Minimali Privacy Policy

Version 0.2, dated 2026-09-27. Effective on publication at minimali.app/privacy.

Draft, not reviewed by a lawyer. Read README.md in this folder before publishing. Do not publish while any item in its “Before launch” list that this document depends on is open. Sentences tagged [launch N] become true only when “Before launch” item N ships; remove each tag when its item ships. hello@minimali.app does not receive mail yet (item 1). Remove this box when publishing.

This policy explains what Minimali collects, why, where it goes, how long it stays, and what you can do about it.

“Minimali” and “the service” mean the iPhone, iPad and Mac apps, the web app at app.minimali.app, the server at api.minimali.app and the website at minimali.app.

1. Who is responsible

Minimali is run by me, Michael Tzach, a private individual living in Israel. There is no company behind it. Under data protection law I am the “controller” of your personal data: I decide what is collected and why. In this policy, “I” and “me” mean me.

You can reach me at hello@minimali.app, in English or Hebrew.

I have not appointed a data protection officer; the law does not require one for a service like this.

I have not appointed a representative in the European Union or the United Kingdom. Minimali is free, earns nothing, and is run by one person in his spare time. A paid representative would cost more than the service can carry. Please contact me directly; I answer every request myself.

2. The short version

Minimali stores your note on a server so it can sync between your devices. (Minimali has exactly one note per account.) It keeps your account details so you can sign in. It counts how the app is used, but never records the words you write.

Your note is not end-to-end encrypted. It is encrypted on its way to the server, but the server stores it in a form that I, as its administrator, can technically read. I don’t, except as the list below says.

What I never do:

• I never sell your data, and never share it for anyone’s marketing.
• I never show ads.
• I never put note text in analytics. Analytics events describe structure (a line was added, it is a heading, it is indented twice), never words.
• I do not look at your note, except when the law requires it, or when you ask me for help and agree to it. The other exception is when I must investigate a security incident, a bug that damaged your note, or a report that it breaks the Terms. Then I look only as much as that needs.
• I never use your note to train AI models, and I do not put it into AI tools or services.

3. What is collected, and why

3.1 Your account

• Email address. To identify your account and sign you in.
• Password. Stored only as a salted hash (a one-way scrambled form). I cannot see your password.
• Account icon. The server can store a small image as an account icon. No app lets you set one yet. Once one does, the image you choose is stored with your account.
• Sessions. When you sign in, a session is created. A session lasts 7 days and renews each time you use the app. It records when it expires. It also records the IP address and the browser or device description (the “user agent”) of the request that created it. Used to keep you signed in.

Minimali does not ask for your name.

Resetting a forgotten password by email is planned. It does not work yet. When it does, this policy will say how.

3.2 Your note

• The note text. Stored on servers run by Railway in the United States, so it can sync to your other devices. [launch 14]
• Edit history. Every change is stored as an edit: a line added, changed, deleted or moved. Each edit records when your device made it, when the server received it, and which of your devices made it. This powers sync, “Recently deleted”, and showing earlier versions of a line.
• Snapshots. Full copies of the note at points in time. The server takes one on each day the note changes, and one every 500 edits.

Deleted lines. Deleting a line hides it, but its text stays in the note’s data for a long time. The server and your devices keep deleted lines so that sync and “Recently deleted” work. They are kept until about 100,000 more edits have been made to the note. For most people that is years. Deleted lines are also inside the daily snapshots, which are kept for the life of your account (section 7). To have text removed for good, see section 8.

3.3 Your devices

• Device identifier. Each app install, and each browser, makes a random identifier for itself the first time it runs. It is not your device’s advertising identifier or serial number. In the web app it also encodes the time it was made.
• Platform. iOS, iPadOS, macOS or web.
• Sync state. When a device last synced and how far it got.

Used to sync your note, keep each device’s edits in order, and help with support.

3.4 Analytics

Minimali uses PostHog, a US company, to understand how the app is used. The data is stored in PostHog’s United States region.

Analytics run by default. There is no consent prompt and no switch to turn them off in the apps today. Section 4 explains why, what is planned, and how to object.

An event contains:

• Its name: “app opened”, “line inserted”, “line edited”, “line deleted”, “line moved”, “sync completed” or “conflict resolved”.
• Structure and counts only. For example: how deep a line is indented, and whether it is a heading or a bullet. Roughly how long a line is (for example “1 to 20 characters”). How you made the change (typing, pasting, a move command or a restore). How many edits were synced, and how long that took.
• The platform.
• A random id for your device. Once you sign in, your account’s internal user id is added. PostHog then links that device’s earlier events to your account. Never your email.
• What the analytics software adds by itself: app version, operating system and version, device model and type, language, time zone, screen size and session ids. In the web app, it also adds the page address, the referring page, and your browser’s name and version.
• An approximate location (country or city) that PostHog works out from your IP address.

Analytics never contain note text: no line, snippet, preview, email or password. The events and fields the apps may send are fixed in the code. An event that does not match is dropped before it is sent. The analytics software adds the details listed above on its own.

