KnotedPrivacy Policy
Last updated 24 July 2026
Knoted is a QR suggestion box for local businesses. A business puts up a small printed sign, their customers scan it, and they can leave a short note privately instead of posting it publicly. This policy explains what we collect from the two groups of people who use Knoted, what we do with it, and how to get it removed.
Who this covers
Two different people use Knoted, and we treat their information differently.
- Business owners and staff who create an account, add a business, and read the feedback they receive.
- Customers leaving feedback who scan a QR sign and write a note. They do not create an account and are anonymous by default.
What we collect
From business owners
- Name and email address, provided at signup.
- Business details you enter, such as business name, type, and location.
- A password, which is stored only as a salted hash by our authentication provider. We never see or store your plain password.
- Billing information, handled entirely by Stripe. We receive a subscription status and the last four digits of the card. We never receive or store full card numbers.
From customers leaving feedback
- The text of the note they write.
- An email address, only if they choose to provide one so the business can follow up. This is never required.
We do not ask a customer for their name, we do not require an account, and we do not attempt to identify who wrote a particular note.
Collected automatically
- IP address, browser type, device type, referring page, and the pages viewed on our site.
- Analytics events describing how our site and app are used, such as which page a visit started on and which buttons were pressed.
- Advertising identifiers set by cookies when you arrive from an advertisement.
How we use it
- To operate the service: create your account, show you your feedback, generate your QR codes, and print and ship your signs.
- To take payment and manage your subscription.
- To send service email such as password resets, receipts, and notifications about new feedback.
- To understand how people move through our site so we can improve it.
- To measure and target our own advertising.
We do not sell personal information, and we do not share the content of the feedback a business receives with anyone other than that business.
Who we share it with
We use a small number of service providers. Each receives only what it needs to do its job.
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database, authentication, hosting of backend functions | Account details, business details, feedback content |
| Stripe | Payment processing and subscriptions | Name, email, payment details |
| Firebase Hosting | Serving the website and app | IP address, request logs |
| PostHog | Product analytics | Usage events, IP address, device information |
| Meta | Advertising measurement | Hashed email, advertising cookie identifiers, conversion events |
| Resend | Sending service email | Name, email address |
We may also disclose information where we are legally required to, or to protect the rights and safety of our users.
Cookies
We use cookies and similar storage for three things: keeping you signed in, measuring how the site is used, and measuring the performance of our advertising. You can block or delete cookies in your browser settings. Blocking them will not stop you leaving feedback on a QR page, but it may sign you out of your account.
How long we keep it
- Account and business records are kept while the account is open, and for up to 12 months after it is closed.
- Feedback notes are kept until the business deletes them or closes its account.
- Billing records are kept for as long as tax and accounting rules require, which is generally seven years.
- Analytics events are kept for up to 12 months.
Your choices
You can ask us to show you what we hold about you, correct it, or delete it. Write to hello@knoted.app and we will act on your request within 30 days. If you are in a jurisdiction with specific data rights, such as the EU, the UK, or California, those rights apply to you and we will honour them regardless of where you are.
If you left a note as a customer and want it removed, contact the business that displayed the sign, or write to us and we will pass the request on.
Children
Knoted is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.
Security
Traffic is encrypted in transit. Access to production data is limited to the people who need it to run the service. No system is perfectly secure, and we will tell affected users promptly if we become aware of a breach involving their information.
Changes
If we change this policy we will update the date at the top of this page. Material changes will be announced by email to account holders.
Contact
Questions about this policy go to hello@knoted.app.