This Privacy Policy (“Policy”) explains what information Pushany (“the Service”) handles, for what purposes, and how.
No ads. We also do not use analytics or tracking tools.
We do not sell your personal information or provide it to anyone for advertising.
Encrypted content (E2EE and share links) cannot be read even by the operator (except content covered by permission for agents to read it, while that permission is on).
1. Operator
Operator: Pushany Operations Office (operated by an individual)
Name and address: Provided without delay upon request
Contact: Help & contact in the app's menu (if you are not signed in, the Contact page)
2. Information we collect
Account
The identifier (ID) of the account you sign in with (Google, GitHub or X)
Your account name (@name). It is visible to the people you share with, who use it to select you. Former @names you have changed, and the @names of deleted accounts, are recorded for 90 days so that no one else can use them
The date and time your account was created
We do not receive email addresses when you sign in. At sign-in, we receive only your account identifier. We do not receive your name, profile picture, contacts, Google Drive data or any other information. The scopes we request are “openid” for Google, none for GitHub, and “users.read” for X, plus “tweet.read”, which X requires alongside it. We never read or write posts.
Content you save
Tray: the text, links, clipboard contents and files you send (including file name, type and size), the sending and receiving devices, and the date and time
Notes: title, body, tags, attachments, pinned status, and when they were created and last edited
Past versions of notes (history), tags you create, and items in the trash
Reminders: when to notify you, repeat settings, time zone, notification language and the devices to notify
For imported notes, their identifier in the source app (to avoid importing the same note twice)
Checklists and sharing
Checklists: item text, notes, section names, and the list's name, color and icon (these are encrypted); when items were checked; due dates and times; flags and priority; reminder times and who is notified; and the order of items
Sharing: the people (accounts) you share notes and checklists with and have invited, who invited them, when they joined, and their role. For invite links, the expiry and a hash used to verify the link
Checklist history: who did what and when (add, edit, check, delete), along with the item text at that time (encrypted)
Contacts: the people (accounts) you have shared with, and the names you gave them (these names are encrypted and are not visible to the other person)
Notices: records about sharing, sign-in methods, passkeys, encryption keys, device approvals and similar events (the other person's name, the passkey's name, the type and approximate location of an approved device or of the device that added or used a passkey, and the time, without note or list names), replies to your inquiries, and notices from the operator to all users
Sharing keys: your public key, and your private key encrypted with your own key (our server cannot decrypt it). A shared list's or note's key is encrypted with the other person's public key before it is passed on. Records of safety numbers used to check other people's public keys are also stored encrypted
Share links
A copy of the file encrypted on your device, the encrypted file name and type, its size, and when the link was created and expires
We never receive the decryption key (it is contained only in the part of the link after “#”, which is not sent to our server)
Devices
Device name, type (such as the OS), when it was registered and when it was last used
For devices with notifications turned on, the subscription details (the push service's endpoint URL and the keys used to encrypt notifications)
Agents (ChatGPT, Claude, etc.)