Used to improve the product and learn whether features work.

3.5 Crash and error reports

If an app crashes, or the web app hits an error it cannot handle, a report goes to PostHog. If the server crashes, it sends a report too. Other server errors are only written to the server’s logs (section 3.7).

A report can contain the type of error, its message, and a stack trace (which parts of the code were running). It also contains the device details listed in 3.4.

Error reports are designed never to contain note text. If one ever did by mistake, I would treat it as a bug and delete it.

Used to find and fix bugs.

3.6 Emails

Minimali sends no emails today, and it will never send marketing emails.

If you email me, I keep the conversation to answer you and handle your request.

3.7 Technical logs

The servers, and the network in front of them, see each request. That means Cloudflare and Railway. They see your IP address, the time and address of the request, and your browser’s or app’s user agent.

The server also writes short log lines about errors and some account events. These can contain your internal user id and your note’s id. They never contain your email address. Used to run the service, keep it secure and fix problems.

3.8 On your device and in your browser

• Apple apps. The note, its local history and unsynced edits are stored in a database on your device. Your sign-in token is kept in the device’s Keychain (Apple’s secure storage). Preferences, such as choosing to use the app without an account, are kept in the app’s settings.
• Web app. The note, its local history and unsynced edits are stored in your browser’s database (IndexedDB). Your browser’s local storage (localStorage) keeps your cursor position and your choice to continue without an account. It also keeps the result of the last sign-in check, so the web app can open offline. That record holds your internal user id and email address.
• Web app files. The web app keeps a copy of its own files in your browser, so it opens without a network. The fonts it loads from Google are kept there too, for up to a year.
• Website. minimali.app has no analytics and sets no cookies. If you pick a light or dark theme, the choice is saved in your browser’s localStorage.
• Cookies. The web app uses one session cookie from api.minimali.app to keep you signed in. PostHog keeps an analytics identifier in a cookie and in localStorage on app.minimali.app. The apps keep a similar identifier on the device.
• Fonts. The website and the web app load their fonts from Google Fonts. So your browser sends your IP address and browser details to Google when it fetches them.
• Do Not Track. Minimali does not track you across other sites or apps. So it does not respond differently to a browser’s “Do Not Track” signal.

Signing out does not erase the copy of the note on that device, so signing back in is instant. To remove it:

• On iPhone and iPad, delete the app.
• On a Mac, quit the app and delete the folder ~/Library/Application Support/Minimali. Deleting the app alone leaves that folder in place.
• In a browser, clear the site data for app.minimali.app.

The sign-in token in the Keychain can survive deleting the app. It stops working once its session expires.

3.9 Using Minimali without an account

On iPhone, iPad and Mac you can use Minimali without an account. The note then stays on that device and is not sent to the server. If you create an account or sign in later, the note is uploaded into your account.

The web app needs an account once sign-in is switched on. It offers to continue without one only while the server cannot be reached or sign-in is off.

Analytics and crash reports (3.4 and 3.5) are still sent without an account, with a random id.

4. Legal bases

These are the legal bases if you are in the European Economic Area (EEA), the United Kingdom, Switzerland, or a place with similar law. The EEA is the EU plus Iceland, Liechtenstein and Norway.

Consent for analytics. Minimali does not ask for your consent before analytics start. They store an identifier on your device from the first launch. In the EU and some other places, the law may require consent for that. A consent prompt, or an analytics mode that stores no identifier, is planned for users in the EU, the UK and Switzerland. A switch to turn analytics off in Settings is also planned.

You have the right to object at any time to processing based on legitimate interest, including analytics. Email me, and I will delete the analytics tied to your account. Until the switch ships, I cannot stop an app from sending new events.

4.1 What you have to give me

You are not legally required to give me any personal data. To create an account I need an email address and a password. Without them I cannot sign you in or sync your note. On iPhone, iPad and Mac you can still use the app without an account.

I do not make any decisions about you by automated means, and I do not profile you.

5. Who else handles your data

A few service providers process data for me, to provide their services to me. Each offers a data processing agreement. It requires the provider to act only on my instructions and to protect your data at least as well as this policy does. I accept each provider’s agreement before this policy is published. [launch 13]

For the App Store, Apple acts under its own privacy policy. Apple shows me download and usage statistics. It also shows me crash reports from people who chose to share them with developers.

Requests from governments and courts. I may disclose data when the law requires it, for example under a valid court order. I may also disclose it to protect the rights and safety of users or the public. If a government or court asks me for your data, I check that the request is valid and give only what it requires. Where the law allows and it is practical, I tell you before I disclose. The providers above are subject to the law where they operate, including the United States. They can receive such requests directly.

If I ever hand Minimali to someone else to run, I will tell you first. Your data will stay covered by this policy.

6. International transfers

I am in Israel. The servers and most providers are in the United States. So your data is transferred to and stored in the United States, and may be accessed from Israel.

