What Nullpad saves
The current development build saves note text and note details—type, labels, todo state, reminder time, and timestamps—in the app's private storage on your device. Final recognized speech is saved as ordinary note text; raw microphone audio is not stored.
For a scheduled reminder, Nullpad gives the operating system the time, note ID, and a shortened title and body so the device can show the local notification. Photo-to-ANSI keeps its generated text, local preview, and—by default—the chosen original image in app-private storage. Voice, reminders, photo/camera, durable merge, and native SFTP behavior are implemented in the development tree but still need complete physical-device, live-server, and recovery proof.
What Chris Mish receives
Nullpad does not require a Nullpad account and is designed without advertising, behavioral analytics, or tracking. Chris Mish does not receive your note contents simply because you use the app.
If a future release adds an optional network provider, this page will name it, say exactly what is sent, and explain retention and deletion before that release goes live.
Store billing
The planned store release is a free download. Local capture, camera import, editing, reading, search, organization, trash/recovery, reminders, and local export stay free, with no note-count limit. One annual auto-renewing subscription at a US reference price of $4 per year unlocks SSH sync, multi-device convergence/recovery, agent-skill delivery, and agent proposal application. A lapse will not hide, delete, or lock local notes.
Apple or Google will show the exact localized price, process the purchase, and provide transaction or entitlement status to the app. Nullpad does not need your card details. Note text, images, SSH credentials, server address, and contents of the synced folder are not part of the purchase transaction. V1 purchases restore only within their original store platform.
The development design verifies purchases through https://nullpad.tech/api/v1/entitlements/verify. The app sends one store-issued signed transaction document from Apple or purchase token from Google, the product ID, and a fresh random nonce. The verifier uses that proof only to ask the applicable store for current subscription state and return a signed, bounded entitlement. It is designed without a Nullpad account or purchase database: request bodies and store proofs are not retained or written to application logs. This endpoint is not live or included in a public build yet; the policy will be checked against its deployed configuration before release.
Local export
When you start a local export, Nullpad opens your operating system's folder picker. After you approve a location, it creates a new export folder there with readable Markdown for active and recoverable trashed notes, plus copies of committed images, ANSI artifacts, and previews.
This is a free, basic recovery copy. It is separate from SSH sync, device backup, and import; it does not update automatically and cannot be imported back into Nullpad. Nullpad does not receive or upload the exported copy. If you choose a third-party storage service or document provider, that provider controls the copy and its privacy terms apply.
Optional SSH sync
When SSH sync ships, enabling it will copy the notes, metadata, and media you choose to the server and path you configure. The connection is encrypted with SSH/SFTP.
SSH protects the transfer. It does not automatically encrypt files at rest on your server. The server administrator, authorized Unix users, and any agent you authorize there may be able to read the Markdown and media in that folder. This is your chosen destination, not a Nullpad-operated cloud account.
The release design keeps SSH passwords and private keys in secure storage supplied by the phone or tablet. They are not written into the synced notes folder. Credential integration and physical-device recovery still have to be completed and verified before sync is called release-ready.
Permissions
The current development build asks for access only when the action needs it:
- Microphone access—and speech-recognition access on iPhone and iPad—when you start voice input.
- Notification access when you save a future reminder.
- Camera access only when you choose to take a photo for ANSI art.
- Photo access only when you choose an image from the system picker.
Camera and photo-library support is now configured in the development tree and remains under native testing. Local-network access is not enabled in the current production configuration; if SSH sync ships, Nullpad will ask only when the operating system requires it for the destination you chose.
Denying these permissions does not prevent ordinary typed notes from working.
The current voice path uses only the device's on-device recognizer and has no cloud fallback. If a future release offers cloud transcription, it will be named, explained, and presented as an explicit choice.
Device backups, deletion, and recovery
Nullpad's current Android release configuration turns off cloud backup. On Android 12 or later, some device makers may still transfer app data directly between devices. On iPhone and iPad, if you enable Apple device backup, that backup may include Nullpad's local notes and attachments. Apple and the device owner control that backup; Nullpad does not operate it or receive its contents.
Removing local app data does not automatically remove the Nullpad sync folder on your SSH server. Remote files and history remain under the control of that server account. Exact deletion and recovery controls will be documented and tested before a sync-enabled release.
This website
This site sets no cookies and loads no advertising, analytics, trackers, contact forms, or third-party fonts. Its fonts and artwork are served from nullpad.tech.
Like most web hosts, the server may keep ordinary request and security logs needed to deliver and protect the site. Those logs are not combined with an advertising profile. If the subscription verifier is enabled here, its request bodies and store proofs will be excluded from application logging and not retained after the response.
Changes and contact
This policy will be updated before a release changes any of these data flows.
Questions about this policy: support@nullpad.tech.