Privacy Policy

Last updated 22 October 2026

bpad is a notepad at bpad.cc, made and run by one person: me, Matias Barragan. This page explains what bpad keeps about you, where it is kept, which companies help run it, and how to get any of it removed. If something here is unclear, write to mati@barragan.com.py.

Without an account

You can write in bpad without signing up. Those notes stay in your browser, in its local storage, and are never sent to me. Clearing your browser's site data deletes them, and I have no copy to bring back.

With an account

Signing up and signing in are handled by Clerk. Clerk keeps your email address, your username, your name and profile picture if you add them, and your password or passkey in a form it can check but not read. It also sets the cookies that keep you signed in. I see your email, username, name and picture, never your password.

I keep what you write so it can follow you between devices: your notes with their titles, text and tags, the comments you post, the polls and their votes, and the files, images and voice memos you add. Files are stored at a long random web address, so anyone who has that address can open the file. Sharing keeps the share links you make, the people you invite and what each of them may do, and the requests people send to get access.

bpad also keeps notifications for you, such as mentions, new comments, access requests and "someone opened your note", which tells the owner of a shared note when you open it. Notifications you have read are deleted after 14 days.

Live editing

While a note is open, bpad carries edits between devices through a live room. The room holds a working copy of the note and shows the people in it to each other: their name, picture, caret color and where their caret is. Only people who can open the note can join its room.

On your device

Your browser keeps some things for speed and offline use: a copy of your notes list, a copy of each note you open so it works offline, your appearance settings, the words you added to your spelling dictionary and whether you have seen the tips. bpad uses no advertising, no analytics and no tracking cookies.

The Claude connection

No AI inside your notes. Connect your own Claude if you want. The Claude connection is opt-in and off unless you connect it yourself: you add bpad to Claude, Anthropic's assistant, then sign in and approve it. Only then can Claude list, read, create, change and delete your own notes, and only when you ask it to, never notes others shared with you. What Claude reads is handled by Anthropic under its own privacy policy. You can disconnect it in Claude at any time.

Who helps run bpad

bpad runs on a few services, and each one only gets what it needs to do its part. Vercel hosts the site and its servers, which run in Singapore. Neon hosts the database, also in Singapore. Vercel Blob stores your files. Clerk handles accounts. Cloudflare runs the live rooms close to wherever you are. The typeface and the spelling dictionaries come from bpad.cc itself, so your browser asks no other company for them. Your data may be handled outside your country by these services.

I do not sell your data, rent it, or use it to show you ads, and nobody reads your notes unless you share them.

How long I keep it

Your notes and everything attached to them stay until you delete them. Deleting a note removes it from the database for you and for everyone it was shared with. Delete account, at the bottom of Settings, erases everything at once: your notes and the files in them, your comments, your sharing and notifications, and then your account. If you can no longer sign in, write to me from the email on your account and I will erase it within 30 days.

Your choices

You can export any note as .pdf, .md, .txt or .docx whenever you like, change your details in your account settings, delete notes yourself, and delete your whole account from Settings. You can also ask me for a copy of what I hold about you, to correct it, or to delete it, by writing to mati@barragan.com.py. I answer within 30 days.

Keeping it safe

Everything travels over HTTPS. The server checks who may open, edit or share each note on every request, and live rooms only let people in with a signed, short lived pass. No system is perfectly safe, so please keep sensitive secrets out of notes you share by link.

Children

bpad is not meant for children under 13, and I do not knowingly keep accounts for them.

Changes

When this policy changes, the date at the top changes too. If a change matters for how your data is used, I will say so in bpad before it takes effect.