Your notes are yours.

What we store

• Your account: your email address, a hashed password, and the date you agreed to our Terms. If you turn on two-factor authentication, the secret your authenticator app uses.
• Everything you capture: notes, lists, reminders, tags, and any images you attach.
• Link previews: when you save a link, we fetch that page's title, description and preview image so your note isn't a bare URL.
• Basic technical logs kept by our hosting providers, such as request times and error records, used to keep the service running.
• The beta list: if you ask us on this website to tell you when Sprwl opens up, we keep the email address you gave us until we've done that.

There are no ads in Sprwl, no advertising trackers, and nothing that follows you around other websites. We don't sell your notes, rent them out, or use them to train anything.

This website counts visits with our own analytics, which we host ourselves: page views, the site that sent you here, and a rough country. No cookies, no profile, nothing tied to your account. The app itself has no analytics in it at all.

How it's protected

• In transit: everything between your device and our servers travels over HTTPS.
• At rest: the database and the image storage are encrypted on disk by our host.
• Between accounts: the database enforces, row by row, that only your signed-in account can read or change your notes and images — it isn't just the app being polite, the database itself refuses.
• On your side: you can turn on two-factor authentication, and then even your password isn't enough to get in.

Who can see your notes

No other user, ever. We do run the database, so in principle a Sprwl operator could read what's in it — that's true of any app that stores your notes for you, and we'd only do it to fix a problem you've asked us to fix. We'd rather say so out loud than imply otherwise.

The Private Vault is the answer to that: notes in the vault are encrypted on your device before they're sent, so we couldn't read them if we wanted to. It isn't built yet.

Who we share it with

Only the companies that make the app work, and only as far as that requires. Supabase hosts the database, file storage and sign-in; Microsoft Azure serves the website; Resend delivers account email like confirmations and password resets; Cloudflare Turnstile checks that it's a person, not a bot, on the sign-up, sign-in and password-reset forms, which means Cloudflare sees your IP address and some browser details while you're on those forms; Sentry receives error reports when something breaks in the app: what went wrong, where, and your browser type. Reports aren't linked to your account, and we strip anything that could carry your notes before they're sent; Formspree passes on the address you type into the beta-list form on this site. No one else, and no data brokers.

One exception to know about: a link preview's image loads straight from the site you linked to. Each time that card appears, that site can see your IP address and browser, the same as if you'd opened the image yourself.

What's kept on your device

Your browser holds your sign-in token and your view settings — light mode, sort order and the like — in local storage, so you stay signed in and the app looks the way you left it. No advertising or tracking cookies.

Deleting your account

Open the account menu in the app and choose Delete account. That deletes the account along with every note, tag, reminder and image in it, straight away. If you can't get into your account, email support@sprwl.co from your account's address and we'll do it for you.

Deleting a note in the app removes it for good — there's no trash can to empty. Our host keeps daily database backups for up to 7 days, so deleted data can survive in a backup for up to a week before it's gone for good. We only use those backups to recover from a failure.

Children

Sprwl isn't meant for children. You must be 13 or older to use it (or older, if the law where you live sets a higher age), and we don't knowingly collect information from anyone under 13.

If we learn that an account belongs to a child under 13, we'll delete it and everything in it. If you're a parent or guardian and think your child has signed up, email support@sprwl.co and we'll take care of it.

While Sprwl is in beta