Privacy Policy

Last updated 2 November 2026

JotSpan is a to-do list with a work journal built in. This policy explains what it stores about you, why, who helps run it, and what you can do about it.

Who runs JotSpan

JotSpan is run by Artem Telunts, an individual based in Armenia (“we”, “us”), who is responsible for your personal data under this policy. For anything about your data, write to support@jotspan.com.

What we collect

Your account

When you create an account, you give us your email address and a password. You need an account to use JotSpan, and we need an email address to create an account. If you sign in with Google instead, Google shares your name, email address and profile picture with us. If you sign in with Apple, Apple shares your name and an email address, which can be your own or a private relay address from Apple that forwards to it, as you choose. Our sign-in provider, Clerk, stores these details and your password; we never see your password. Clerk also records your signed-in sessions, including the browser, device and IP address, so you can review and end them from Settings.

What you write

Your tasks, reflections and their times: when you start, pause and complete work, planned dates, the edits you make, what you move to Trash, and the records that let you undo and redo changes. We also store your timezone. In automatic mode it follows your browser’s timezone; you can fix it in Settings.

Your preferences

Whether you’ve hidden the welcome message or reflections, and whether you use the 24- or 12-hour clock, are saved with your account.

Google Calendar

If you connect Google Calendar to show a day’s events beside your Journal, Google gives JotSpan read-only access to your list of calendars and the events on them, and tells us that Google account’s email address. You can connect up to two Google accounts. JotSpan reads a day’s events from Google each time it shows them and doesn’t store them. It reads each event’s title, times, link and whether you declined it, never its description, location or the other people invited. We store only each Google account’s email address, which calendars you chose to show and the access Google granted, encrypted. Disconnect an account in Settings at any time; that, or deleting your account, ends JotSpan’s access at Google.

JotSpan’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Email updates

If you ask for updates about JotSpan Plus and the iOS and Android apps, we store your email address, when you asked and confirmed, and the wording you agreed to. We don’t record anything else about the request: not your IP address, your browser or the page you were on. If you join from your account, we use your account’s email address.

Technical data

Like every website, our hosting provider receives your IP address, browser details and the pages you request, and keeps request logs. JotSpan’s own error logs record only error types, codes and timings, never what you write. We use IP addresses to limit abusive traffic. When you create an account, Cloudflare checks that you’re not a bot.

Visit counts

On jotspan.com and the sign-up page, Vercel Web Analytics counts visits: the page’s address without anything after the path, the site that linked to it, your approximate location from your IP address, and your browser, operating system and type of device. It sets no cookies and stores nothing on your device. Visits are grouped by a value derived from your request that Vercel discards after 24 hours, so they can’t be linked to you, across days or across websites. It never runs on pages that show your journal or account, and if your browser sends a Global Privacy Control or Do Not Track signal, your visits aren’t counted at all.

What we don’t do

• We don’t sell or rent your personal data, or share it for advertising.
• We don’t show ads or use tracking tools. The only analytics is the cookieless visit count on our website and sign-up page, described above.
• We don’t use your entries to train AI models or run them through AI services.
• We don’t send marketing emails unless you ask for them. The only ones are the updates about JotSpan Plus and the apps that you requested and confirmed, and they carry no tracking pixels or tracked links. Apart from those and our replies when you write to us, you get one welcome email when you create an account, also without tracking, and account emails from Clerk, such as verification and password reset codes.

Why we use your data

• To run JotSpan for you: storing and showing your journal, signing you in and keeping your account working. This is needed to provide the service you asked for.
• To keep JotSpan secure and working: preventing abuse and bots, and fixing errors. This is our legitimate interest in running a safe, reliable service.
• To understand how people find JotSpan: counting visits to our website and sign-up page. This is our legitimate interest in improving the website, and it identifies no one.
• To show your calendar: if you connect Google Calendar, reading a day’s events to show them beside your Journal. This is needed to provide the feature you asked for.
• To welcome you: one email when you create an account, with a few tips for getting started, and never again. This is our legitimate interest in helping new accounts find their way.
• To send the updates you asked for: your consent. Withdraw it at any time with the unsubscribe link in any of them.
• To answer you: when you write to us, we use your email to reply.
• To meet legal obligations, when the law requires it.

We don’t read your entries, unless you ask us to help with a problem, we need to investigate abuse or a security issue, or the law requires it.

We don’t profile you or make automated decisions that significantly affect you. The only automated check is Cloudflare’s bot check when you create an account; if it stops you, write to us.

