Privacy Policy

Effective date: 18 June 2026

OriginText is designed to know as little about you as possible. This Privacy Policy explains what information is collected when you use OriginText (the “Service”), how that information is used and protected, and the choices and rights available to you. The Service is operated by PFG Apps (“PFG Apps”, “we”, “us”, or “our”). By using the Service you acknowledge the practices described in this Policy.

1. Our approach to privacy

OriginText is built on two principles: data minimization and zero-knowledge encryption. By default, your notes never leave your device. If you choose to enable cloud sync, your content is encrypted on your device before it is transmitted, and we store only ciphertext that we are unable to read. We do not use advertising trackers, and we do not sell or rent your personal information.

2. Information we collect

We collect only the information needed to provide and secure the Service:

  • Account information. Authentication is provided through Supabase. An account may be created anonymously, in which case we hold only a generated account identifier. If you register a full account, we store your email address and an authentication record.
  • Note content and metadata. By default your notes are stored only on your device. If you enable sync, we store encrypted ciphertext together with the minimal structural metadata required to synchronize it — such as document identifiers, timestamps, and workspace membership. We cannot decrypt your content.
  • Subscription and billing information. For paid plans we store a subscription record (plan tier, workspace and seat quantities, and status). Payments are processed by Stripe; full payment-card details are entered directly with Stripe and never reach our servers.
  • Technical information. We process the limited technical data necessary to operate and secure the Service, such as authentication tokens and basic server logs. We do not use third-party analytics or advertising technologies.

3. How your content is protected

When sync is enabled, each note is encrypted on your device using AES-GCM with a workspace key derived locally. An optional passphrase lock (PBKDF2) can further wrap that key. Your encryption keys are never transmitted to us. Because encryption happens before data leaves your device, our servers hold only ciphertext and structural metadata. This protection is enforced cryptographically, not merely by policy, and there is no backdoor: if you lose your passphrase and recovery code, we cannot recover your content.

4. How we use information

We use the information we collect to: provide, maintain, and improve the Service; authenticate users and secure accounts; process subscriptions and payments; respond to support requests; and comply with legal obligations and enforce our Terms of Service.

5. Legal bases for processing

Where the EU/UK General Data Protection Regulation applies, we process personal data on the following bases: performance of our contract with you (to provide the Service); our legitimate interests in operating and securing the Service; your consent, where required; and compliance with legal obligations.

6. Service providers and disclosure

We share limited information only with the processors that help us operate the Service:

  • Supabase — authentication and storage of encrypted data.
  • Stripe — payment processing for paid plans.

We do not sell or rent personal data, and we do not disclose it for advertising. We may disclose information where required by law, or where reasonably necessary to protect the rights, property, or safety of our users, the public, or PFG Apps.

7. International data transfers

Our service providers may process data in countries other than the one in which you reside. Where personal data is transferred internationally, appropriate safeguards are applied as required by applicable law.

8. Data retention

Data stored locally on your device remains until you remove it. Where you use cloud features, we retain encrypted content, account, and subscription records for as long as your account is active. Following account deletion, we delete associated data within a reasonable period, except where retention is required to comply with legal obligations or resolve disputes.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing or withdraw consent. You can export your workspace at any time from within the app, and you can delete local data by clearing site storage in your browser. To delete a cloud account and its stored ciphertext, contact us. If you are a California resident, note that we do not sell personal information.

10. Cookies and local storage

OriginText uses your browser’s local storage, OPFS, and IndexedDB to store your notes and preferences on your device, and a session cookie or token to keep you signed in. We do not use advertising or cross-site tracking cookies.

11. Children’s privacy

The Service is not directed to children under the age of 16 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us so we can remove it.

12. Security

We apply reasonable technical and organizational measures to protect information, and our zero-knowledge design substantially limits the data exposed to us in the first place. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above, and for material changes we will provide a more prominent notice. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.

14. Contact us

For questions about this Policy or your personal data, contact PFG Apps using the contact details at pfgapps.com. [Registered legal entity name and address to be confirmed.]