Privacy

Anything you upload is public

A board is protected by its link, not by a password. Anyone who has the link — or who is given it by someone else — can open the board, read every file on it, and download them. There is no sign-in on any of this. Boards are excluded from search engines, and the links are long enough not to be guessable, but that is the whole of the protection: treat a board link the way you would treat the files themselves. Don't upload anything you would mind a stranger reading, and don't upload other people's personal information.

What we store

• The files you upload, their original filenames, and each file's size, kept on our server until someone deletes them.
• A display title for a file if you typed one instead of using the filename (optional, free text).
• The time each file was uploaded, shown publicly on the file's row.
• The workspace name you typed and the slug derived from it.
• The course code and title the owner created.
• An uploader name if you typed one (optional, free text).
• A one-time manage token for each upload. It is what the "delete your own file" link contains, so it stays with the file until the file is deleted.
• A content fingerprint (SHA-256 hash) of each file, used to skip duplicate uploads and to stop files the operator removed from being re-uploaded. Fingerprints of operator-removed files are kept after the file itself is gone; a fingerprint can't be turned back into the file.
• If you report a file: the report reason and your IP address, used only to review the report.
• Your IP address as a rate-limit counter when you create a board, upload a file, report a file, or try the operator login. These counters live in a short-lived cache and exist to blunt automated abuse, not to identify you.
• When a board was last opened. One timestamp per board, overwritten each visit — it tells the operator which boards are still in use. It records no visitor details and keeps no history.
• The board's owner secret, and an upload passphrase if the owner sets one — both stored only as one-way hashes, so we can't read them back.
• An optional recovery email if the owner opts in. It is stored encrypted at rest and used only to send a fresh owner link when requested.
• Standard server logs (IP address, request path, timestamp), used for security and debugging, not analytics.
• A session cookie to remember owner-mode unlocks and passphrase entries within a single visit, and the session record it points at on our server. That record holds your IP address and your browser's user-agent string (browser and operating system version), which is how the session is kept secure. It is deleted when the session expires.
• A small browser-side recent boards cookie if you open a board in owner mode, so this browser can show shortcuts back to boards you've recently managed.
• A browser-side theme preference (light, dark, or system) stored locally on this device only.

How long we keep it

SlipNote does not auto-delete your content. Files, workspaces, and course details are kept until someone removes them — an uploader deleting their own file, the owner deleting files, or the operator removing content. A board that is never touched stays indefinitely. Report details, including the reporter's IP address, are retained only for as long as needed to review the report and are not used for anything else. The two things that do expire on their own are session records and the IP rate-limit counters, both of which are short-lived and discarded automatically.

Age

SlipNote is intended for students in higher or further education and is not directed at children under 13. We don't knowingly collect personal information from children under 13. If you believe a child has uploaded personal information, report the file or contact the operator and it will be removed.

Your rights

Depending on where you live (for example under GDPR or CCPA), you may have the right to access, correct, or delete personal information about you, or to object to its processing. Because SlipNote holds so little — no accounts, no profiles — most of this is self-service: delete your own file with its delete link, or ask the workspace owner or site operator. For anything else, contact the operator of the specific site.

What we don't do

• No analytics product, no advertising, no profile building, and no tracking of you across boards or visits. The one usage figure kept is a single "last opened" timestamp per board, which records nothing about who opened it.
• No selling or sharing of data with third parties.
• No account, password, or email is required to browse, create a board, or upload files.

Email delivery

If the operator enables recovery, recovery emails are sent through the site's configured mail provider. That provider may process message metadata needed to deliver the email. SlipNote itself does not use recovery emails for marketing or mailing lists.

Telegram notifications (optional)

If the site operator has configured Telegram, a one-line notice (course, section, filename, link) is posted to the configured channel on every new upload. This is set by the operator, not per workspace.

Deleting your data

An uploader can remove their own file via the one-time delete link shown after upload. The workspace owner can delete any file in their workspace and can add, change, or remove the workspace's recovery email. There is currently no UI to delete an entire workspace. If you need this, contact the site operator.

Contact

SlipNote is open source. The code is at github.com/otatechie/slipnote. For privacy questions on a specific deployment, contact the operator of that site.