Privacy Policy

Effective 12 October 2026

Honeycomb Notes is made by Busy Bee Software, a sole trader in South Australia (“we”, “us”). This policy explains what information the Honeycomb Notes app, this website and the optional sync service handle, and what we do with it. You can contact us at honeycombsupport@busybeesoftware.com.au.

The short version

• The app keeps your notes on your own computer, as ordinary files. We never see them unless you turn on sync.
• If you use sync, your notes are encrypted on your device before they are uploaded. We cannot read their content, titles or folder names.
• We do not sell your information, show advertising, or use analytics or tracking in the app or on this website.
• You can delete your sync account and all cloud data yourself, from inside the app, at any time.

1. The app on your computer

You do not need an account to use Honeycomb Notes. Your notes, attachments and settings are stored on your computer in the vault folder you choose. The app does not send usage statistics, crash reports or advertising identifiers to us or anyone else.

The app contacts the internet only when you ask it to or turn on a feature:

• Check for updates. When you press this button, the app requests a small file from www.honeycombnotes.com.au. Like any web request, this lets our web host see your IP address and the app’s version.
• Sync. Only if you create or log in to a sync account (see section 2).
• Connect your AI (MCP). The app has no built-in AI. If you choose, you can connect an AI assistant that you already use to your notes through a local connection on your own computer. We do not see that connection or what passes through it. What that assistant does with your notes is governed by its own provider’s terms and privacy policy, so connect only assistants you trust with your notes.
• Text recognition (OCR) and everything else in the editor run on your computer and send nothing out.

2. Sync accounts: what we hold

If you create a sync account we hold the following.

• Your email address, so we can verify your account, send you security and billing-related messages, and let you recover access.
• Login and key material, not your password. Your password never leaves your device. Your device turns it into a login key, and we store only a scrambled (hashed) version of that key. We also store encrypted copies of your encryption key, locked by your password and by your recovery key, plus a hash of a proof from your recovery key. None of these lets us read your notes.
• Your encrypted notes. We store encrypted data blocks, opaque identifiers, their sizes and version numbers, and the timing of changes. We cannot read note content, titles, folder names or attachments. We can see how much you store and roughly when you sync.
• Your devices. The names you give them (for example “Work laptop”), when each was added, and when each was last seen.
• Subscription details. Your trial and subscription status and dates, and the customer and subscription identifiers that link your account to Stripe (see section 3).
• Short-lived technical records. Temporary email verification codes (stored in scrambled form), and counters that limit repeated sign-ups and logins, which include the IP address or email address they apply to. The counters are deleted after about a day.

We send you emails to verify your address, to alert you when a new device signs in, to confirm security changes, and to warn you if your subscription has lapsed and your cloud data is approaching deletion. We do not send marketing email.

3. Payments

Payments for sync are handled by Stripe, which acts as the seller of record for the subscription. When you subscribe, you give your card and billing details (and, where required, your address and tax details) to Stripe on its own pages. We never see or store your card number. Stripe tells us your subscription status, and we keep your email address and the identifiers described above. Stripe’s own privacy policy explains what it does with your information, and Stripe keeps payment records for as long as the law requires.

4. Who else handles your information

• Cloudflare hosts the sync service, stores its database and encrypted data blocks, and delivers this website.
• Resend delivers our emails, so it sees your email address and the content of the messages we send you, such as verification codes.
• Stripe processes payments, as described above.

These providers may handle information in the United States and other countries outside Australia. We use them only to run the service, and we do not give them your information for marketing. Each handles information under its own privacy policy. We may also disclose information when the law requires it, but because your notes are encrypted we would only be able to provide the limited details listed in section 2.

5. How long we keep information

• While your account exists, we keep the information in section 2.
• If you delete your account, we cancel your subscription and permanently delete your cloud data, your device records, your subscription record and the daily internal backups of your vault’s change log.
• If your subscription ends without you deleting your account, your cloud copy becomes read-only for 30 days, is then locked (resubscribing restores it instantly) and is permanently deleted 90 days after the subscription ended. We email you before each stage.
• Accounts that never verify their email address are removed automatically.
• Stripe and our email provider keep their own records under their own policies. We keep messages you send us for as long as needed to help you.

6. Security

Notes are encrypted on your device with modern, standard cryptography before they leave it, and the connection to our servers is encrypted. Our server checks and relays encrypted data and has no way to decrypt it. Because of this we cannot reset your password or recover your notes for you. If you lose both your password and your recovery key, your cloud copy cannot be recovered, although the notes on your own devices are unaffected. No system is perfectly secure, and we cannot guarantee that it will never be breached, but we have designed it so that a breach of our servers would not expose your note content.

7. Your choices and rights

You can see and download your account details and subscription information from inside the app (Settings, then Sync, then “Download my account data”), change your password and recovery key, sign out individual devices, and delete your account. You can also ask us to correct or delete information we hold about you, or to tell you what we hold, by emailing us. We aim to handle personal information in line with the Australian Privacy Principles.

If you have a concern, please contact us first so we can try to fix it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

8. Children

Anyone can use the Honeycomb Notes app on their own computer, because it collects no personal information from them. A sync account requires you to be at least 16 years old. We do not knowingly collect information from anyone under 16 through sync, and if we learn that we have, we will delete the account.

9. This website

This website does not use cookies, analytics or advertising trackers. Our host, Cloudflare, processes ordinary web request details (such as IP addresses) to deliver pages and downloads and to protect against abuse.

10. Changes

We may update this policy. We will post the new version here with a new effective date, and if a change is significant we will also email sync account holders.

Contact

Busy Bee Software, South Australia, Australia
honeycombsupport@busybeesoftware.com.au