Privacy policy

Last updated 21 October 2026

noot is a shared page for groups. We built it to collect as little as possible: no accounts, no ads, no tracking, and we don’t sell anything about you. New rooms are end-to-end encrypted, so we can’t read what’s in them.

The short version. What you put in a room is stored so everyone in the room can see it. Public and view-only rooms can be opened by anyone who has the link, so don’t put anything in them you wouldn’t want shared. Your browser keeps a few settings, like your display name. That’s about it.

Who we are

noot is run by We Are Flip Pty Ltd (ABN 92 702 616 475), trading as flip, in Queensland, Australia (“we”, “us”). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can contact us about privacy at [contact email].

End-to-end encryption

Rooms created from 21 October 2026 are end-to-end encrypted. Your browser creates a secret key for each room and encrypts everything people type, every name and every image with it before anything is sent. The key is only in the room’s links (after the #, a part of a web address that browsers never send to a server) and in the browsers that have opened the room. We, our hosting and database providers, and anyone who gains access to our database only see scrambled text.

Some things can’t be encrypted, because noot needs them to work: room names, who is a member and their role, when things were created or changed, and numbers and on/off values (such as how many votes an option has, a score, or whether a task is ticked). Rooms created before 21 October 2026 are not encrypted.

Because only links carry the key, anyone you share a full link with can read the room, and if every link and every device that opened a room is lost, nobody, including us, can recover what’s in it.

What we collect

What you add to rooms. Text, lists, cards, votes, chat messages, questions, sign-ups, images and anything else you or other people in a room enter. It belongs to the room and is visible to whoever can open the room. In encrypted rooms we only store it encrypted.
The name you choose. If you give a display name, it’s shown next to what you do in a room and in the room’s list of people. It doesn’t need to be your real name. In encrypted rooms it’s stored encrypted.
An anonymous ID. When you open noot, Firebase gives your browser a random anonymous ID. We use it to remember which rooms you’re a member of, your role (viewer, editor or admin) and which rooms you own. It isn’t linked to your email, phone or any account.
Who’s in a room right now. While a room is open we show how many people are there and their display names. This is removed when you leave.
Saved copies of rooms. Rooms with members keep up to twelve recent copies, so an admin can roll back if the room is damaged.
Technical information. Our hosting and database providers process your IP address and basic browser details to deliver the site and keep it secure, and keep short-lived logs.

We don’t ask for your email, phone number, address or payment details, and we don’t use analytics, advertising or tracking cookies.

What stays in your browser

noot stores a few things in your browser’s local storage, not on our servers: your display name, your theme, the rooms you visited recently, the starting layout you picked last and similar settings. You can clear them at any time by clearing this site’s data in your browser.

How we use it

To run rooms: store and sync what people add, in real time, for everyone in the room.
To control access: decide who can open, edit or manage a room.
To keep noot safe: stop automated abuse, spam and attacks, and investigate reports.

We don’t use the content of your rooms for advertising, and we don’t sell or rent personal information.

Who else handles it

We use a small number of providers to run noot. Their servers may be outside Australia, including in the United States.

Google Firebase stores rooms and runs the anonymous sign-in (Realtime Database and Authentication).
Google reCAPTCHA Enterprise and Firebase App Check check that requests come from the real noot site and not a bot. Google processes device and usage signals for this.
Cloudflare hosts the website.
Google Fonts and jsDelivr serve the typeface and the QR-code script, so your browser contacts them when it loads those files.
Open-Meteo provides forecasts if a room uses the Weather module. The place name and its coordinates are sent to Open-Meteo, not your own location.
Embedded content such as YouTube, Vimeo, Loom, Figma, Google Docs, Maps or Spotify loads from those services when a room contains an embed. They have their own privacy policies and may set cookies. YouTube embeds use YouTube’s privacy-enhanced mode.

By using noot you agree that your information may be handled by these providers overseas. We take reasonable steps to make sure they protect it.

Public, view-only and private rooms

Whoever creates a room chooses who can open it. Public rooms can be opened and changed by anyone with the link. View-only rooms can be opened by anyone with the link, but only invited people can change them. Private rooms can only be opened by people who were invited. Room links end in a random code to make them hard to guess, but anyone you share a link with can pass it on.

How long we keep it

Rooms stay until an admin deletes them. A deleted room can be restored by its admins until it’s deleted for good, which erases it, its members, its invite links and its saved copies.
Saved copies are replaced as new ones are made; we keep up to twelve.
Rooms that are empty and unused for a long time may be removed.
Provider logs are kept only as long as those providers need them for security and operations.

Your choices and rights

You can change or remove what you added to a room, leave a room, or (as its admin) delete it. You can ask us for access to, or correction or deletion of, personal information we hold about you by emailing [contact email]. Because noot has no accounts, we may need the room link and details of what you added to find it. If you’re in the European Union or the United Kingdom, you also have rights under the GDPR, including to object to processing and to complain to your local regulator.

Children

noot isn’t meant for children under 13. If you’re under 18, check with a parent or guardian before using it. If you think a child has put personal information into noot, contact us and we’ll help remove it.

Security

Connections are encrypted, new rooms are end-to-end encrypted, access to rooms is enforced on the server, and invite and recovery links are long random codes. No system is perfectly secure, so keep your recovery link private and don’t put passwords, financial details or other sensitive information in rooms.

Complaints

If you have a concern about how we handle your information, email [contact email] and we’ll respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We may update this policy as noot changes. We’ll change the date at the top, and for significant changes we’ll make it clear on the site.