Privacy
Slate keeps your notes on your own disk and works with no server at all. This page is about the other case: what Slate's hosted relay holds when you sync through it, how long it holds it, and what is left once you delete your account.
What the relay stores#
A hosted account is by invitation only, for people aged 18 or over, and invitations go out when the closed beta opens. When you accept one and fill in the app's Create account form, the relay writes the following, and holds it until the account is deleted.
The email address you gave it, a verifier for your password rather than the password itself, a sealed copy of your recovery kit that only your own devices can open, whether the address has been confirmed, and whether the account has been suspended.
The name you gave each one, and the time it last synced.
As encrypted data the relay cannot read. Note text, file names and folder names are all encrypted on your device before any of it is sent.
The address an invitation was sent to, in the clear. One invitation can be live for an address at a time, and it stops working after seven days.
The recipient, the subject and the body. The body is erased in the same step that sends the message. A sent message keeps its recipient, its subject and the time it went for thirty days, and is then deleted. A message the relay gave up on is kept until an operator clears it, because it is the only record that something was owed and never arrived. If it was addressed to someone who never went on to have an account, deleting an account is not what takes it away.
The count is held against a one-way hash of the address instead of the address itself, so the relay can hold a sending limit without keeping a stranger's address in order to apply it.
What the machine logs#
The relay runs behind a web server on the same machine, and both of them write a log.
It holds the address your device connected from, the time, the method and path it asked for, the status it was answered with, and the size of that answer: those five fields and nothing else. No referrer, no browser or device name. It is kept for fourteen days and is then deleted.
It names the route that was called, the status it answered with and how long it took, together with a random identifier that ties the lines of one request together. That identifier is made on the spot and means nothing outside the log. When the relay turns away a burst of sign-in attempts, or sees a sign-in token used twice, the line also holds the address the request came from. No email address, note, file name, vault name or key is ever written to it.
Who else handles it#
Slate runs on infrastructure from other companies. Each one handles only the part named here.
Rents Slate the server the relay runs on, in London. The relay's store and its logs are held there.
Holds the daily backup, in the United States. The backup is encrypted before it leaves the server. Backblaze is certified under the UK Extension to the EU–US Data Privacy Framework, which is what lets UK data be held there.
Sends Slate's mail, from France: invitations, address confirmations and password-reset messages. It handles your address and the text of each message, and nothing else about your account: not your notes, not your devices, not your keys. How long it keeps what it handles is set by its own terms.
Has your email address if you are added to the test of the iPhone app through TestFlight. On a Mac or an iPhone, it also serves the speech data for your language, which the system downloads when the app first needs it, or when you ask for the download in Settings. Apple sees the address your device connects from and the language it asked for, and no recording or transcript. On a Mac, besides the relay and the update check, this download is the only connection the app makes; on an iPhone, which TestFlight and the App Store keep up to date, it is the only one besides the relay. Apple's own terms cover both.
Serves the speech model and a small speech detector that the app downloads on Linux and Windows: the speech model when the app first needs it or when you ask for the download in Settings, the speech detector when you turn it on in Settings. It sees the address your device connects from and the name of the file, and no recording, transcript or account. On Linux and Windows, besides the relay and the update check, these downloads are the only connections the app makes.
Backups#
The relay's store is copied once a day, and the copy is encrypted and kept off the machine, with Backblaze, so that a server that is lost or broken does not take your notes with it.
Seven daily copies are kept, then four weekly ones. A deleted account can therefore still sit in a backup for about five weeks, until the last copy that holds it ages out.
A backup is opened only to bring the service back after a disaster. It is not a place anyone looks in to answer a question about an account.
Deleting your account#
One request deletes the account and everything held against it, at once: the account itself, your devices, all of your encrypted notes, and any mail still queued for your address. Two things are kept on purpose.
It is held as a hash of the address. Deleting an account must not clear a sending limit that exists to stop mail being aimed through Slate at somebody who does not want it.
It is kept so that you can be invited back. It stops working seven days after it was made, like any other.
The backups above are the one thing that outlasts the request: a copy taken before you deleted the account still holds it until that copy ages out.
Two cases are refused. While a password reset on the account is less than 24 hours old, the relay will not delete it, so that the reset can still be undone; the request works once the 24 hours have passed. While the account is suspended, it cannot delete itself, and the operator closes it instead.
What is not collected#
This site runs no analytics of any kind: no cookies, no trackers, no third-party scripts, and no measurement of who visits it.
The relay reports numbers about itself, so that it can be kept running: which routes were called, how many times, how long they took, and how large the store has grown. The route names are fixed in the code, and no account, address, vault or note can appear beside them.
The server that serves this site counts how many pages it sends and how many installers are downloaded in full. It also counts every answer it gives, by whether it succeeded, redirected or failed, and how many bytes it sent, and every request to the download server by the kind of file asked for, which includes the app checking for an update and a Linux package manager reading the list of packages. A count carries no address, no page name and no browser, so it identifies no one.
The desktop app checks for a new version once at launch and then once a day while it is open, by reading the list of releases from the download server, and you can turn the check off in Settings. The request names the app, its version and the system it runs on, so that the app's own checks can be counted apart from people, and nothing else: no account, no identifier and nothing about your notes. The download server keeps no address for any request. The app never sends back what it found.
None of this is compulsory. Slate works with no server at all. A relay you run yourself comes after the closed beta.
Why it is held#
UK data protection law asks for a reason, called a lawful basis, for everything that is held about you.
Your account, your devices, your encrypted notes and the mail the relay owes you. You asked for the service, and it cannot run without them.
The logs, the sending limit, the invitations and the backups. Slate has a legitimate interest in stopping abuse, finding faults and recovering from a failure.
Who is responsible#
Slate's hosted relay is run by one person, not a company.
The controller, in the words of UK data protection law, is Graham Mawji-Bull.
Write about anything on this page to privacy@slateoutliner.com.
Your rights#
You can ask what is held about you, for a copy to take elsewhere, for it to be corrected or deleted, or for its use to be limited or stopped. Write to the address above. The answer comes within a month, at no cost.
To delete everything at once, delete your account in the app, as described above.
An email address cannot be changed. Delete the account and create a new one with the right address.
If you are unhappy with how your data is handled, write to the address above, and you will hear back within 30 days. You can also complain to the Information Commissioner's Office, the UK's regulator for data protection.