How does PrivacyNotes handle GDPR and my data rights?

Mostly by holding as little as possible. Sign up with a phrase and there is no name, email, or identity on file to request: your data is ciphertext under a random public key, hosted in Zurich, Switzerland. Sign in with Google or Apple and exactly one identifier exists - the email your provider shares, linked to that key. Billing details for Pro live with Paddle, the merchant of record, not with us.

Every right is self-serve and immediate, no request form needed: access and portability are Settings > Import & Export (full export in open formats), erasure is Settings > ID & Sync > "Delete account & data..." with no retention window, and rectification is editing your notes. The formal version, including how to reach us for anything the app cannot do itself, lives in the privacy policy.