The names of agents you have allowed, when you allowed them and when they were last used, whether and since when you have allowed them to read your content, and the language used when you allowed them. Sign-in tokens are not stored; only hashes used for verification are stored
Agent activity records: the type of action (adding items, creating a list, etc.), the target list, the time, and whether it succeeded. Contents are not recorded
The names of lists shown to agents (not encrypted, so they can be provided to the agent)
Your device's time zone (so that times like “tomorrow morning” are interpreted in your local time)
API keys
The API key's name, the device it is linked to, and when it was created and last used
We do not store the API key itself, only a hash used for verification
Chrome extension
When you sign in with the extension, it is registered as one of your devices and an API key is issued for it (stored as described under "Devices" and "API keys" above)
Only when you choose to send or save something does the extension read the tab's URL and title, the text or image you selected, the screenshot you took, or the article's text and images, and send them to the Service. If E2EE is on, they are encrypted on your device before being sent. The extension does not collect your browsing history or read pages you have not acted on
When you send a link, the extension reads the page's title, site name and image and attaches a small preview to the item. For a link you right-clicked, the extension may fetch that page (without cookies)
The clipboard is used only when you choose to paste or copy
Sign-in state
A cookie that keeps you signed in (a random value; the server stores only its hash and expiry. It is valid for up to 1 year, or 12 hours after last use on a device with “Don't save keys on this device” turned on). If you sign in with a passkey, we also record which passkey was used
A cookie valid for 10 minutes, used during sign-in (Google, GitHub or X)
A single-use value valid for 10 minutes, used when you sign in with a passkey or add one
Passkeys
If you add a passkey: the passkey's identifier, public key and name, its signature count, whether it syncs, when it was created, last used and last used to sign in, and your keys encrypted with a key derived from the passkey (our server cannot decrypt them)
We never receive the passkey's private key or biometric data such as your fingerprint or face. We also never receive the value used to derive keys from the passkey
E2EE (encryption)
A value used to derive your keys, data used to verify that a key is correct, and your keys encrypted with keys derived from your recovery key and similar (our server cannot decrypt any of these)
If you add a passkey: your keys encrypted with a key derived from the passkey (see “Passkeys” above)
If you use locked notes: a value used to verify your PIN, the key for locked notes encrypted with keys derived from your PIN and similar, and the number of wrong PIN attempts in a row (we never receive your PIN, and our server cannot decrypt locked notes)
We never receive your recovery key or PIN. Except in the agent case described in section 8, we never receive your keys in a form our server can decrypt
Key transfer requests (device approval): the requesting device's name, its type (OS and browser), its approximate location estimated from the IP address (country, region and city), a one-time public key, and the time. Once approved, the encryption keys encrypted with a one-time key (our server cannot decrypt them). Requests expire after 10 minutes
Inquiries and reports
Inquiries: the message, the user (account) who sent it, and the time
Inquiries sent without signing in: the message, the email address for our reply, and the time
Share link reports: the report, the share link it concerns, and the time (reports can be sent without signing in)
Access logs
The Service runs on Cloudflare. Each time you access it, Cloudflare processes your IP address, user agent (browser and OS type), the URL accessed, the time and similar information.
The operator keeps these logs for a short period (a few days) to investigate problems. URLs may include search terms, and the names and captions of files that are not encrypted.
When an error occurs, we record device and item IDs (not their contents).
To limit large bursts of activity, we temporarily use your IP address or account ID.
To limit how many accounts can be created from the same network, when you sign up we keep a value derived from your IP address for one day (not the address itself).
3. What we don't do
We do not show ads.
We do not use analytics, advertising or tracking tools (such as Google Analytics), and we do not track your activity on other sites.
We do not sell personal information, and we do not provide it to third parties for advertising.
Our server never fetches the pages behind the links you send (we do not generate previews or perform similar processing).
4. How we use information
We use the information only for the following purposes:
To provide the Service (storage, syncing between devices, notifications, sharing, share links, agent integration, import and export, and so on)
To sign you in and verify your identity
To prevent misuse and attacks (such as rate limiting)
To investigate and fix problems, and to improve the Service
To respond to your inquiries, and to handle reports (checking for and acting on use that violates the Terms)
To send important notices, such as changes to the Terms or discontinuation of the Service
To comply with the law
If we introduce a paid plan, we will add how we handle payment information to this Policy and notify you beforehand.
5. Consent and disclosure to third parties
By signing in, you agree to this Policy (including the processing outside Japan described in section 7).
We do not provide your personal information to third parties without your consent, except:
Where required by law (including formal legal requests from courts, police and similar authorities)
Where it is necessary to protect a person's life, body or property and it is difficult to obtain your consent
In other cases permitted by Japan's Act on the Protection of Personal Information
Using the service providers listed in section 6 is entrustment for the purpose of running the Service, and does not constitute provision to third parties in this sense.