Cookies and browser storage

JotSpan sets no advertising or analytics cookies, so there’s no cookie banner. It uses:

• Sign-in cookies from Clerk, which keep you signed in. JotSpan can’t work without them.
• jotspan-theme, a cookie that remembers light or dark mode if you choose one, shared by jotspan.com and app.jotspan.com for up to 400 days.
• jotspan-signed-in, a cookie that remembers this browser is signed in, so jotspan.com opens the app and an expired sign-in returns to the sign-in page. It’s shared by jotspan.com and app.jotspan.com, removed when you sign out, and kept for up to 400 days.
• jotspan-sidebar, a cookie on app.jotspan.com that repeats whether you keep the sidebar open or closed, so pages open at that width, kept for up to a year.
• jotspan-calendar, a cookie on app.jotspan.com that remembers whether you keep the calendar open beside your Journal and how wide, kept for up to a year.
• jotspan-calendar-oauth, a cookie on app.jotspan.com that exists only while you connect Google Calendar, for up to 10 minutes, so only you can finish connecting it.
• Browser storage for view choices on this device (the sidebar’s open or closed state, whether the Completed tasks are shown, and whether Insights counts reflections), for keeping your open tabs in step, and, for the current tab only, whether you closed the welcome message.

JotSpan doesn’t track you across other websites and doesn’t let advertising companies collect information about your activity through it. If your browser sends a Do Not Track or Global Privacy Control signal, JotSpan doesn’t count your visits; everything else works the same.

Who helps run JotSpan

These providers process data for us, under their own privacy and security terms:

• Clerk: sign-in, account details and account emails.
• Neon: the database that stores your journal and the email-updates list, hosted on Amazon Web Services in the United States (Virginia).
• Vercel: hosting the website and app, request logs, traffic limits and visit counts. JotSpan’s servers run in the United States (Washington, D.C.).
• Resend: sending the welcome email and email updates, from the United States. For the welcome email it receives your email address and, if your account has one, your first name. It keeps delivery records for a short time and a list of addresses that bounced or reported spam.
• Cloudflare: checking that new accounts aren’t created by bots.
• Google: only if you choose to sign in with Google, or connect Google Calendar (see Google Calendar above).
• Apple: only if you choose to sign in with Apple.

We may also disclose data when the law requires it, for example in response to a valid court order.

Where your data is stored

Your account and journal are stored in the United States. If you live elsewhere, your data is transferred there. Where the law requires it, these transfers rely on safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses. You can ask us for a copy.

How long we keep it

• Your account and journal: until you delete them. Items in Trash stay there until you delete them permanently or delete your account.
• When you permanently delete something or delete your account, it’s removed from the live database right away. Database backups hold it for up to 7 days longer before it’s gone for good.
• Request logs we can see are kept for about an hour. Visit counts are kept by Vercel as totals that identify no one. Our providers may keep security records longer under their own policies.
• Email updates: an address that isn’t confirmed within 7 days is never emailed again and is deleted the next time the list changes, for example when someone else signs up. A confirmed one is kept until you unsubscribe or ask us to delete it.
• Google Calendar: the connection is kept until you disconnect it or delete your account. Events aren’t kept at all.
• Emails you send us: as long as we need them to help you.

Your choices and rights

• Get a copy: export everything as JSON from Settings.
• Correct it: edit your entries and tasks directly, and change your sign-in details in Settings.
• Delete it: delete entries in Trash, or delete your account and all of its data in Settings.
• Stop email updates: unsubscribe with the link in any update, or write to us. Deleting your account also removes its email addresses from the list.

Depending on where you live, including in the European Union and the United Kingdom, you have the right to:

• access your data and get a copy of it;
• have it corrected or deleted;
• restrict or object to how we use it;
• receive it in a portable format, or have it sent to another service.

For anything you can’t do in Settings, write to support@jotspan.com from the address you sign in with, and we’ll answer within one month. You can also complain to the data-protection authority where you live, or in Armenia.

Security

JotSpan uses encrypted connections (HTTPS), keeps each account’s data separate, and leaves passwords to Clerk. No service is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

Children

JotSpan is not meant for anyone under 16. If we learn that a child under 16 has an account, we’ll delete it.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change affects how we use your data in an important way, we’ll tell account holders by email or in JotSpan before it takes effect, and announce it on jotspan.com.

Contact

Questions or requests: support@jotspan.com. See also the Terms of Service.