Your data is safe with us
We built Calenote with privacy-first principles. Here's exactly how we protect your information.
Passwords encrypted
bcrypt 12 rounds
HTTPS always
TLS on all connections
Zero ads
No advertisers
Data in South Asia
Mumbai, India region
Your notes are private
Your notes, to-dos, and reminders are stored in an encrypted MongoDB Atlas database. Only you can access your own data using your account credentials. Calenote team members cannot read your personal notes.
Passwords are never stored in plain text
When you create an account, your password is hashed using bcrypt (12 rounds) before storage. This means even if someone accessed our database, they cannot recover your password. We use industry-standard one-way hashing.
Secure connections
All data between your device and Calenote is transmitted over HTTPS/TLS. Your browser connection is encrypted end-to-end via Cloudflare's global CDN and Vercel's infrastructure.
Location data
Calenote uses your device's geolocation only to show local weather and sunrise/sunset times. Your exact coordinates are sent directly to Open-Meteo (a privacy-respecting free weather API) and are never stored on our servers.
We don't sell your data
Calenote does not sell, share, or trade user data with any third parties. We don't run ads. We don't share your information with advertisers. Your data is yours.
Delete your data
You can delete any note, to-do, or reminder at any time from within the app. To permanently delete your account and all associated data, email us at support@calenote.app.
Cookies & sessions
Calenote uses a single secure session cookie for authentication (NextAuth.js). This cookie expires when you sign out. No tracking cookies. No analytics tracking without consent.
Data location
Your data is stored in MongoDB Atlas (Mumbai region, ap-south-1). We chose Mumbai to keep data close to Nepal for faster performance and to keep your data within the South Asia region.
Technical implementation
What each dashboard tool stores
Different tools hold different kinds of data, so they are protected differently. This section says plainly what happens to each — including the one case where we deliberately made it impossible for ourselves to help you.
🩺 Health records — end-to-end encrypted
Everything you type into the Health vault — profiles, records, vitals, medicines, appointments and the emergency card — is encrypted on your own devicewith a key derived from your PIN before it is sent anywhere. Our servers store the encrypted result and nothing else. We cannot read your family's medical history, and we cannot reset your PIN if you forget it — the vault would be unrecoverable. That is the honest cost of real encryption, and we would rather state it than quietly weaken it.
Two things sit outside that encryption, and you choose both: uploaded report files are stored like any other Calenote file (we can see that a file exists, not which record it belongs to), and any reminder you create carries the title you typed through the normal reminder system.
📓 Notebooks, ✅ Planner and 🎓 Study
Your pages, drawings, tasks, subjects, exam dates and study logs are stored in your account in our encrypted database. We do not read them, we do not use them to train anything, and we do not sell them. Reminders you create are processed so they can be delivered to your devices at the right time.
📈 NEPSE Portfolio
Your holdings, purchase prices and dates are stored in your account and used only to calculate your own figures. We never place trades, we have no connection to your broker or demat account, and we never ask for those credentials — if anything ever does, it is not us. Share prices come from public market data; requesting them does not send your holdings anywhere.
🔐 Password Vault (in development)
When it launches it will use the same zero-knowledge approach as the Health vault: your master passphrase never reaches our servers, and a forgotten passphrase cannot be recovered by us. We will say so clearly at setup rather than in a footnote.
📁 Files you upload
Photos and documents you upload — health reports, project files, student documents in workspaces — are stored in object storage against your account's quota and served only to people your account or workspace permits. Deleting a file removes it from storage and returns the space to your quota.
None of this is funded by advertising. There are no ad networks, no third-party trackers following you between features, and nothing here is sold to data brokers. If that ever changed, it would be announced before it happened, not discovered afterwards.