If you create a share link and give it to someone, that person can view the file. This happens at your direction.
When you share a checklist or note, its contents and the account names (@names) of its members and pending invitees are visible to the members (email addresses are not). This also happens at your (and the members') direction.
When you allow an agent (ChatGPT, Claude, etc.), the names of the lists shown to agents and the results of its actions are provided to the agent's provider (OpenAI, Anthropic, etc.). If you have allowed it to read your content, the content it reads is also provided. For a shared note or checklist, if the owner or an admin turns on “Allow agents to read contents”, its content is also provided to the agents of members who have allowed them to read their content. What you ask the agent is handled under that provider's policies. This also happens at your direction. You can revoke access at any time in Settings → Integrations.
6. Service providers (processors)
To run the Service, we use the services of the following companies. Each company handles data in accordance with its own privacy policy and agreements.
Cloudflare, Inc. (USA): running the app and server, the database, file storage, real-time sync, access logs and rate limiting. All of the Service's data is stored and processed here.
Google LLC (USA): signing in with your Google account. Google will know that you signed in to the Service.
X Corp. (USA): signing in with your X account (only if you sign in with X). X will know that you signed in to the Service.
Your browser's push service: used to deliver notifications. Which service is used depends on your browser (for example, Apple for Safari and iPhone, Google for Chrome and Android, Mozilla for Firefox, Microsoft for Edge).
Notification contents are encrypted so that only your device can decrypt them. The push service cannot read them, but it can see the destination, the time and the size of the data.
A notification contains the title (up to 100 characters), the beginning of the text (up to 200 characters) and the link URL. For items sent with E2EE, it contains only the ID and type, and the content is decrypted and displayed on your device.
A notification that cannot be delivered may be retained by the push service for up to 24 hours.
GitHub, Inc. (USA): signing in with your GitHub account (only if you sign in with GitHub; GitHub will know that you signed in to the Service), and storing database backups. Backups are encrypted with a passphrase before they are stored (section 9). They do not include file contents.
7. Processing outside Japan
The companies above are based in the USA. Your data may be stored and processed outside Japan (for example, in the USA).
Cloudflare has data centers around the world and handles each request at a location near you, so we cannot determine in advance which country your data will be processed in.
The USA has no federal law that covers personal information in general, as Japan's Act on the Protection of Personal Information does. Instead, it has state laws (such as the California Consumer Privacy Act) and sector-specific laws. Information on each country's system is available from Japan's Personal Information Protection Commission (in Japanese).
Each company sets out measures to protect personal data (such as access restrictions and encryption) in its privacy policy and data processing agreements. Please contact us if you would like more details.
8. End-to-end encryption (E2EE)
E2EE is on from the moment you first use the Service and cannot be turned off. Text, links, clipboard contents, note titles and bodies, tags, and the contents and names of files and attachments are encrypted on your device before they are sent.
Your keys are generated on your device, and the server stores them only in a form encrypted with keys derived from your “recovery key” (one the app generates on your device, or one you set yourself) or similar. The recovery key is never sent to the server. Neither the server nor the operator can read your content (except in the agent cases described below).
A new device receives the encryption keys when you approve it from a device you already use. The keys are encrypted with a one-time key before they are sent, so the server only relays them and cannot decrypt them.
The following are not encrypted: dates, the number of items, file sizes, the type (whether an item contains text, links, images, videos or files), your account name (@name), device names, API key names and whether a note is locked. The following are also not encrypted: whether checklist items are checked, due dates and reminder times, flags and priority, who you share with and who you have invited, each person's role, the “who did what and when” part of the history, and your contacts (who you have saved). Item text, notes, names and the names you give contacts are encrypted.
Text and links sent from Shortcuts are encrypted with your public key as soon as our server receives them, and the unencrypted content is not stored. Our server can read the content while receiving it. Files sent from Shortcuts are not encrypted.
If you lose your recovery key and no device still holds your encryption keys, nobody — not even the operator — can recover the encrypted content.