From the EEA, the UK or Switzerland. The European Commission, the UK and Switzerland recognise Israel as giving adequate protection. For each provider in the United States, I rely on these safeguards:

Email me for a copy of the safeguards that apply.

From Israel. Transfers abroad follow the Israeli rules on transferring data to databases abroad. They rely on each provider’s written commitment to protect the data and not pass it on.

7. How long data is kept

These are the longest times I keep each kind of data. They are not a promise that history can be recovered. A bug, a failure or the end of the service can remove it sooner, as the Terms of Service (section 7) explain.

When you delete your account, your account, note, history, snapshots, devices and sessions are deleted from the database. I ask PostHog to delete the analytics tied to your user id. This happens within 30 days.

Some copies can remain for a while:

• In the hosting providers’ backups and logs, if any, until they expire on the providers’ schedules.
• On your own devices, until you remove them as section 3.8 explains.

The history periods are product settings. If they change, this policy changes first.

8. Deleting your account

There is no delete button in the apps yet. It is planned for iPhone, iPad, Mac and the web. Until then:

• By email: write to hello@minimali.app from your account’s email address. I will confirm and delete the account within 30 days.

You can also keep your account and have one piece of text removed from the server’s copy of your history. Email me and I will remove it. I cannot reach copies on your devices; remove those as section 3.8 explains.

9. Your rights

Depending on where you live, you have the right to:

• Access the data about you and get a copy.
• Correct data that is wrong.
• Delete your data.
• Take your data with you (portability): the note and account details you gave me, in a common, machine-readable format. The apps cannot export yet, so I send it to you by email.
• Object to processing based on legitimate interest, including analytics (section 4).
• Restrict processing while a request is handled.
• Withdraw consent at any time, if I ever ask for it.
• Complain. Complain to me first if you like, and I will answer within 30 days. You can also complain to a data protection authority at any time. In Israel, that is the Privacy Protection Authority. In the EU, it is the authority in your country. In the UK, it is the Information Commissioner’s Office (ICO).

To use any of them, email hello@minimali.app. I may ask you to confirm the account is yours, usually by writing from its email address. I answer within 30 days, or sooner if your law requires it. There is no charge.

10. Security

I take reasonable measures to protect your data, suited to a small free service. For example:

• Every connection to Minimali uses HTTPS. Browsers refuse unencrypted connections to any .app address, and the apps only use HTTPS.
• Passwords are stored only as salted hashes.
• On Apple devices the sign-in token is kept in the Keychain.
• Only I can sign in to the servers and provider accounts. [launch 17] Automatic deployment uses access keys that I keep as secrets in GitHub. The providers in section 5 can access the systems they run, under their own terms.

Your note is encrypted in transit, but it is not end-to-end encrypted. The server, and I as its administrator, can technically read it. I don’t, except as section 2 says.

No method of storing or sending data is perfectly secure. I cannot promise that your data will never be accessed, lost or disclosed without permission.

Do not store sensitive data in your note. That includes passwords, secret keys, bank or card details, health information, government id numbers, and personal data about other people. Minimali is a scratch note, not a vault.

If you store such data anyway, I process it only to store and sync it for you, as you asked. I treat it like the rest of your note. I do not analyse it, and it never goes into analytics.

11. If something goes wrong

If a security incident affects your personal data, I will notify the relevant authorities and the people affected where the law requires it. I will do so within the time the law sets.

Keep your own copy of anything that matters. Data can be lost through a bug, a failure or an attack. Your rights under data protection law are not affected by this policy or the Terms. That includes any right to compensation under the GDPR (Article 82) or Israel’s Privacy Protection Law.

12. Children

Minimali is not meant for anyone under 16, or under the age of digital consent in your country if that is higher. If you are younger, do not create an account.

I do not knowingly collect data from children. If I learn that an account belongs to a child, I delete it and its data. Parents can ask me to do this by email. I will not ask them for more information than I need to find the account.

13. A hobby project

Please read this part.

• Minimali is run by one person in his free time. There is no company, no staff and no revenue.
• It is new, early-release software. Sync, history and restore may have bugs that lose, duplicate or reorder lines.
• The service is free. It may change, pause or end. If I decide to end it, I will tell you by email or in the app at least 30 days before sync stops. I will do this wherever it is practicable. The copy of your note on each of your devices keeps working after that.
• If I die or become unable to run the service, it may stop without notice. Your devices keep their copies.
• Keep your own copy of anything that matters. Every device holds a full copy of your note. To keep a copy elsewhere, select all the text in the note and paste it somewhere else.

The Terms of Service say more about this.

14. Changes to this policy

I may update this policy. The version and date at the top will change. For a significant change, I will tell you in the app or by email at least 30 days before it takes effect. The exception is a change needed sooner for legal or security reasons.

15. Contact

Michael Tzach, Israel. hello@minimali.app, in English or Hebrew.

If you get no answer within 14 days, write again; mail can be lost.