Privacy policy

Last updated: October 12, 2026

This policy covers the dobox.app website and the DoBox apps. There's only one, and we've tried to keep it readable.

In short

No tracking cookies on this site. No third-party scripts. No third-party fonts.
No ads. Your data is never sold to anyone.
Your notes stay on your device. An account is optional.
No master key: the server can't read the content of your vaults or your sync.
AI is off by default. You decide to turn it on.
No identity check (KYC).
Two things are not end-to-end encrypted, and we tell you so: logs you send to support, and remote AI.

1. Who is responsible for your data

Publisher identity coming soon. Contact: contact address coming soon

For any question about your data, write to us (contact address coming soon).

2. On this website (dobox.app)

No tracking cookies. We don't follow you around.
No third-party scripts. No external analytics, no ad pixels, no social buttons watching you.
No third-party fonts. No font is loaded from an outside service.
Hosting. The site is hosted by Hostinger International Ltd. (61 Lordou Vyronos, Lumiel Building, 6023 Larnaca, Cyprus; server in France). Like any website host, they process technical data (such as your IP address) to serve you the pages.

3. In the DoBox apps

Without an account

You can use DoNote without an account. Your notes are stored on your device. They aren't sent to our servers.

With an account (optional)

If you create an account, we process the information needed to create it and make it work. Nothing more.

Encrypted cloud sync (Premium, coming soon)

When sync is available, your synced data will be encrypted before it leaves your device and hosted in the European Union. There's no master key: the server can't read its content in plain text.

Usage statistics (optional)

You can choose to share usage statistics. They're pseudonymized. They feed an internal tool that helps us see what works and what doesn't. They're never passed to any advertising service. Crash reports and statistics: off by default, two switches in Settings > Privacy.

AI

AI is strictly opt-in. Nothing turns on without you.

On-device voice transcription. It runs on your device. The model (about 74 MB) is only downloaded if you turn it on (in the installed app; not in the web version). Your recordings don't leave your device to be transcribed.
Cloud AI (OpenAI or Anthropic). It only works with your own key. When you use it, the relevant content is sent to the provider you chose. This is not end-to-end encrypted: the provider can read that content. Their own privacy policy applies.

Logs sent to support

If you send us logs to fix a problem, they aren't end-to-end encrypted. We read them to help you, and only for that.

The newsletter isn't live yet: no email is collected for now.

We only send you the newsletter if you agreed to it (checkbox). We use your email to tell you what's new: Android, Premium, the next apps. Every email has an unsubscribe link. You can also write to us (contact address coming soon).

5. What we never do

Show ads.
Sell or rent your data.
Ask for ID to use the apps.
Keep a master key that could open your vaults.
Turn on AI for you.

6. Legal basis

Your consent: newsletter, optional statistics, cloud AI.
Providing the service: your account, if you create one, and sync once it's available.
Your request: logs you send to support.

You can withdraw your consent at any time, no reason needed.

7. How long we keep your data

Account: as long as your account exists. Then it's deleted.
Newsletter: until you unsubscribe.
Support logs: as long as it takes to handle your request.
Optional statistics: pseudonymized, for the internal tool only.

8. Who can access your data

The DoBox publisher, to run the service.
Hostinger International Ltd. (61 Lordou Vyronos, Lumiel Building, 6023 Larnaca, Cyprus; server in France), which hosts the website.
The cloud AI provider you choose (OpenAI or Anthropic), only if you turn it on with your key.

Nobody else. No advertisers. No data brokers.

9. Your rights (GDPR)

You have the right to:

access your data;
have it corrected;
have it erased;
get it back in a readable format (portability);
object to processing or ask for it to be restricted;
withdraw your consent at any time.

To use any of these rights, write to us (contact address coming soon). We won't ask for ID as a matter of course; we may just check the request really comes from you.

If you think your rights aren't respected, you can file a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

10. Deleting your account

You can delete your account at any time in the app (Settings > Privacy > Delete account). The data linked to your account is then deleted from our servers.

Before that, remember to export your data: export is always possible.

Notes stored only on your device stay on your device. To erase them, delete them in the app or uninstall it.

11. Changes

If this policy changes, we update the date at the top of the page. If the change is significant, we'll let you know beforehand.