Merge branch 'main' of https://github.com/toolworks-dev/rusty-notes-webapp

Author: 0xGingi

PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy Policy for TrustyNotes
 
-Last updated: 12/19/2024s
+Last updated: 05/22/2024
 
 ## Overview
 
@@ -9,16 +9,22 @@ TrustyNotes is committed to protecting your privacy. This Privacy Policy explain
 ## Information Collection and Use
 
 ### Notes and Content
-- All notes and content you create are encrypted end-to-end using AES-GCM encryption
+- All notes and content you create are encrypted end-to-end using AES-GCM (Advanced Encryption Standard with Galois/Counter Mode)
 - Encryption keys are derived from your sync code, which is never transmitted to our servers
 - Notes are stored locally in your browser and optionally synchronized with our servers in encrypted form
 - We cannot access, read, or decrypt your notes as we don't have access to your encryption keys
 
+### Encryption Technology
+- We implement quantum-resistant cryptographic methods
+- For key exchange, we use ML-KEM (Module-Lattice Key Encapsulation Mechanism)
+- ML-KEM securely generates and encapsulates a shared secret key, which is then used to derive an AES key
+- Data encryption is performed using AES-GCM for authenticated encryption
+- This hybrid approach combines quantum-resistance with high-performance encryption
+
 ### Technical Data We Collect
 - Basic usage analytics through Plausible Analytics (privacy-focused analytics)
 - Sync timestamps and note metadata (without content) for synchronization purposes
 - Error logs (without personal information) for troubleshooting
-- Browser extension status and version information
 
 ### Data Storage
 - Notes are stored locally in your browser's storage
@@ -31,20 +37,14 @@ TrustyNotes is committed to protecting your privacy. This Privacy Policy explain
 - Communication with our servers uses HTTPS encryption
 - Notes are signed using ECDSA to verify authenticity
 - Server access is restricted and monitored
+- We implement regular updates
 
 ## Data Sharing
 We do not share your data with third parties. Your encrypted notes are only:
 - Stored locally on your devices
 - Transmitted to our servers for sync purposes (if enabled)
 - Accessible only with your sync code
 
-## Browser Extension
-The TrustyNotes browser extension:
-- Accesses only the trustynotes.app domain
-- Stores encrypted notes locally
-- Communicates with the web application for synchronization
-- Requires explicit user permission for storage and tab access
-
 ## Your Rights
 You have the right to:
 - Export your notes at any time
@@ -54,8 +54,9 @@ You have the right to:
 - Generate new sync codes
 
 ## Data Retention
-- Deleted notes are permanently removed after 24 hours
-- You can manually purge deleted notes immediately
+- Deleted notes are permanently removed from the server immediately upon sync
+- You can manually purge deleted notes from your local storage at any time
+- All user data on the server (including encrypted notes) is automatically deleted after 180 days of inactivity (no syncing)
 - Server logs are retained for 30 days
 - You can delete all your notes at any time
 
@@ -69,4 +70,4 @@ If you have any questions about this Privacy Policy, please contact us at:
 
 ## Open Source
 TrustyNotes is open-source software. You can review our code and security implementations at:
-https://github.com/toolworks-dev/trusty-notes
+https://github.com/toolworks-dev/trusty-notes