Privacy policy
Last updated
In short
- Your notes, their titles, tags and attachments are end-to-end encrypted on your devices and stored in your own Google Drive. Nobody at Ordinal Works can read them, and we keep no copy.
- There is no lullpage account. lullpage asks Google for two narrow permissions: a hidden folder of its own, and the files it creates.
- A small relay passes encrypted updates between your devices and keeps a few small records for share links, each of which ends on a set date.
- Error reports go to Sentry in the EU and never contain your notes or your IP address.
- No ads, no tracking, no analytics, and we never sell data.
Who we are
lullpage is made by Ordinal Works, in Singapore. Ordinal Works is responsible for lullpage and for the personal data described in this policy; under the European and UK data protection laws, it is the controller. You can reach us about anything in this policy at privacy@lullpage.com.
What this policy covers
The lullpage apps for the web, iPhone, iPad, Android and Mac; the relay at
relay.lullpage.com; the share pages on lullpage.page; and this website,
lullpage.com.
lullpage is in development and not yet available to the public. This policy describes how it is built to work. We will update it before anything it describes changes, including before Dropbox or any other storage provider is offered.
Your notes stay in your own cloud
When you connect Google Drive, lullpage creates your library in a hidden app folder in your Google Drive. Everything in it (your notes, their titles, tags and folders, attachments, sketches, version history, settings, and your profile name and photo) is encrypted and signed on your device before it leaves, with keys that only your devices and your recovery key hold.
Ordinal Works runs no server that stores your notes. We cannot read them, recover them or reset your keys. If you lose every device and your recovery key, nobody can get your notes back, and that includes us.
Google stores the encrypted files under its own terms and privacy policy. Like any storage provider, it can see how many files your library has, roughly how large they are, when they change, and the IP addresses your devices connect from. It cannot see what is in them.
Each device keeps a full copy of your library so that lullpage works offline: in the app's own storage on phones and the Mac, and in your browser's storage for the web app. On the web, your browser stores that copy without extra encryption, so anyone with access to your browser profile could read it; folders you lock are the exception.
Google permissions and Google data
lullpage asks Google for these two permissions and nothing else:
-
drive.appdata, which Google describes as “See, create and delete its own configuration data in your Google Drive”. This is the hidden folder where your encrypted library lives. You cannot see it in Drive, and other apps cannot open it. -
drive.file, which Google describes as “See, edit, create and delete only the specific Google Drive files you use with this app”. lullpage uses it for files it creates for you outside the hidden folder, such as the encrypted copies behind your share links and the folders you share with other people, and for folders you choose to open in lullpage, such as one someone has shared with you.
With these permissions lullpage cannot open any other file in your Drive, and it does not ask for your Gmail, contacts, calendar or any other Google service.
The information lullpage receives from Google is the files in its own folder, the files it created or you opened with it, and, only if you join a shared folder, your Google account's email address (see sharing). It is used only to give you lullpage's features: syncing your library and sharing what you choose to share. It is never used for advertising, never sold, never used to develop or train machine-learning models, and never read by people at Ordinal Works, who could not read it in any case because it is encrypted.
lullpage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To reach your Drive, each device holds a token from Google. On iPhone, iPad, Android and the Mac it is kept in the system's secure storage. In the web app, Google's sign-in goes through our relay, which exchanges and renews the token and keeps the long-lived part in an encrypted cookie in your browser that only the relay can read; the relay keeps no copy and logs nothing about it. You can remove lullpage's access at any time in your Google Account.
Other apps on your Mac
The Mac app can let other apps on the same Mac read and change your notes, for example writing or assistant tools that support the Model Context Protocol. Nothing is available to such an app until you allow that app by name in Settings. You can limit it to chosen folders, see what it did, and remove it at any time; locked folders are never visible to it. This all happens on your Mac and never passes through our systems. Once you allow an app, what it does with your notes is governed by that app's own terms and privacy policy.
