Removing a notepad someone shared with you only removes your copy. Turning sync off on a device stops it syncing and deletes nothing.

Permissions and why they are needed

• Side panel shows your notepad in Chrome's side panel, only on the tab where you open it.
• Storage saves your notepads and settings in your browser, as described above.
• Tabs is used in two cases. When you choose "Link this page", Sidenote reads the current tab's address and title and puts a link to it in your note. When you open the full view, Sidenote looks for an existing Sidenote tab so it can switch to it instead of opening a second one. Sidenote does not record or keep your browsing history.
• Alarms schedules the reminders you write in a note (for example “@tomorrow 9am”), on your computer.
• Notifications are optional. Sidenote asks the first time you make a reminder, then shows it at the time you set. Nothing about a reminder is sent anywhere beyond your synced notes.
• Unlimited storage lifts Chrome's 10 MB limit on local storage so a large set of notes keeps saving. It does not send anything anywhere.
• Scripting and access to web pages are optional and off by default. If you turn on the page shortcut in Settings, Chrome asks for permission to run a small script on web pages. It only watches for the key combination you chose and tells Sidenote to open; it does not read or send anything from the page. Turning it off removes the permission.

Links you open

When you click a web link inside a note, Chrome opens that site in a new tab. From then on, that site's own privacy policy applies. Sidenote is not involved in the visit.

Your control

• Export all notepads as a JSON file from the settings sheet in the full view. The file is saved to your computer.
• Delete any notepad from its menu.
• Turn sync off on any device from Settings → Sync & devices.
• Uninstall the extension and Chrome deletes everything Sidenote stored.

Children

Sidenote collects no personal information from anyone, including children.

Changes

If this policy changes, the new version will be posted on this page with a new date. Version 1.2 added the optional, encrypted sync and sharing described above. Version 1.5 added view-only share keys and reminders (alarms, and notifications if you allow them). Sync keeps no extra copy of your notes on your computer, only small fingerprints of each line, used to merge edits made at the same time.

Contact

Questions about this policy can be sent through the support link on Sidenote's Chrome Web Store page, or as an issue on GitHub.