Sticky Notes

Sticky Notes is a local-first Chrome extension for notes, workspaces, folders, Kanban boards, calendars, links, code snippets, and personal reference information.

Effective date: November 2, 2026

1. Who we are

Sticky Notes is developed and maintained by Daniel Mengote. For privacy questions or deletion requests, contact danielmengote.prowork@gmail.com.

2. Information the extension handles

Depending on the features you use, Sticky Notes handles:

Account information: email address, optional username, authentication provider information, and session information when you sign in.
User-created content: notes, folders, workspaces, Kanban boards, calendar events, pinned items, preferences, and keyboard settings.
Attachments and resources: images, documents, links, and attachment metadata that you intentionally add to notes.
Authenticator folders: if you use this feature, folder names and encrypted authenticator data are stored separately from normal notes.
Technical information: limited information required for authentication, synchronization, error handling, and local storage. The extension does not intentionally collect browsing history, page content, precise location, contacts, or advertising identifiers.

3. How information is stored

Local storage: Notes, settings, and most application state are stored in your browser. Images and files are stored in browser storage by default, or in the ADX Note Tracker folder when you grant access to a local folder.
Optional Supabase synchronization: When you sign in and use cloud synchronization, the extension stores an account-owned JSON state document in Supabase. This can include workspaces, folders, notes, Kanban data, calendar data, and preferences.
Attachments: Attachment bytes are kept in local browser/file storage and are not included in the normal Supabase synchronization document. Complete JSON backups can embed attachments when you explicitly export them.
Authentication: Supabase Auth handles account authentication. Google sign-in uses Google OAuth through Supabase. The extension uses a publishable Supabase client key; it does not include a service-role key.

4. Sensitive Notes warning

Sensitive Notes mask values in the interface, but ordinary note data is not end-to-end encrypted. If cloud sync is enabled, sensitive note values are included in the account state sent to Supabase. JSON backups can also contain those values. Do not use Sensitive Notes as a replacement for a dedicated password manager, and do not store highly confidential credentials unless you accept this limitation.

5. Why information is used

Information is used only to provide the features you request: displaying and organizing your notes, authenticating your account, synchronizing your state across devices when enabled, restoring backups, and maintaining the reliability and security of the extension.

6. Sharing and third-party services

We do not sell your personal information or use your note content for advertising. Information is shared with service providers only when necessary to provide a feature you request:

Supabase: authentication and optional cloud synchronization.
Google: sign-in information when you choose Google authentication.
Chrome: extension storage, file access, downloads, and the Chrome Identity API required for OAuth.

These services process information under their own policies and terms.

7. User controls and deletion

You can sign out, delete notes, empty Trash, clear workspace data, reset local resources, export a JSON backup, and import a backup from System Settings.
You can disable automatic synchronization and choose whether to upload or fetch data from Supabase.
System Settings includes Delete cloud data. This permanently removes the signed-in account's Supabase synchronization snapshot, keeps the local browser copy, clears its local sync cache, and pauses automatic synchronization so the deleted cloud row is not recreated silently. You can upload the local copy again later as an explicit action.
To request deletion of the Supabase Auth account itself, email danielmengote.prowork@gmail.com from the account you want removed. We will verify the request before processing it through a trusted server-side workflow.
Deleting the extension or clearing Chrome site/extension data removes local browser data, but it does not automatically delete a previously uploaded Supabase copy. Use Delete cloud data before uninstalling, or request cloud deletion separately.

8. Security and retention

We use HTTPS for communication with Supabase and rely on Supabase authentication and row-level access controls for account-owned cloud state. No online service can guarantee absolute security. Local data remains until you delete it, clear browser storage, reset resources, or uninstall/clear the extension. Cloud data remains until you delete it through available controls or request deletion.

9. Changes to this policy

We may update this policy when the extension's data practices or features change. The effective date at the top of this page will be updated when a revised policy is published.