The relay
The relay is a small service of ours, run on Cloudflare at relay.lullpage.com and
lullpage.page. It passes encrypted updates between your devices while they are online
and tells them when to fetch, helps the web app stay connected to Google, enforces the expiry,
passwords and open counts of share links, and carries invitations and updates between people who
share notes. You can turn it off in the app; sync then runs through your own Drive alone, more
slowly.
The relay can see which of your devices are online (by random ids, not by name), the size and timing of the encrypted messages it passes on, share-link ids and how often each is opened, and the IP address of each connection. It never receives a key, a note, or anything that would let it read one. IP addresses are used to answer each request and to apply short-lived limits that stop abuse; they are not stored, except that failed password attempts on a share link are counted per IP address for one hour.
What the relay keeps, and for how long:
| Record | Kept |
|---|---|
| Which of your devices are connected right now | Only while they are connected; it is not written down |
| A fingerprint of your library's latest list of devices, so a new device can check it is not being shown an old one | While your library uses the relay |
| The date the relay first saw a library, under a code that cannot be traced back to it, so that new libraries can create fewer links at first | 30 days |
| For each share link: its id, when it ends, how often it was opened, where its encrypted copy is, the terms version accepted when it was made, what your devices need to change it, and, if it has a password, a check value that cannot reveal the password | Until 30 days after the link ends, or until you delete it |
| Encrypted messages waiting for someone you share with | Until they are collected, and at most 30 days |
| Reports about share links | 90 days |
| Links taken down after a report | As long as they need to stay down |
| Failed password attempts on a share link, per IP address | One hour |
The relay keeps no request logs in production. Cloudflare gives us totals, such as the number of requests, errors and connections, which do not identify anyone.
Share links and shared folders
Sharing is planned for a later version of lullpage. When it arrives, it works like this.
Share links
Each share link carries its own secret key after the # in its address. Browsers do
not send that part to any server, so neither the relay nor Google can read what you share. Your
device encrypts a copy of the note with that key and saves it in a “lullpage links” folder in your
Google Drive. That file is shared in Drive so the relay can fetch it, but it is encrypted, and its
location is known only to the relay and your devices.
Anyone who has the full link can read the note in a browser, so share a link only with people you would trust with the note itself. You choose when each link ends, and you can turn it off at any time. The share page loads nothing from other sites and sends no error reports. We count how many times a link is opened, never who opened it.
Shared notes and folders
You can also invite people who use lullpage to a note or a folder. The invitation and the keys to read what you share travel end-to-end encrypted through the relay. If you both use Google Drive, the shared note or folder lives in a Drive folder that the owner's app shares with the other person's Google account. To make that possible, the app of the person joining reads their Google account's email address from Drive and sends it, encrypted, to the person who invited them.
Reports
Anyone can report a shared page, from the page itself or from the app. A report contains the link's id, a reason, and any details and contact address the person reporting chooses to give. Only if they choose, it also contains the full link, which lets us read that one note to decide what to do. Reports are forwarded to abuse@lullpage.com and kept at the relay for 90 days.
Error reports
When something goes wrong in the apps or the relay, an error report goes to Sentry (Functional Software, Inc.), stored in Sentry's EU region; a small sample of performance timings goes with them. A report contains what went wrong in the code, the app version, the type of device and its operating system, timings, and random ids.
It never contains note content, titles, tags, search terms, attachment names, email addresses, IP addresses or the contents of requests, and there is no recording of your screen or your session. Sentry is set not to store IP addresses; it uses the address only to estimate a country and then discards it. Reports from inside a locked folder carry ids only. Sentry keeps reports for at most 90 days. The share pages and this website send no error reports at all.
Hosting and this website
This website, the web app at app.lullpage.com, the relay and the share pages are
served by Cloudflare, Inc., which handles IP addresses and request details to deliver them and to
protect them from attacks, under its own
privacy policy.