Files for share links are also encrypted on your device.
Items and lists an agent adds are encrypted with your public key as soon as the server receives them, and are re-encrypted with the list's key when they are opened on your device. The server does not store what it received.
When you turn on “Allow access to contents” (Settings → Integrations, or when allowing an agent), your device sends your encryption keys to the server, which stores them encrypted with the operator's secret key and decrypts them only when an agent reads or writes. While this setting is on, the Service's server can read your data. When you turn it off, the stored keys are deleted immediately and your device renews your encryption key (the deleted keys may remain in backups kept for recovery from failures for up to about 90 days). The permission turns off automatically when the agent hasn't used it for a while or after a set period. Shared notes and lists, and locked notes, cannot be read even while it is on. This is because their keys are encrypted with a separate key such as the protection key, not your encryption keys. The protection key is stored only in a form our server cannot decrypt.
When the owner or an admin of a shared note or list turns on “Allow agents to read contents”, a device sends that note's or list's key to the server, which stores it encrypted in the same way. While it is on, the Service's server can read that note's or list's content. When it is turned off, the stored key is deleted immediately and a member's device renews the key. This permission also turns off automatically when it hasn't been used for a while or after a set period. Agents can add items to a shared list with this setting off only if its name is shown to agents.
With the “PC agent” (Settings → Integrations), a command on your PC receives encrypted data and decrypts it on your PC to read and write. No plaintext is sent to our servers. The API key and encryption keys used for this are stored on your PC.
Your account and saved content: retained until you delete your account.
Trash: items are automatically and permanently deleted 30 days after being moved to the trash (deletion runs once a day, so it may be delayed by up to about a day). To delete items immediately, use “Empty trash”.
Note history: up to the 20 most recent versions per note are kept for up to 90 days (versions older than 90 days are deleted once a day). Permanently deleting a note also deletes its history.
Share links: expire after 7 days, and the file copies are then deleted in a daily cleanup. When you disable a link or move the original file to the trash, the copy is deleted immediately.
Checklist history and sent reminders: deleted in a daily cleanup after 30 days. History is limited to the 1,000 most recent entries per list.
Notices: notices addressed to you are deleted after 90 days, and notices from the operator to all users after 180 days (in a daily cleanup).
Agent connections: agent activity records are deleted after 90 days (in a daily cleanup). Access that has not been used for 90 days expires and is deleted. When you revoke access, its records are deleted immediately.
Sharing invitations: retained until the invitee joins or the invitation is cancelled.
Key transfer requests: deleted as soon as the keys are received. Requests that are not completed expire after 10 minutes and are deleted in a daily cleanup.
Sign-in state: up to 1 year (12 hours after last use on a device with “Don't save keys on this device” turned on). Signing out immediately removes the sign-in state for that device. Removing a passkey also removes sign-ins made with it on other devices.
Passkeys: kept until you remove them. The single-use values used to sign in with or add a passkey are deleted once used. Unused ones expire after 10 minutes and are deleted in a daily cleanup.
Notification subscriptions: deleted when you turn off notifications, delete the device, or the push service reports the subscription as invalid.
Access logs: deleted automatically after a few days.
Inquiries and reports: retained so that we can respond. If you delete your account, the link between you and the message is removed (the content is retained as a record of how it was handled).
When you delete your account
Settings → Delete account immediately deletes your account, saved content, files, devices, API keys and share links from our server. However, the following are retained for a limited time:
Database restore records (a Cloudflare feature): up to about 30 days
File copies: files you send and note attachments are also copied to a separate location in case of accidents. These copies are deleted 30 days after you delete the files.
Database backups: created weekly, encrypted, and kept for about 90 days. Deleted data may remain in these backups during that period.
These are used only to recover data after failures or accidents, and are deleted automatically when the period ends. If we restore from a backup, we will delete the data of deleted accounts again (for this purpose, we keep only the IDs of deleted accounts).
