Privacy Policy

Last updated 5 August 2026

Typewell has no server. There is no account to create, no database holding your notes, and no analytics of any kind. Your notes stay in your own browser until you explicitly connect a backup, and even then they go to your Google Drive or your GitHub account — never to us. We could not read your notes if we wanted to.

1. Who this applies to

This policy covers the Typewell web app published at typewell.net and its source repository. Typewell is a free, open-source project maintained by volunteers; there is no company behind it and nothing is sold.

2. What we collect

Nothing. Typewell is a single static HTML file. It has no backend, so there is nowhere for your information to be sent to or stored. Specifically, Typewell does not:

ask you to create an account or give an email address;
set cookies, or use any tracking, advertising or analytics service;
record your IP address, device, location, or how you use the app;
transmit the contents of your notes anywhere, unless you turn on a backup yourself.

3. Where your notes are kept

Your notes and preferences are saved in your browser's localStorage, under two keys:

Key	Contents
`typewell.notes.v1`	Your notes: titles, contents and timestamps.
`typewell.settings.v1`	Preferences — theme, default font, auto-backup, plus the backup identifiers described below.
`typewell.drive.v1`	Only if you connect Drive: which Drive file corresponds to which note, and when each was last synced. No note contents.

This data never leaves your device on its own. It is tied to that one browser on that one device: it does not follow you to another computer, and clearing your browser's site data for this domain erases it permanently. These policy pages read the theme preference from that same key so they match the app's appearance; they store nothing.

4. Optional backups

Both backup destinations are off by default and require you to connect them deliberately.

Google Drive

If you connect Drive, Typewell requests only the drive.file scope. That scope is limited to files the app itself creates — it grants no ability to see, open or list anything else in your Drive. Your notes are written to a Typewell folder in your own Drive account, one ordinary Markdown file per note, which you can read, edit or delete with any tool you like. The access token is held in memory for the duration of the session and is never written to disk; only the file identifiers described above and the fact that you granted access are saved locally. Data handled by Google under your own account is governed by Google's Privacy Policy.

GitHub Gist

If you supply a GitHub personal access token, Typewell writes a single JSON backup file to a secret gist in your account — unlike the Markdown in Drive, that file is an exact copy. The token needs only the gist scope. Data held by GitHub is governed by GitHub's Privacy Statement.

Worth knowing: the GitHub token you enter is stored in your browser's localStorage alongside your settings, so that backups keep working between visits. Anything with access to that browser profile can read it. Issue the token with the gist scope only, and revoke it from your GitHub settings if the device is shared, lost, or no longer yours. A secret gist is unlisted, not private — anyone given its URL can open it.

5. Third parties your browser contacts

Typewell itself sends nothing, but loading any web page involves requests to whoever serves it. For transparency, this is the complete list:

Service	When	What it necessarily sees
Google Fonts	Every visit	Your IP address and browser user-agent, as with any file fetched from another domain.
GitHub Pages	Every visit	Hosting provider for the site; GitHub may log requests as described in the GitHub Privacy Statement and its Pages data-collection note.
Cloudflare DNS	Name lookups only	Cloudflare is the authoritative DNS provider for `typewell.net`, so it answers the query that turns the domain into an address. The records are unproxied, so page requests go straight to GitHub and Cloudflare does not see them.
Google Identity Services	Only when you connect Drive	The sign-in script is not loaded at all unless you start connecting Drive.
Google Drive API	Only while Drive backup is on	The Markdown files it writes into the folder you asked it to keep.
GitHub API	Only while gist backup is on	The backup file you asked it to write.

None of these are analytics or advertising services, and none of them receive your notes except the two backup destinations you connect yourself. If you would rather not contact Google Fonts at all, download index.html and open it from your own disk — Typewell runs perfectly from a file:// URL, and the fonts simply fall back to your system's.

6. Cookies

Typewell sets no cookies, so there is no cookie banner to dismiss. localStorage is used instead, purely to hold your own notes and settings as described above.

7. Deleting your data

Because we hold nothing, there is nothing for us to delete and no request for you to send. You are always in full control:

Notes and settings: delete notes in the app, or clear site data for this domain in your browser to remove everything at once.
Drive: delete the Typewell folder in your Drive, and revoke Typewell's access at your Google account permissions.
Gist: delete the gist, and revoke the token in your GitHub developer settings.

8. Children

Typewell is suitable for general audiences and collects no personal information from anyone, children included.

9. Changes to this policy

If this policy changes, the date at the top will change with it, and the edit will be visible in the project's public commit history — so you can see exactly what changed and when.

10. Contact

Questions or concerns are best raised as an issue on the project's issue tracker, where the answer is public and useful to everyone.