This website sets no cookies, runs no scripts and loads nothing from any other site. We do not use Cloudflare's web analytics. The only cookie lullpage uses is the web app's connection to Google, described above, which is needed for the web app to stay connected and is not used for anything else.
If you install lullpage from the App Store or Google Play, Apple or Google handles the download under its own terms and privacy policy.
When you write to us
If you write to hello@lullpage.com, privacy@lullpage.com or abuse@lullpage.com, your message is delivered to our mailbox at Fastmail, our email provider. We use your address and message only to reply to you and to keep a record of what we were asked, and we delete them when we no longer need them. lullpage sends no email of its own.
No ads, no tracking, no selling
lullpage shows no ads and contains no trackers, advertising identifiers or third-party analytics. We do not sell, rent or trade personal data, and we share it only with the providers named in this policy, to run lullpage. If we ever add usage counts to help improve lullpage, they will be off unless you turn them on, will never describe what you write, and this policy will say so before they arrive.
Deleting everything
We have no access to your library, so only you can delete it. There are two ways, and nothing is kept afterwards on our side.
- In the app: in Settings, choose Disconnect and delete library and confirm. lullpage removes your library from your Google Drive.
- Without the app: in Google Drive on the web, open Settings, then Manage apps, find lullpage, and choose Options then Delete hidden app data, then Disconnect from Drive. Then remove lullpage's access in your Google Account under Your connections to third-party apps and services. If you made share links, delete the “lullpage links” folder from your Drive too.
On your devices, uninstall the app; for the web app, remove the site's data in your browser's settings. Records at the relay about your links and messages end on their own, within the periods listed above. To have them removed sooner, write to privacy@lullpage.com with the link concerned; we cannot find them otherwise, because we do not know who you are.
Your rights
Because lullpage has no accounts and cannot read your library, we hold very little that can be linked to you, and we may need you to point us to it, for example with a share link's address or the email address you wrote from. Write to privacy@lullpage.com and we will answer within 30 days.
Under Singapore's Personal Data Protection Act 2012, you can ask what personal data we hold about you and how it has been used in the past year, ask us to correct it, and withdraw your consent. If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission.
If you are in the European Economic Area or the United Kingdom, the GDPR and the UK GDPR also give you the right to access, correct or delete your personal data, to restrict or object to how it is used, to receive it in a portable form, and to complain to your local data protection authority (in the UK, the Information Commissioner's Office). We use personal data to provide the service you asked for, for our legitimate interest in keeping lullpage working, secure and free of abuse (error reports, limits on requests, and reports about share links), and to meet legal obligations.
Where data is processed
Ordinal Works is in Singapore. Cloudflare serves lullpage from data centres around the world, close to whoever is connecting. Sentry stores error reports in the EU. Fastmail stores email sent to our addresses in the United States. Your library is stored wherever Google stores your Drive. When personal data from the European Economic Area or the United Kingdom goes to a country without an adequacy decision, we rely on the standard contractual clauses in Cloudflare's and Sentry's data processing terms.
Children
lullpage is not meant for children under 13, or under the older age at which the law where they live lets them agree to online services on their own (up to 16 in some EU countries). Because there is no account, we do not ask anyone's age. If you think a child has sent us personal data, for example by email or in a report, write to privacy@lullpage.com and we will delete it.
Security and its limits
Every file is encrypted and signed on your device before it reaches Google or the relay, and the encryption design is reviewed independently before lullpage is released. Some limits remain, and we would rather you knew them:
- The web app is only as trustworthy as the code we serve to your browser at that moment. The phone and Mac apps carry their own reviewed, signed code.
- A device that is unlocked can read whatever you can read on it.
- If you lose every device and your recovery key, your notes cannot be recovered.
To report a security problem, write to hello@lullpage.com. Our security.txt says the same.
Changes to this policy
When this policy changes, the date at the top changes with it. For significant changes, we will say so on this page and in the app before they take effect.
Contact
Ordinal Works, Singapore. privacy@lullpage.com