Privacy

Two kinds of people, and who is responsible for what

Latest Note has two kinds of user. Owners sign in to publish updates and manage ideas. End users are the people reading those updates and voting on ideas, on the owner's own website or public page. End users never have an account.

For owners' accounts, we are the controller: we decide what is kept and why. For what end users leave on a board — the ideas they add and the votes they cast — the owner of that board is the controller and we process it on their behalf.

People reading updates and voting

Nobody is asked to sign in, give an email address or create an account to read updates, vote or add an idea.

The widget sets no cookies. It uses the browser's local storage, on the website it is placed on, for three things only, and only for functions the visitor uses:

• a random visitor ID, created the first time they vote or add an idea — not before
• which of that site's ideas they have voted for, so the widget can show it
• when they last opened the updates panel, so the unread count is right

What we store when somebody votes or adds an idea

For each vote we store a one-way, keyed hash made from the visitor ID and the site. We never store the visitor ID itself. Because the site is part of the hash, the same browser voting on two different sites produces two unrelated values, so nobody can be followed from one site to another.

When somebody adds an idea, we store the title and details they typed. Please do not put personal information in an idea: it is shown publicly on that site's board.

An owner can choose to tell us which of their own signed-in users voted or added an idea. Their app signs that label so it cannot be forged. If they do, we store the label they send alongside the vote or idea. If they do not, there is nothing to store.

Clearing the browser's storage lets somebody vote again. That is deliberate. The only way to prevent it would be to fingerprint the device, and we will not do that.

IP addresses

To stop abuse, sign-in requests, votes and new ideas are rate limited. For that we make a keyed, one-way hash of the IP address (for IPv6, of the network block it belongs to) and count recent requests against it. The IP address itself is never written down, and the hashes are deleted after about 48 hours.

We don't keep a log of every request. Our own error logs record what went wrong, never IP addresses or email addresses. Cloudflare, which runs the service, handles requests under its own privacy policy.

Owners

To have an account you give us an email address. That is the only personal detail we ask for. There is no password, no name field and no phone number. You sign in with a link we email you.

Alongside it we hold the sites you manage, the posts you write, the ideas on your boards and how you have set them, images you upload, which team members are attached to each site and who owns it, the email addresses you send invitations to, and — on Broadcast — the web address you connect as your own domain.

If you pay for Beacon or Broadcast, we also hold your plan, the Stripe customer and subscription references, whether the subscription is active, and when it renews. Your card and billing address are held by Stripe, not by us.

When you sign in we set one cookie that keeps you signed in. It holds a random value; we store only a hash of it. It lasts 90 days and is renewed while you keep using the service.

• Why we hold it: to provide the service you asked for and keep it secure.
• The legal basis: performance of our agreement with you, and our legitimate interest in running and securing the service.
• How long: while your account exists — see deleting, below. Sign-in links expire after 15 minutes, unaccepted invitations after 7 days and sessions after 90 days without use; once expired they are erased the next time the service tidies up, which happens whenever new ones are made.

Who else touches it

As few companies as we can manage. Each does one job:

• Cloudflare — hosting, the database (held in Cloudflare's EU jurisdiction), storage for images in posts, certificates for owners' own domains, and Turnstile, the check that a person rather than a bot is signing in or adding an idea.
• Resend — sending sign-in links and team invitations. No other email is sent.
• Stripe — taking payment for the Beacon and Broadcast plans. Card details go straight to Stripe and never reach us.
• Sereno — visitor counts on latestnote.com and on the public pages we host for owners, including those on owners' own domains. It sets no cookies and collects no personal data.

Transfers and selling

Some of these companies are based outside the UK. Where data reaches them it is covered by the contractual safeguards the law provides for such transfers.

We do not sell data, we do not share it for advertising, and no advertising network has access to any part of Latest Note.

Deleting

An owner can delete a site from its settings at any time. Its posts, ideas, votes, images and public page are removed straight away. Anywhere the widget is still installed, it shows an empty state instead. The site's address is never given to anybody else.

An owner can also delete their account. That erases their sign-in, their place on every team, and any sign-in links or invitations sent to their address. Sites they own that other people are also on pass to the longest-standing of those people. If they pay for a plan, the subscription is cancelled at Stripe first — if the cancellation can't be confirmed, nothing is deleted. Stripe keeps its own record of past payments, as the law on financial records requires.

Database backups, which exist so we can recover from a fault, roll off within 7 days, after which nothing deleted can be recovered.

If you added an idea or voted on somebody's board and want that removed, the owner of that board is the right person to ask. If you cannot reach them, email us.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. Email privacy@latestnote.com and we will answer within a month.

If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Changes

If this policy changes in a way that matters, we will email account holders before it takes effect. The date at the top always says when it last changed.