Privacy
In short
Noshi is built to know as little about you as possible. There are no accounts, no email sign-up and no tracking. This page says what data exists when you use Noshi, where it lives, and what you can ask of us.
What we never collect
- Your name, email, phone number or postal address.
- Advertising or analytics identifiers. We run no analytics scripts and no third-party trackers.
- The contents of your notes. They are encrypted in your browser with a key that lives in the link, and the link's key is in the part of the URL after the #, which browsers never send to a server.
What exists, and where
| Data | Where it lives | Why |
|---|---|---|
| Your wallet address, the stock, the amount, the dates | Robinhood Chain, publicly | This is how a sealed envelope exists. Anyone can read the public chain. |
| The encrypted note | Robinhood Chain, as ciphertext | So the person with the link can read it. Without the link it is unreadable. |
| The links you create | Your browser's local storage, if you allow it | So you can share them again from Sent and received. Never sent to us. |
| Your cookie choice | Your browser's local storage | So we don't ask again. |
| Request logs (IP address, time, page) | Our hosting provider, kept up to 30 days | Security and abuse prevention, including rate limits on the service that submits openings. |
The service that submits openings
When someone opens an envelope, their browser sends us the envelope's public key, the destination address and a signature, so we can submit the opening and pay its network fee. We keep this only as long as needed to submit the transaction and in the request logs described above. The resulting transaction is public on the chain.
Legal basis
Under the GDPR, we process request logs on the basis of our legitimate interest in keeping the service secure and available, and the storage on your device on the basis of your consent, which you can withdraw at any time in Cookie settings. Public chain data is created by your own transaction; we do not control it and cannot erase it.
Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. You also have the right to complain to your local data protection authority.
Because we hold almost nothing, most requests are answered by the table above. For anything else, write to us through our X account and we will reply within 30 days. We will never ask for your seed phrase or private key.
Third parties
Pages are served by our hosting provider. Purchases go through Uniswap's public contracts; USDG is issued by Paxos; stock tokens are issued under their own terms. Each of them has its own privacy practices for the parts they run. We share no data with them.
Changes
If this policy changes, the date at the top changes too, and material changes will be announced on our X account. See also the cookie policy and the terms.