Where are my notes stored?
In the local storage of the extension, inside your Chrome profile on this computer. The notes are not synced through Chrome Sync and are not uploaded to HotPanCake; the extension has no HotPanCake server to talk to. Removing the extension deletes them, so keep a backup.
What does the Google Drive backup store?
Nothing, until you click the cloud icon, agree to share your notes with Google Sheets and sign in with Google. After that, NotePADD keeps one spreadsheet, Notes sheet, in your own Drive:
- column A: the note name (first 40 characters), readable;
- column B: the note text as plain text, or encrypted text if encryption is on.
The spreadsheet is stored and protected by Google under your Google account. HotPanCake cannot see it. Anyone you share the spreadsheet with can read the readable parts, as with any file in your Drive.
How strong is the encryption?
When Encrypt data is on, each note's content is encrypted with AES-256 in GCM mode. The key is derived from your password with PBKDF2-SHA-256 (100,000 rounds) and a random salt and IV for every note. The password is not saved; during a session the extension keeps the derived key until the notepad locks. Three wrong passwords lock the notepad for three minutes.
Honest limits:
- Note names are not encrypted, locally or in the spreadsheet.
- A forgotten password cannot be reset. Encrypted notes are then lost.
- Encryption protects notes at rest. While the notepad is unlocked, anyone using your computer can read them, so choose an auto-lock time that suits you.
Permissions, one by one
| Permission (as in the manifest) | Why NotePADD has it |
|---|---|
| Storage | To keep the interface language and, if you connect Drive, the Google sign-in tokens |
| Identity | To sign in with Google when you turn on the optional Drive backup |
Google Drive: files created by this app (drive.file) | To create and update the one spreadsheet Notes sheet; it cannot open your other files |
Google Drive: app data (drive.appdata) | Requested at sign-in but not used by the current code |
| Identity e-mail, two web addresses | Left over in the manifest of version 3.1; the code does not use them |
NotePADD does not ask to read or change data on the websites you visit, and it does not read your browsing history.
What is sent, and where
| Data | Goes to | When |
|---|---|---|
| Notes (names and text) | Google Sheets, your spreadsheet in your Drive | Only with the backup on, about 2 seconds after you stop typing |
| Google sign-in | When you connect the backup | |
| Anything | HotPanCake | Never sent by the extension |
When you install or remove NotePADD, Chrome opens a welcome or goodbye page on hotpancake.com. Those are ordinary web pages, covered by the site privacy policy.
What is not collected
- the text of your notes;
- your password;
- your browsing history or the content of pages you visit;
- usage statistics: the extension has no analytics.
The full policy for this extension is on the privacy page.