This notice covers the Derive app (web, Mac, Windows, iPhone and iPad) and the marketing website at derivenotes.com. It is published by Derive Notes Pty Ltd (ACN 696 859 597), 2/290 Boundary Street, Spring Hill QLD 4000, Australia. It sits under the Privacy Policy. Questions go to matt@derivenotes.com.
The short version
The core Derive app uses local storage and a local database. The web app also loads the Meta pixel and its cookies for advertising measurement: on by default outside the EEA, UK and Switzerland, with your explicit yes inside them, never for anyone we know is under 18, and off when you switch off Share usage analytics or send Global Privacy Control. The web app keeps a Google advert click reference in local storage for Google Ads measurement, which our servers report; no Google tag runs in your browser. The iPhone and iPad apps include Meta's kit, which keeps its own storage on the device, and may ask Apple which Apple Ads campaign led to the install. All of this follows the same rule. Google and Apple apply only to visitors who are not signed in and to accounts created on or after 3 October 2026.
The marketing website does use cookies. It asks you about the analytics ones on your first visit. One cookie, visitor_id, is set before you answer, and this notice says so plainly below rather than pretending otherwise.
What we mean by these words
- Cookie: a small file the website asks your browser to store and send back on later visits.
- Local storage: a place in your browser or app where we keep small settings on your device. It is not sent back automatically the way a cookie is.
- Local database (IndexedDB): a larger store on your device where the app keeps your notebooks so it works offline.
- Strictly necessary: without it, something you asked for stops working. These do not need your permission anywhere in the world.
The marketing website: cookies
| Cookie | Set by | What it is for | Strictly necessary | How long it lasts | When it is set |
|---|---|---|---|---|---|
| visitor_id | Derive | A random identifier used to decide which version of the home page headline you see, so we can measure which wording works. It is not linked to your name or email, and it is not sent to your browser's analytics. It is passed to PostHog on our server to pick the headline variant | No | 365 days | On your first request, before the cookie banner appears and whatever you later answer |
| derive_waitlist_meta | Derive | Remembers where you arrived from: campaign tags in the link, a referral code, and which page variant you landed on. It is read when you join the waitlist so we know which link brought you | No | 30 days | Only when a link you follow carries campaign tags, a referral code, or an access key. Set before the banner is answered |
| derive_site | Derive | Remembers which version of the site you asked to see, when you follow a link that specifies one | Yes | 30 days | Only when a link includes a site choice |
| tester_session | Derive | Keeps an invited tester signed in to the restricted download portal | Yes | 7 days | Only when a tester signs in to the portal |
| ph_(key)_posthog | PostHog | Website usage analytics: pages viewed, clicks, scroll depth, campaign tags. Stored as both a cookie and a local storage entry | No | 365 days, set by PostHog's default | Only after you answer yes to the banner. PostHog is not loaded at all before that |
Your consent choice is stored in local storage under derive_analytics_consent, not in a cookie. It holds the word "granted" or "denied" and nothing else. It lasts until you clear it or choose "Ask me again next visit" on this page.
What happens before you answer the banner. The visitor_id cookie is set on the first request to the site. Our server uses it to ask PostHog which home page headline to show you. That is a feature flag lookup keyed on a random identifier. No page views, clicks or other events are recorded against it before you say yes. If you say no, the cookie stays in your browser until it expires, and the only thing it is ever used for is picking the headline. The derive_waitlist_meta cookie is also set before you answer, but only if the link you arrived on carried campaign or referral information.
What PostHog receives when you say yes. PostHog loads and records pages viewed, clicks, scroll depth and the campaign tags on the link you arrived on. If you join the waitlist, your email address is sent to PostHog as your identifier, so your earlier anonymous events are joined to it. If you buy a subscription on the website, the payment event is recorded in PostHog against your email address, and a cancellation is recorded against your Stripe customer id. That is more than usage and diagnostics, so we say it here.
Website analytics processing location. PostHog for the website is hosted in the United States. Requests go through our own domain first and then on to PostHog.
The Derive app: local storage and on-device data
The following items are stored on your device. Consented advertising cookies and native attribution are described below.
