Security and privacy
What Notefix keeps, where, and who can reach it. The short version: everything stays on your own servers, and it is exactly as private as the page it is on.
Who can see notes#
There are no logins yet. Anyone who can open a page with Notefix on it can read every note on that board, write new ones, and delete them. Only put Notefix on pages that are already protected: behind a password, a VPN or an internal network.
Logins and per-project access are being built. Until then, the protection is whatever already guards your staging site.
Screenshots#
A note can carry screenshots, and a screenshot shows whatever was on the screen: customer names, emails, figures. A board is as sensitive as the pages it is about. Treat the store's database and its backups like the data on those pages.
Where things are kept#
| What | Where | Who can reach it |
|---|---|---|
| Notes and screenshots | The store's database, notefix.db, on your server | Anyone who can open the page |
| A copy of notes | Each reviewer's browser storage | That browser |
| Your name and settings | Your browser storage | Only you. Never sent to the store |
| Email addresses and email choices | The store's database, apart from the notes | Only programs holding the secret |
| Tracker and Slack tokens, mail passwords | Settings files on your server | Only the connector and notifier |
Nothing is sent to BBASHI or to anyone else. Notefix makes no requests except to the store path you gave it.
Tokens never reach the page#
The page is visible to everyone who opens it, so it never holds a tracker token, a webhook address or a password. The page only marks a note as waiting; the connector, on your server, holds the token and does the filing.
- Keep settings files readable only by their owner (
chmod 600), as the setup pages show. - Give each token the least it needs: one repository, one project, one board.
- Set
NOTES_CONNECTOR_SECRETon the store, so only your connector and notifier can change a note's ticket or read email addresses.
What the store checks#
- Ticket links shown on notes must be
httpsand on GitHub, Trello or Atlassian, so a note can never carry a link to somewhere else. Add your own tracker's address withNOTES_ISSUE_HOSTS. - Size limits on every request, note and drawing, so one misbehaving browser cannot fill the disk.
- Email is confirmed first. Signing up sends one email asking to confirm. Nothing else is sent until the person presses Confirm, and sign-ups are rate limited.
- Email links are signed, and only change settings for the one address they were sent to.
Deleting data#
- One note: delete it from its card. It is removed for everyone.
- Finished notes: Settings, Clear finished. Decisions are kept.
- Everything: stop the store and delete
notefix.db, and its backups. - One email address: someone who signed up from the page can press Stop emails in Settings, or Remove my address on the page any Notefix email links to.