Privacy policy

Last updated 26 October 2026

Scratchpad is a notes app. This policy explains what we collect when you use scratchpad.sh and app.scratchpad.sh or visit a page published on scratchpad.to, what we do with it, who helps us run the service, and the choices you have. The short version: your notes are yours, we never sell anything about you or use it for advertising, and what we store of a locked note can't be read without its password, even by us.

Who we are

Scratchpad.sh ("Scratchpad", "we") is the business that runs the service, and it is responsible for your personal information.

Scratchpad.sh 330 Avro Pointe-Claire, QC H9R 5W9 Canada hello@scratchpad.sh

Our person in charge of the protection of personal information can be reached at the same email or mailing address. Put "Privacy" in the subject line so it reaches them quickly.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a one-way hash we can't turn back into the password.
• What you set up to sign in securely: two-step sign-in secrets, backup codes, and the public half of your passkeys.
• If you sign in with Google or Apple, the name and email address they give us, and an identifier for your account with them. If you chose Apple's Hide My Email, we get a relay address that forwards to you, never your real one.
• For each signed-in session: the date, your IP address, and the browser you used, so you can see and end sessions.

What you put in Scratchpad

• Your notes, folders, tags, and version history.
• Files you add: photos, PDFs, audio, video, and anything else, plus the text we read out of them so search can find it.
• Transcripts of voice memos, your reminders, and your conversations with the assistant.
• Share links you create, the email addresses you invite, and the name a guest types when they open a shared note.

Billing

Payments are handled by Creem, our merchant of record. Creem collects your payment details directly. We receive your plan, its status, and your billing dates, and we never see or store your full card number.

What we need to run the service

• How many AI assistant messages and transcriptions you've used, so plan limits work.
• Server logs: IP address, date and time, the page or address requested, and the browser, used for security and to fix problems.
• Your preferences, such as your time zone and theme.

Applying for the student discount

• Your name, the email address we reply to, your school, which plan you'd like and how you'd like to be billed, and anything you write in the form.
• Your school email address, if you give one, and whether you confirmed it.
• A photo or document showing you're a student, if you upload one, and the type and size of each file.
• A scrambled form of your network address (a hash, not the address itself), used to stop the form being flooded.
• When you applied, when it was ready for us to look at, and what we decided and when.
• If we approve you, a record of your discount: your email address, your account once you have one, when you were first approved, and when your discount needs checking again.

Visiting scratchpad.sh

There is no advertising, and nothing here is sold or shared with anyone. Your browser loads fonts from Adobe Fonts, which receives your IP address when it does.

Save to Scratchpad: the app and browser extensions

Save to Scratchpad, for iPhone, iPad, and Mac, and as an extension for Safari, Chrome, and Firefox, saves pages and text to your account. Each time you save, it sends us the page's address and title, the tags you typed, and either the page itself or the text you selected, so we can make it into a note. It sends nothing else, and only when you press Save or share to it.

To connect it, you paste a capture key you made in Scratchpad. The key can only add things to your account: it can't read, change, or delete your notes. The app keeps the key, and a short list of what you saved recently, in your device's keychain; the browser extensions keep the key in the browser's own storage for extensions. None of them has advertising, analytics, or tracking. You can revoke a key in Settings at any time, and it stops working at once.

Page counts

We count page views on scratchpad.sh and inside the app, using our own analytics software running on our own server at t.scratchpad.sh. No third party is involved and nothing is sent anywhere else.

It sets no cookies and does not follow you between sites. For each page view it records the address of the page, the page before it if you arrived from a link, your browser, operating system, screen size, language, and a country worked out from your IP address. Your IP address itself is not stored.

It also records how long each page stays open and how far down it is scrolled. When someone starts a plan, it records which plan and its price, never who started it.

Inside the app, the address is stripped before it is sent. Note identifiers, share link tokens, invitation codes and anything in the query string are replaced, and the page title is replaced too, so a note's name never reaches it. What we see is that someone opened a note, never which note.

If you would rather not be counted, any tracker blocker will stop it, and we do not treat that as a problem.

