Data security

Notes Sharing is designed to hold as little of your data as possible and to protect what it does hold. This page explains how.

Your files never touch our servers

When you upload a note, your browser sends the file directly to your own Google Drive. Our server only creates the upload session and then records the note's title, category, size, type and Drive link. We never store or proxy file contents.

Least-privilege Google access

• We request Google's drive.file permission, which only reaches files created by Notes Sharing. We cannot read the rest of your Drive.
• Your Google tokens are used only on the server and are never sent to the browser.
• You can revoke access at any time from your Google account permissions.

Sign-in and sessions

• Sign-in uses Google OAuth. We never see or store a password.
• Sessions use an HTTP-only cookie, so page scripts cannot read it. In production, cookies are marked secure and all traffic is served over HTTPS.

Access control on every request

• Every API request checks your session, and permission checks (member, owner, uploader) run inside the same database statement that reads or changes the data, so they cannot be skipped.
• Private communities are invisible to non-members, and only owners see member emails.
• All input is validated against a strict schema before it reaches the database, and database queries are parameterised to prevent injection.

Infrastructure

The app and its database run on managed cloud providers. The database is reachable only by the app server, and connections to it are encrypted.

Sharing by link

To let community members download notes, each Drive file is shared as "anyone with the link can view". The link is hard to guess, but anyone who receives it can open the file. Do not upload confidential or personal documents.

Deletion

Deleting your account immediately removes your profile, sessions, Google tokens, memberships and notes from our database. Deleting a community removes its members, notes, categories and download history. Files remain in each uploader's Drive.

Reporting a security issue

No system is perfectly secure. If you find a vulnerability, please email us privately before disclosing it. We will acknowledge your report and keep you updated on the fix.

Rahul Das, India
Email: rahulcodepython@gmail.com
Website: rahulcodepython.in