Privacy policy

Last updated September 17, 2026

Scratchpad is a notes app. This policy explains what we collect when you use scratchpad.sh and app.scratchpad.sh or visit a page published on scratchpad.to, what we do with it, who helps us run the service, and the choices you have. The short version: your notes are yours, we never sell anything about you or use it for advertising, and the text of a locked note can't be read by anyone without its password, including us.

Who we are

Scratchpad.sh ("Scratchpad", "we") is the business that runs the service, and it is responsible for your personal information.

Our person in charge of the protection of personal information can be reached at the same email or mailing address. Put "Privacy" in the subject line so it reaches them quickly.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a one-way hash we can't turn back into the password.
• What you set up to sign in securely: two-step sign-in secrets, backup codes and the public half of your passkeys.
• For each signed-in session: the date, your IP address and the browser you used, so you can see and end sessions.

What you put in Scratchpad

• Your notes, folders, tags and version history.
• Files you add: photos, PDFs, audio, video and anything else, plus the text we read out of them so search can find it.
• Transcripts of voice memos, your reminders, and your conversations with the assistant.
• Share links you create, the email addresses you invite, and the name a guest types when they open a shared note.

Billing

Payments are handled by Creem, our merchant of record. Creem collects your payment details directly. We receive your plan, its status and your billing dates, and we never see or store your full card number.

What we need to run the service

• How many AI assistant messages and transcriptions you've used, so plan limits work.
• Server logs: IP address, date and time, the page or address requested and the browser, used for security and to fix problems.
• Your preferences, such as your time zone and theme.

Visiting scratchpad.sh

The website has no analytics and no advertising. Your browser loads fonts from Adobe Fonts and Google Fonts, and those services receive your IP address when it does.

How we use it

• To run Scratchpad: store and sync your notes, search them, send your reminders and keep your account secure.
• To send emails about your account: sign-in codes, password resets, reminders you set, and notices about your trial, payments and plan.
• To send tips about using Scratchpad, if you agreed to them. Every one of those emails has an unsubscribe link.
• To apply plan limits, prevent abuse and enforce our acceptable use policy.
• To meet our legal obligations.

We don't sell personal information, we don't use your notes for advertising, and we don't use your notes to train AI models.

The assistant and transcription

When you ask the assistant something, we send the AI provider what it needs to answer: your question, the conversation so far, the note you have open and the text of files in that note. With the messages included in your plan, the provider is Anthropic. If you add your own API key, it's the provider you chose (Anthropic, OpenAI or Google), under your own agreement with them.

Voice memos are transcribed on our own servers. Your audio isn't sent to another company to do it.

Locked notes

A locked note's text and its version history are encrypted with a key that only its password can open. We can't read, search, scan or recover them, and if the password is lost, so is the note. Three things in a locked note aren't encrypted: its name (its first line, or the name you give it), so it can still show in your list; the wording of reminders set in it, so they can reach you; and the pictures, recordings and files in it, which anyone with their link can open.

Sharing and publishing

Anyone who has a share link can open that note with the permission you gave the link. A published note is public at its scratchpad.to address: anyone can read it, search engines can index it, and other people can copy or archive it, even after you unpublish it. We may check published pages, and the links on them, for abuse.

Who we share it with

We share personal information only with the companies that help us run Scratchpad, only for that purpose, and when the law requires it.

If Scratchpad is ever sold or merged, your information would move to the new owner under this policy, and we'd tell you first.

Where it's stored

Our servers and the companies above may store and process your information outside Quebec and Canada, including in the United States and the European Union. Their laws may give authorities there access to it.

How long we keep it

• Your notes, files and account stay for as long as your account is open.
• When your account is closed, we delete your notes and files from our servers within 30 days. Copies in our backups are gone within 90 days, as those backups are replaced.
• If your trial ends and you don't subscribe, we keep your account for a while so you can come back or export your notes, then delete it. We email you before we do.
• Server logs are kept for a short time, for security and troubleshooting.
• We keep billing records for as long as tax law requires.

Your rights

You can ask to see the personal information we hold about you, correct it, get a copy in a format you can take elsewhere, or have it deleted. You can export your notes at any time, and unsubscribe from tips emails from any of them. Email hello@scratchpad.sh and we'll answer within 30 days.

If you're not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

Security

Everything travels over encrypted connections. Passwords are hashed, two-step sign-in and passkeys are available, locked notes are encrypted, and access to our servers is limited. No service is perfectly secure, so if a breach puts you at risk of serious harm, we'll tell you and the authorities as the law requires.

Cookies

We use a few cookies to make Scratchpad work: to keep you signed in, to remember which locked notes you've opened, to remember your theme, and to remember the name a guest gave on a shared note. We don't use advertising or tracking cookies.

Age

Scratchpad is for adults. You need to be at least 18, or the age of majority where you live, to create an account.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change matters, we'll email you before it takes effect.