| Item | What it is for | Strictly necessary | How long it lasts | How to control it |
|---|---|---|---|---|
| sb-(project)-auth-token | Keeps you signed in. Holds your session token | Yes | Until you sign out or clear app storage | Sign out, or clear the app's storage |
| derive_settings_v1 | Your settings: theme, tool preferences, AI switch, analytics choice, age band, onboarding answers | Yes | Until you sign out or clear app storage | Settings, or clear app storage |
| Local notebook database (IndexedDB) | Your pages, strokes, assistant conversations, the queue of changes waiting to sync, and staged images. This is what makes Derive work offline | Yes | Until you sign out or clear app storage | Sign out clears it, or delete the app |
| derive_analytics_id_v1 | A random identifier for usage analytics. It is not your account id, your name or your email | No | Until you sign out | Turn off "Share usage analytics" in Settings, Account. Signing out removes it |
| ph_(key)_posthog | PostHog's own storage for usage analytics | No | Set by PostHog; removed on sign out | Same as above |
| derive_analytics_first_stroke_v1, derive_analytics_last_stroke_at_v1 | Marks whether you have drawn your first stroke, so we can count activation once instead of on every launch | No | Until you sign out or clear app storage | Same as above |
| derive_internal_device_v1 | Marks a device that has been used to sign in to a Derive staff account, so staff activity is never counted in product analytics | No | Permanent on that device, including after sign out | Clear app storage |
| derive.geo.country | The country we detected, used to show you the right price and to apply the right privacy rules to your account | Yes | Cached for reuse until cleared | Clear app storage |
| derive.ageGateLocked.(account id) | Marks an account that answered under 13, so the app does not let it back in | Yes | Permanent on that device | Not user controllable by design |
| derive_global_theme, derive_sidebar_layout, derive-library-view, derive-view-mode, derive_portrait_hint_dismissed, derive_new_page_background_preference | Interface preferences: your theme, how the sidebar and library are laid out, and which hints you have dismissed | Yes | Until you clear app storage | Change the setting, or clear app storage |
| derive_conversion_enabled | Whether handwriting conversion is on for this device | Yes | Until you clear app storage | Settings, AI |
Country detection. On launch the app asks our website for the country your internet connection appears to be in. That request goes to our hosting provider Vercel, which sees your IP address in order to answer it. If that request does not succeed, the app falls back to your device's time zone and then to your device's language setting. We store the country and which of those three signals produced it.
What we do not use
- The marketing website and native desktop apps do not run the web-app advertising pixel. The marketing website loads no advertising tag at all; when you arrive from an advert it passes the click reference on in the link it sends you to, and does not store it. Native iOS attribution is described separately below.
- No Google Analytics, no Google Tag Manager, no Google advertising tag in your browser, no TikTok, LinkedIn or X tag, no Hotjar and no Clarity, anywhere. Google Ads measurement is done from our servers, as described below.
- We do not sell personal data, and we build no advertising profile of you.
- Web-app advertising measurement, Meta. The Meta pixel on web.derivenotes.com follows the rule above and is blocked by Global Privacy Control. It can set _fbp and _fbc; the app also keeps derive.meta.fbclid and derive.meta.eventIds for up to 90 days. Conversion matching can include the IP address and browser you used and, for declared adults only, a hashed email. No notebook content is sent to Meta.
- Web-app Google Ads measurement. No Google tag runs in your browser. When you arrive from a Google advert, the web app keeps the click reference Google put in the link (gclid, gbraid or wbraid) under derive.google.clickId for up to 90 days, and our servers report clicks on a button that takes you to the Derive web app or the App Store, sign ups, trials and payments to Google with it. It follows the same rule as Meta and is blocked by Global Privacy Control. For declared adults only, a hashed email is included. It applies only to visitors and to accounts created on or after 3 October 2026. No notebook content is sent to Google for advertising.
- iPhone and iPad advertising measurement. Meta's kit keeps a random app identifier and queued events on the device. It runs with advertiser tracking off and never reads the advertising identifier, so the apps do not ask for Apple's tracking permission. It sends no email or hashed email. The apps may also use Apple's AdServices framework to ask Apple which Apple Ads campaign, if any, led to the install; that uses no advertising identifier, needs no tracking permission, and applies only to visitors and to accounts created on or after 3 October 2026. Privacy policy section 13.6 explains what is sent.
Your choices, by region
Inside the European Economic Area and the United Kingdom. Usage analytics in the app are off until you turn them on in Settings, Account. If you are under 16 we do not offer the choice at all and analytics stay off. Session recording also requires an explicit analytics opt-in and age eligibility.
Everywhere else. Usage analytics in the app are on by default and you can turn them off at any time in Settings, Account. They are always off for an account that has told us it belongs to someone under 13. If we could not work out your country, analytics stay off until you turn them on.
Session recording. Explicitly turning on Share usage analytics can enable session replay for users who satisfy the applicable age and country rules. It can include the canvas, handwriting and visible text, with canvas capture at up to four frames per second. Input text is not universally masked. Regional analytics defaults do not enable replay. Turning the setting off stops new recording; already received data requires a deletion request.
The website. We ask on your first visit. Saying no changes nothing about how the site works and we do not ask again. You can change your answer at any time on this page.
Browser privacy signals. The web app honors Global Privacy Control for advertising measurement with Meta and Google. The marketing website's analytics banner remains its control for product analytics; we do not claim that every storage item above is removed by a browser privacy signal.
Turning things off after the fact
Turning analytics off stops new data being collected. It does not delete what was already collected. Email matt@derivenotes.com and we will delete it.
Related documents
Privacy Policy, Terms of Service, Subprocessors, Children and students, AI disclosure, Data processing addendum.
You have not been asked yet, so analytics is off.
Turning analytics off stops new data being collected. It does not delete what was already collected; email us and we will remove it.