Notes and checklists you own and share with others are not deleted. They are transferred to the admin who joined first (or, if there is none, the editor who joined first, then the viewer who joined first), so that other people's content is not lost.
You are also removed from other people's contacts and invitations. Your @name is recorded for 90 days so that no one else can take it (to prevent people from sharing with someone else by mistake). Your link to entries in checklist history is removed.
10. Data stored on your device
The Service also stores the following data on your device (in your browser). This data is not used for tracking or advertising.
Cookies: the cookie that keeps you signed in (see section 2). No other cookies are used.
Local storage: the device ID, display settings (theme, language, font size and so on), unsent drafts, share links you created (URLs containing the key), and account and device information used to speed up startup
IndexedDB:
Your E2EE encryption keys (extracted only for device approval or adding a passkey. The locked notes key is not stored)
The one-time key for a request awaiting approval (stored in a non-extractable form)
Records of the safety numbers of people you share with
An index for searching encrypted items on your device (decrypted text, titles, URLs and file names, but not file contents)
Notes written while offline (waiting to be sent) and a copy of part of your lists. E2EE notes are also kept unencrypted on the device until they are sent
Your setting for which browser opens links
Chrome extension: the extension's storage holds the API key used to sign in, your list of destinations, unsent drafts and settings. The E2EE key is stored in a non-exportable form, as in the app
Cached app files: so that the app can start while offline
On a device with “Don't save keys on this device” turned on, the keys, the search index, notes waiting to be sent, drafts and similar data are not saved on the device and are deleted when you close the tab.
Signing out removes the encryption keys, the search index, notes waiting to be sent, share links and drafts from that device. This data may remain on your other devices, or on the device you used to delete your account. On devices you no longer use, please sign out or delete this site's data in your browser.
11. Your rights and choices
View and export: you can view what you have saved in the app at any time. From Settings → Import & export, you can export text and links from your notes and tray (the Markdown zip also includes attachments and files).
Correct and delete: you can edit or delete content, and delete devices, API keys and share links, in the app.
Delete everything: Settings → Delete account deletes your entire account.
Make a request: requests under Japan's Act on the Protection of Personal Information — to disclose, correct, suspend the use of, or erase personal data we hold, to stop providing it to third parties, or to disclose records of such provision — are accepted through Help & contact in the app's menu (or the Contact page if you are not signed in). We will verify your identity and respond as required by law. There is no fee.
Complaints and inquiries: complaints and inquiries about how we handle personal information are accepted through the same channel.
12. Security measures
All communication is encrypted with HTTPS.
The sign-in cookie cannot be read by JavaScript (HttpOnly) and is configured so that other sites cannot easily send it. For sign-in state and API keys, the server stores only hashes.
Every action verifies your account so that no one can access other people's data. We also protect against forged requests from other sites (CSRF).
We limit large bursts of activity in a short time.
Share link files and the content you save are encrypted on your device (text and links sent from Shortcuts are encrypted by our server as soon as they arrive, and files sent from Shortcuts are not encrypted).
Backups are encrypted (AES-256) with a strong passphrase before they are stored, and the unencrypted data is deleted immediately.
Only the operator has administrative access to the server and backups.
If an incident such as a data leak occurs, we will report it to Japan's Personal Information Protection Commission and notify you, as required by law.
13. Children
The Service is not intended for children. Children under 13 may not use the Service.
If we learn that we hold information from a child under 13, we will delete it.
If you are under the age at which your country or region requires a parent's or guardian's consent, please obtain that consent before using the Service.
14. Changes to this Policy
We may change this Policy to reflect changes in the law or in the Service.
We will announce important changes on this page and in the app before they take effect.
If we expand the information we collect or the purposes of use in a way that is not closely related to the current purposes, we will ask for your consent again.
15. Contact
For questions or requests about this Policy or how we handle personal information, please use Help & contact in the app's menu. If you are not signed in, please use the Contact page.
Operator: Pushany Operations Office Effective date: October 16, 2026