Privacy Policy

Effective September 29, 2026

MyIdol is built to handle only what it needs, and to keep as much as possible on your PC. This page explains what is stored where, and when the app uses the internet.

• No account. The app does not collect your name or email.
• To-dos, notes, records, and settings stay on this PC.
• Notes sync is optional. When on, notes are encrypted on your PC before they are sent, and the server cannot read them.

Stored only on your PC

• To-dos, notes, records, settings: the %APPDATA%\MyIdol folder
• Calendar (ICS) URL, license key, notes-sync connection code: Windows Credential Manager
• The app never reads what you type. There is no global keyboard hook; it only checks whether you are away (idle time).

When the app uses the internet

• Calendar (optional): fetches events from the ICS URL you enter. Requests go straight to that server, not through ours.
• Notes sync (optional): see below.
• License: keys are verified offline; no server is contacted.

What the sync server stores

• A hash of the auth token derived from your connection code (the space ID). The code and token themselves are never stored.
• Per note: a random ID, last-modified time, deleted flag, and ciphertext (AES-256-GCM)
• Per space: created time, last-used date (updated at most once a day), note count, size

What the server does not store

• Note contents in plain text, your connection code, or the decryption key
• Name, email, or any account information
• IP addresses (not recorded in the server database)

Retention and deletion

• Deletion records are cleaned up after 90 days.
• Data for a connection code unused for one year is deleted automatically.
• In the app, Settings → Notes sync → Delete notes on server removes server data immediately.
• If you lose your connection code, we cannot recover it. Do not share it with anyone.

Processors and international transfer

• Cloudflare, Inc. (USA): runs the website and the sync server. The sync data above is stored on Cloudflare infrastructure, and connection network data is processed by Cloudflare. Retention is as described above.
• Lemon Squeezy (USA): handles payment and tax as merchant of record. Card details never reach us; we receive only the order email to send your license key.
• GitHub (USA): hosts installers. The download page calls the GitHub API from your browser to check the latest version.

Website

• Visit statistics use cookie-free Cloudflare Web Analytics. No personally identifying information is collected.

Contact

• AYH Labs · [email protected]
• Changes will be posted on this page with a new effective date.