Privacy
Coffee Pad is a personal to-do app run by one person at pad.jp.coffee. It is not a company, it sells nothing, and it has no advertisers. This page says exactly what it stores and what it is unable to read.
Last updated 7 September 2026.
The short version
Your lists and tasks are encrypted in your browser, with a key derived from a passphrase that is never sent. What reaches the database is ciphertext. Nobody running this service can read your notes — not the administrator, not with database access, not by asking. That is a property of how the data is stored, not a promise about how it is handled.
There is no analytics, no tracking, no advertising, and no third-party scripts of any kind on this site.
What Google tells us when you sign in
Signing in requests the standard email and profile scopes. No other Google data is requested, and nothing in your Google account is read or written beyond confirming who you are.
| Email address | Identifies your account, and is how an administrator recognises you when you ask for an invite or a deletion. |
| Name and picture | Shown to you in the app. Never shown to other users. |
| Google account ID and sign-in tokens | Kept so your session can be refreshed without asking you to sign in repeatedly. |
What the app itself stores
| Your lists and tasks | As ciphertext only. Titles, notes, due dates and completion are inside the encrypted blob. The database also holds the row's identifiers, its position in the list, and when it was created and last changed — those are not encrypted, because the server needs them to store and order rows it cannot read. |
| Wrapped key material | A salt and your encryption key sealed with your passphrase, and a second copy sealed with your recovery key. Neither can be unwrapped without one of those, and neither is stored here. |
| Session records | A session token, its expiry, and the IP address and browser user-agent it was created from, so a session can be recognised and expired. |
| Account status | Whether you are active, and who invited you. An administrator can see this, along with your email and name. |
What cannot be read, and why
The encryption key is derived from your passphrase in your browser and never leaves it. The server has no copy and no way to derive one. The database enforces this independently: row-level security scopes every row to the account that owns it, an administrator has no privileged path to anyone’s content, and the roles the application connects as have no access to those tables at all.
The practical consequence, which is worth being blunt about: if you forget your passphrase and lose your recovery key, your notes are unrecoverable. Nobody can reset them for you.
Who else sees any of it
Three services, each because the app cannot run without them, and none of them for anything else:
| Signs you in. Google's own privacy policy governs what it collects when you do. | |
| Neon | Hosts the database, and therefore holds the ciphertext and the account records described above. |
| The host running this site | Serves the pages, and keeps ordinary web server logs. |
Nothing is sold, shared for advertising, or passed to anyone else. There is nobody to sell it to.
Deleting your account and your data
Email me@jp..coffee from the address you signed in with, and ask for your account to be deleted.
Deletion removes the account record and everything attached to it — your profile, your lists, your tasks, and your wrapped key — in a single operation. It is not a flag or an archive; the rows are gone, and the key that would have made the ciphertext readable goes with them. Ordinary web server logs may persist for a short period afterwards.
You can also revoke this app’s access from your Google account permissions at any time. That stops future sign-ins; it does not by itself delete what is stored here, so send the email as well.
How long things are kept
Your account and content are kept until you ask for them to be deleted. Sessions expire on their own. Invites expire whether or not they are used.
Changes
If this page changes, the date above changes with it. There is no mailing list to announce it on.