Uni3K
Uni3K Privacy Policy
Uni3K (大千) collects only the data it needs to run. We do not show ads, track you, or sell your data, and we do not use your content to train AI models. This policy covers app.uni3k.com and its cloud features. The service is run by an independent developer under the name Uni3K. Contact details are at the end. The browser extension has its own privacy policy, which remains in effect and does not conflict with this one.
What we collect
| Category | What | Why |
|---|---|---|
| Account | The email address, name and account ID that Google or Apple provide when you sign in | To create and identify your account |
| Passkeys | The public key, device name, and when it was added and last used. The private key stays on your device | To let you sign in with a passkey |
| Sign-in | A random token. The server stores only its hash. It expires after 30 days without use | To keep you signed in |
| Your content | The text, titles, source URLs, canvas layouts and folder names of your cloud cards | To store it and sync it between your devices |
| Locked cards | Only ciphertext, plus a salt and your card key encrypted with your lock password | To store content only you can open |
| Preferences | Theme, language and layout settings | To keep them the same on every device |
| Access data | IP address | To limit request rates and prevent abuse. We do not write IP addresses to our database |
Legal bases
- Contract: your account, sign-in, content and preferences are needed to provide the service you asked for.
- Legitimate interests: using IP addresses to limit request rates and prevent abuse, and keeping daily backups, protect the security and reliability of the service.
- We do not rely on consent, and we do no marketing or profiling.
Locked cards
Locked cards are encrypted in your browser with a key that only your lock password can unlock. The password is never sent to us. Neither the server, nor we, nor any AI can read them. If you forget the lock password, we cannot recover the content for you.
Cookies and local storage
We use one sign-in cookie, plus short-lived security cookies during sign-in that expire within 10 minutes. Your browser also keeps your interface preferences and an offline copy of the app. There are no analytics or advertising cookies, so no cookie banner is needed.
Who processes your data
- Cloudflare runs our servers, database and backup storage. The database is stored in the western United States.
- Google and Apple confirm your identity, only when you choose to sign in with them. We do not read any other data from those services.
We do not share your data with anyone else unless the law requires it. If we add AI features later, they will use an API key you provide, and we will update this policy before they go live.
International transfers
The database and backups are stored in the western United States and hosted by Cloudflare, a US company. If you are in the EU, the EEA or the UK, your data is therefore transferred to the United States. It is protected under Cloudflare's data processing agreement, which includes the EU Standard Contractual Clauses. Cloudflare also participates in the EU-US Data Privacy Framework.
How long we keep data
- Cards are kept until you delete them. Cards in the trash are kept until you delete them permanently.
- When you delete a card permanently, its content is removed at once. Only its ID and timestamps remain, so your other devices know to delete it too.
- Deleting your account removes the account and all cloud cards at once. Cards stored on your device or in your own sync folder are not affected.
- Daily backups are kept for up to 30 days and then deleted automatically, so deleted data can remain in a backup for up to 30 days.
Your rights
- Access and correction: you can see and edit everything directly in the web app.
- Export: you can export Markdown or JSON from Settings at any time, always free.
- Deletion: you can delete single cards or your whole account in Settings.
- Other requests: email support@uni3k.com and we will reply within 30 days.
If you are in the EU, the EEA or the UK, you can also ask us to restrict or stop processing your data, and you have the right to complain to your local data protection authority.
Children
The service is not meant for children under 13, or under the higher age that local law sets (for example 16 in some EU countries). If we learn we have collected a child's data, we will delete it.
Changes
We will announce important changes in the web app in advance and update the effective date at the top of this page.
Contact
The browser extension has its own privacy policy.