Privacy policy

Version of [DATE]

Draft. Fill in the highlighted fields and have a lawyer review the text before publishing. The Russian version prevails.

1. Who processes the data

The data controller is [full name / sole proprietor, tax ID] (“we”). Contact: [support email].

2. What data we receive

Island runs on your computer. Until you sign in to a cloud account, it sends us no data.

If you create a cloud account, we receive and store:

• your email address — to sign you in and contact you;
• the computer name and last activity time of each of your devices — to show you the device list;
• the IP address of requests — temporarily, to protect against password guessing;
• encrypted sync data (tasks, snippets, hosts, settings, mail passwords and service keys).

3. End-to-end encryption

Sync data is encrypted on your computer with a key derived from your password. Neither the password nor the encryption key is sent to our server. We store only encrypted data and cannot read, restore or hand it over to anyone in readable form. If you forget both your password and your recovery key, the cloud data cannot be recovered.

We see the service information needed for syncing: the number and size of records, when they changed, and section names (for example, “tasks”).

4. Why we process data

• to provide sync between your devices;
• to protect accounts from unauthorized access;
• to contact you about the service.

We do not sell data, use it for advertising or share it with third parties, except where required by law.

5. Where data is stored

The sync server is located in the Russian Federation. Network access to it is provided by Cloudflare, Inc. (transfer of encrypted traffic); Cloudflare cannot access the content because it is encrypted on your computer.

6. Third-party services you connect yourself

If you connect a mailbox, an AI service (for example, OpenAI, Anthropic, Cloud.ru) or cloud speech recognition, the app talks to them directly from your computer with your keys. Their processing of data is governed by their own terms; we are not part of that exchange.

7. Retention and deletion

Account data is kept while the account exists. You can ask us to delete your account and all data by writing to [support email]; we will delete it within 30 days. Server backups are overwritten no later than [14] days later.

8. Your rights

You may ask which of your data we process, request corrections or deletion, and withdraw consent to processing. To do so, write to [support email].

9. Changes

A new version is published on this page with its date.