Privacy Policy

Who is responsible

Barrio.Works is an Alplus Technologies initiative. The data controller is Alplus Technologies S.R.L., Timișoara, Romania. Write to us at hello@alplustech.com.

The guest canvas

Your notes, shapes, code blocks, frames, and Spaces save to IndexedDB in your browser. If IndexedDB fails, the canvas uses localStorage and tells you. The canvas does not send your board content to our servers.

This also means that we cannot recover a board for you. If you clear your browser data, the board is gone. Another browser or device will not show it.

This site sets no cookies while sign-in is off. The browser storage that the canvas uses stays on your device.

Exchange rates

Note math can convert currencies. Your browser asks only this site for the rates, at /api/fx/rates, and keeps a copy in localStorage. Our Worker gets the European Central Bank rates from Frankfurter (api.frankfurter.dev). That request is a fixed URL. It holds nothing from your notes or your browser. Your browser sends no request to Frankfurter.

Sign-in and cloud sync

Sign-in and cloud sync are not available today, so we store none of the data in this section now. The code exists, but we have not turned it on. When we turn it on, and only if you choose to sign in, we will store:

• Your account: a user ID that we create, and your name, email address, email verification time, and profile image URL.
• Your sign-in link: the provider name (Google or GitHub), your provider account ID, and the tokens that the provider returns, with their type, scope, and expiry time.
• Your sessions: a random session token, your user ID, and an expiry time. A session expires after 30 days without use.
• Your synced boards: Space names and positions, each board document, and its revision, hash, size, and update time. This data is in Cloudflare D1. A document above 512 KiB is in Cloudflare R2.
• Your revisions: the last 50 revisions of each synced board. A revision holds a hash and a size. For a large board, it also holds a full copy of the document in R2.

Guest boards do not go to our servers when you sign in. The canvas offers a copy, and it copies them only if you choose this.

When sign-in is on, it uses cookies only to keep you signed in and to protect the sign-in. On this site, these cookies are:

• __Secure-authjs.session-token
• __Secure-authjs.callback-url
• __Host-authjs.csrf-token
• __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, and __Secure-authjs.nonce, which are for short checks during sign-in

When you are signed in, your browser loads your profile image directly from Google or GitHub, so that provider receives that request.

MCP guest boards

The MCP tools are different. Hosted MCP is closed, so guest boards are available only on a Worker that you run on your computer. What an agent sends to a guest board is stored in the local database of that Worker, with no authentication. Any process on your computer with the board_id can read geometry and write to that board. Use synthetic content only, and do not put private notes there. Boards that agents wrote to the development server before it closed stay there.

Hosting and logs

Cloudflare hosts this site and handles each request, and we keep Worker logs to run and secure the service. These logs can include request details such as the time, the URL, and your network address.

No tracking

We do not sell your data. We do not show advertising. These pages and the canvas use no analytics or advertising scripts, and all fonts come from this site.

Why we use your data

• To run the service that you ask for. This covers your account, your sessions, and your synced boards when sign-in is on.
• Our legitimate interest in security. This covers our Worker logs, which we use to keep the service running and to stop abuse.

Who processes your data

• Cloudflare hosts the site, data, and logs.
• Google and GitHub process your sign-in, but only when sign-in is on and you choose that provider.

These providers operate in many countries, so your data can be processed outside your country. Frankfurter supplies the exchange rates, and it receives no data about you from us.

How long we keep data

• Guest boards stay in your browser until you remove them.
• We keep Worker logs for a limited time to run and secure the service.
• When sign-in is on, we keep your account and synced boards until you ask us to delete them. We keep the last 50 revisions of each synced board.

Your rights

You can ask us for access to your data, correction, deletion, and an export of it. You can also object to how we use it. To do this, write to hello@alplustech.com. You can also make a complaint to your data protection authority.

We cannot read, change, or delete a guest board, because it exists only in your browser. You control that data.

The model, and copies that you host

Our model is not a subscription. Pay once and we host it for you, or download the source and host it yourself, when we publish the source. The model that inspired this is once.com. ONCE is a trademark of 37signals. Barrio.Works is not affiliated with 37signals.

We receive no data from a copy that you host yourself, unless you send it to us.

Children

Barrio Notes is not for children under 16.

Changes

When we change this policy, we post the new date on this page. We will update this policy before sign-in starts, if the facts here change.