Proof of concept. Use at your own discretion.

Privacy Policy

FileLoveNote (filelovenote.com) — last updated October 13, 2026.

This policy describes what FileLoveNote stores about you, where it is stored, which third parties are involved, and what you can ask for. It describes how the service actually works rather than covering every hypothetical.

FileLoveNote is a proof of concept. It is provided as is, with no warranties. Use it at your own discretion. Notes, files and account data can be lost, changed or become unavailable, and the service may change or be discontinued at any time, including without notice. This is not a backup. Keep your own copies of anything you cannot afford to lose.

1. Who is responsible

FileLoveNote is run by Ernst, an individual based in the Netherlands, who is the controller of the personal data described here. For any privacy question or request, write to mail@ern.st.

2. What we collect

Account data. You sign in with your Google account. We store your email address, your display name and profile picture URL if Google supplies them, the Google account identifier, an internal account identifier derived from it, and the dates the account was created and last used. No account passwords are stored.

Content you create. Notes, documents, canvases, folders, uploaded files and media, saved links, thumbnails generated from your media, and transcripts generated from your audio and video. Storing this is the purpose of the service.

Diagnostic logs. Private technical records of errors and warnings in your own workspace, used only to troubleshoot the service.

Technical data. The server and its reverse proxy process ordinary request data (IP address, path, timestamp, user agent) to serve and secure the site.

There is no third-party analytics, no advertising, no tracking pixels and no behavioural profiling. Your content is never sold, and we do not use it to train machine-learning models.

3. Cookies and local storage

Two cookies are used. Neither is an analytics or advertising cookie, so no consent banner is shown.

Session cookie. A signed cookie named mediavault_session keeps you logged in. It is HttpOnly, SameSite=Lax and Path=/, and it is marked Secure when the site is served over HTTPS. The session identifier is rotated when you sign in. The matching session record on the server holds the signed-in account until you sign out or the session expires after a period of inactivity (90 days from last use, unless that window is configured differently).

Last-note cookie. When you open a note, the page also sets a cookie named last_active_note. It stores that note's identifier, not the note text. It is not HttpOnly, so the page can update and clear it. It is SameSite=Lax and Path=/, it is not marked Secure, and it is kept for up to one year. The browser sends it to our server on later requests. The notes page reads it, when the address does not name a note, to reopen that note. The same identifier is then kept on the server session, and a copy is also kept in local storage on your device under mytube-active-note. Opening another note replaces the value. Putting the note in the trash clears the cookie when it still names that note.

Your browser also keeps your theme preference and some interface state (such as whether the sidebar is open, and which folder you last opened) in local storage, and may cache recently viewed pages in a service worker so they stay available offline. That preference and cache data stays on your device. When local-first sync is enabled, a working copy of notes is also kept in IndexedDB on your device and synced with the server.

4. Third parties

Each provider handles what it receives under its own privacy policy. Transcription of audio and video runs on our own server; media is not sent to an external transcription service.

5. Where data is stored

Application data and a working copy of documents live on a virtual server rented by us, with periodic backups on that server. When you make Google Drive the primary note storage, the Markdown source files live in your Google account. Files uploaded to Google Drive also stay there. These providers may process data outside the EU under their own transfer safeguards.

6. Why we process it

There is no marketing email, no profiling and no automated decision-making that produces legal effects for you.

7. How long we keep it

Your content is kept until you delete it or ask for your account to be removed. When you confirm Delete, the selected items are permanently removed from their storage. Items already in the trash remain until you delete them permanently or empty the trash. Backups are retained for a limited period, so deleted content may survive briefly in a backup. Sessions expire after a period of inactivity.

8. Your rights

Under the GDPR you can access, correct, delete, restrict or object to the processing of your personal data, and receive a copy of it in a portable form. Much of this you can do yourself: content can be edited, exported and deleted in the app, and the settings screen offers a full account reset or lets you permanently delete your account. For anything else, write to mail@ern.st; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country of residence.

9. Security

Traffic is served over HTTPS, sessions use signed HttpOnly cookies, and access to the server is restricted to the operator. No system is perfectly secure, and this is a personal project run without a dedicated security team, so keep your own copies of anything you cannot afford to lose.

10. Children

The service is not directed at children under 16, and accounts should not be created by them.

11. Changes to this policy

This policy may change as the service changes. The date at the top is the current version. Because this is a proof of concept, a change can take effect without a separate notice.

12. Contact

Ernst — mail@ern.st. See also our Terms of Service.

← Back to FileLoveNote