Draft — this page is being reviewed and may change before the public launch.
Privacy Policy
Last updated: 2026-10-31
Sidekick Note is a notes app made of the website sidekicknote.com, the web app at app.sidekicknote.com and the Sidekick Note extension for Chrome. It is run by the Sidekick Note team (“we”, “us”). This policy explains what we collect, why, and the choices you have. The short version: protected by default, private when you need it — every note is encrypted (Standard protection, staff can’t browse notes), notebooks you make private are end-to-end encrypted so only you can open them, we show no ads, we use no analytics or tracking, and we do not sell data.
1. Your account (IDUnify)
You sign in with an IDUnify account. When you sign in, IDUnify tells us your account ID, name, e-mail address and profile picture (if you have one). We use them only to sign you in, to show who is signed in, to keep the same account across the web app and the extension, and to contact you about your account. For each account we also keep your plan (for example Free), its limits and an end date for a plan given to you, the date you joined and when you last signed in.
2. Your notes and images — protected by default, private when you need it
- Standard protection (every note). Notes, notebooks, settings that sync, device names and images are encrypted on your device (AES-256-GCM) before they sync, and they stay encrypted in our database, in image storage and in your browser’s storage. The key is a random key made for your account. It is stored only in wrapped (encrypted) form, by Google Cloud Key Management Service (KMS). A single server function unwraps it — only for your own signed-in account — and sends it to your device over an encrypted connection; your device keeps it in a form that cannot be exported. There is no admin tool that shows note content, and our staff do not browse notes. Account recovery is simply signing in with IDUnify.
- Private notebooks (end-to-end). You can make any notebook private. It gets its own random key, locked by a passphrase you choose and a recovery code shown once. The passphrase and the recovery code never leave your device, and we never get that key — we cannot read notes in a private notebook, and we cannot recover them if you lose both the passphrase and the recovery code. A private notebook’s name is kept with Standard protection so it can show (locked) on your devices; its notes, their AI chats and images added to them are end-to-end encrypted.
- Our servers also keep the technical details needed to sync: an item ID, a version number, the encrypted size, a deleted flag, timestamps and, for notes in a private notebook, which notebook key they use. We do not use your notes for advertising or to train AI.
- Your device keeps an encrypted copy (browser storage) so the app is fast and works offline. The account key stays in this browser profile until you sign out. Private notebook keys are kept only in memory while the notebook is unlocked; they lock with Lock, after the auto-lock time and when you close the app.
- Accounts made before 31 October 2026 used a passphrase for every note. The next time you unlock with that passphrase, your account switches to Standard protection — your notes are not re-encrypted, the same key is now held in KMS, and the passphrase and recovery code are no longer needed.
- Where it is stored: Google Firebase / Cloud Firestore (United States multi-region) for notes and account records; Google Cloud KMS (United States, us-central1) for wrapped account keys; DigitalOcean Spaces (United States, San Francisco) for encrypted images.
3. Sharing and publishing
If you choose to share or publish a note, the shared copy is meant to be read by other people, so it is not end-to-end encrypted the same way: anyone with the link (and the password, if you set one) can read it. You can stop sharing at any time.
4. AI features (only when you ask)
- AI runs only when you press an AI action. Before you send, the app shows what will be sent (for example “this selection” or “the text of this page”). You can turn AI off per device and mark any note “never send to AI”. A note in a private notebook is sent to a cloud AI (Sidekick AI or your own key) only after you confirm it for that note; on-device AI keeps it on your device.
- Sidekick AI: the text you choose is sent through our server function to the IDUnify AI service and on to the AI model, and the answer comes back to you. The text is passed through only — not stored and not logged by Sidekick Note or the IDUnify AI service. To count AI credits, the IDUnify AI service keeps usage records only: account, app, feature, model, amount used and time.
- Your own API key: if you add a key for another AI provider, the text goes from your device straight to that provider under its own terms. Your key is stored only inside your encrypted settings.
- On-device AI: if you choose Chrome’s built-in AI, the text stays on your device.
5. The Chrome extension
- The extension reads the address and title of the tab next to the side panel to show the notes pinned to that page. It does not keep or send your browsing history.
- It reads the content of a page only when you press a page action (save selection, page info, summarise or ask this page). Page text used for AI is handled as in section 4; selections you save become part of your encrypted notes.
- No content scripts stay on pages, the extension changes nothing on the pages you visit, and it loads no remote code.
Chrome Web Store — Limited Use. The use of information received from Google APIs and from Chrome will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this data only to provide and improve the extension’s single purpose (notes beside the page you are on). We do not sell it, we do not use or transfer it for advertising, credit-worthiness or lending, and no human reads it, except with your explicit permission, for security or abuse investigations, or when the law requires it.
6. Cookies and local storage
sidekicknote.com uses only cookies needed for sign-in: sn_idu (keeps you signed in, 30 days), sn_sso (protects the sign-in step, 15 minutes), idu_try and idu_off (remember whether to check quietly if you are already signed in to IDUnify). The web app and extension use browser storage for your encrypted notes and for device preferences such as theme and layout. We use no advertising or analytics cookies.
7. Logs and security
Our hosting providers keep standard server logs (IP address, browser type, time, page requested) to run and protect the service. Our server functions do not log tokens, e-mail addresses or note content. Sign-in attempts are rate-limited using a one-way hash of the IP address that expires automatically.
8. Who we share data with
We do not sell or rent personal data and we do not share it for advertising. We use these service providers to run Sidekick Note: Google Firebase / Google Cloud (sign-in tokens, database, server functions, key management (KMS), web hosting), DigitalOcean (encrypted image storage), our web host for sidekicknote.com, IDUnify (accounts and the AI service) and the AI model providers it uses. We may disclose information if the law requires it.
9. How long we keep data
- Notes you delete go to Trash. The encrypted copy is removed from our servers automatically about 30 days after you delete it. Database recovery copies roll over within about 7 days.
- Account records are kept while your account exists. When you ask us to delete your account, we delete your Sidekick Note account record, encrypted notes and images within 30 days.
- Usage records for AI credits are kept by the IDUnify AI service as long as needed for credit and billing history.
10. Your choices and rights
You can export all your notes at any time (.md, .html, .zip), delete notes, turn AI off, and sign out. You can ask us to access, correct or delete your personal data, or to delete your account, by writing to support@plaazaa.com. If you live in a place with data protection laws (for example the EU/UK GDPR or a US state privacy law), you also have the rights those laws give you, including the right to complain to your data protection authority.
11. Children
Sidekick Note is not meant for children under 13, and we do not knowingly collect their personal data.
12. Changes
If we change this policy we will update the date above, and for important changes we will tell you in the app or by e-mail before they apply.
13. Contact
Questions or requests: support@plaazaa.com.