How we use it

• To run Scratchpad: store and sync your notes, search them, send your reminders, and keep your account secure.
• To send emails about your account: sign-in codes, password resets, reminders you set, and notices about your trial, payments and plan.
• To send tips about using Scratchpad, if you agreed to them. Every one of those emails has an unsubscribe link.
• To check that you're a student and put your plan on the student price, if you apply for the student discount.
• To apply plan limits, prevent abuse, and enforce our acceptable use policy.
• To meet our legal obligations.

We don't sell personal information, we don't use your notes for advertising, and we don't use your notes to train AI models.

The assistant and transcription

When you ask the assistant something, we send the AI provider what it needs to answer: your question, the conversation so far, the note you have open, and the text of files in that note. With the messages included in your plan, the provider is Anthropic. If you add your own API key, it's the provider you chose (Anthropic, OpenAI, or Google), under your own agreement with them.

Voice memos are transcribed on our own servers. Your audio isn't sent to another company to do it.

Locked notes

A locked note's text and its version history are encrypted with a key made from its password. To lock or open the note, your password is sent to our server over an encrypted connection, and the server does the encrypting and decrypting. While the note is open, the server holds its key in memory, never on disk. The database and every backup hold only the encrypted text, so nothing we store can be read without the password, or without Face ID or Touch ID if you set that up to open the note. We can't recover a locked note for you: if the password is lost, so is the note, unless you've set up Face ID or Touch ID to open it. Four things in a locked note aren't encrypted: its name (its first line, or the name you give it), so it can still show in your list; its password hint, if you give one; the wording of reminders set in it, so they can reach you; and the pictures, recordings, and files in it, which anyone with their link can open.

Sharing and publishing

Anyone who has a share link can open that note with the permission you gave the link. A published note is public at its scratchpad.to address: anyone can read it, search engines can index it, and other people can copy or archive it, even after you unpublish it. We may check published pages, and the links on them, for abuse.

Who we share it with

We share personal information only with the companies that help us run Scratchpad, only for that purpose, and when the law requires it.

If Scratchpad is ever sold or merged, your information would move to the new owner under this policy, and we'd tell you first.

Where it's stored

Our servers and the companies above may store and process your information outside Quebec and Canada, including in the United States and the European Union. Their laws may give authorities there access to it.

How long we keep it

• Your notes, files, and account stay for as long as your account is open.
• When your account is closed, we delete your notes and files from our servers within 30 days. Copies in our backups are gone within 90 days, as those backups are replaced.
• If your trial ends without a subscription, or a payment fails, your account is paused and your notes are kept. We email you before we would ever delete a paused account.
• A photo or document you upload for the student discount is deleted as soon as we've reviewed it, or after 30 days if we haven't. It's stored apart from everything else and is never included in our backups.
• The rest of a student discount application (everything listed under "Applying for the student discount" above, apart from the proof itself) is deleted 90 days after we've decided on it. Copies in our backups are gone within 90 days after that, as those backups are replaced. If you'd like it gone sooner, email us and we'll delete it.
• The record of an approved student discount is deleted when your account is closed. If you were approved but never made an account, it's deleted once the discount would have ended.
• Server logs are kept for a short time, for security and troubleshooting.
• We keep billing records for as long as tax law requires.

Your rights

You can ask to see the personal information we hold about you, correct it, get a copy in a format you can take elsewhere, or have it deleted. You can export your notes at any time, and unsubscribe from tips emails from any of them. Email hello@scratchpad.sh and we'll answer within 30 days.

If you're not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

Security

Everything travels over encrypted connections. Passwords are hashed, two-step sign-in and passkeys are available, locked notes are encrypted, and access to our servers is limited. No service is perfectly secure, so if a breach puts you at risk of serious harm, we'll tell you and the authorities as the law requires.

Cookies

We use a few cookies to make Scratchpad work: to keep you signed in, to remember which locked notes you've opened, to remember your theme, and to remember the name a guest gave on a shared note. We don't use advertising or tracking cookies, and our page counts (above) set no cookies at all.

Children

Scratchpad isn't for children under 14, and we don't knowingly collect personal information from anyone under 14. People aged 14 to 17 can use it with a parent or guardian, who agrees to our terms with them and sets up any plan.

If you're a parent or guardian and you think a child under 14 has given us personal information, email hello@scratchpad.sh. We'll delete it.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change matters, we'll email you before it takes effect.