Privacy Policy

Effective date: 12 September 2026

Fenex is a markdown notes app. The short version of this policy is this: your notes are stored as .md files in your own Google Drive. We do not have a copy. We do not run a database of your content, and we cannot read what you write. There are two exceptions, both of which only happen when you ask for them: publishing a page, and using an AI action. Both are described below.

This page explains that in full, including the parts where the short version is not the whole story.

Who operates Fenex

Fenex is operated by an individual developer in the Republic of Korea.

Service: Fenex (https://fenex.pages.dev)
Person responsible for personal data: tommykim
Contact: withtommykim.lab@gmail.com

What we collect

Your notes - we do not collect them

When you connect Google Drive, Fenex reads and writes files directly between your browser and Google's servers. The content never passes through a Fenex server, and none of it is stored by us. The exceptions are the two actions you choose to take - publishing a page, and using an AI action - described below.

If you use Fenex without connecting Google Drive, your notes are stored only in your own browser's local storage. They are not sent anywhere.

Authentication - held by your browser, not by us

To stay signed in, Fenex uses Google OAuth. The refresh token issued by Google is encrypted and returned to your browser as an HttpOnly cookie. We do not store it in any database, file, or log. Our server cannot read the cookie's contents without the encryption key, and it never keeps a copy.

When your access token expires, your browser sends that cookie back to our authentication endpoint, which exchanges it with Google for a new access token and returns it to you. The token is not retained after the response is sent.

Signing out, or clearing your browser data, removes the cookie. You can also revoke Fenex's access at any time in your Google Account permissions.

Google permissions we request, and why

Fenex requests access to Google Drive (https://www.googleapis.com/auth/drive). This is used to:

create and update the .md files that hold your notes
read those files back so your notes appear on your other devices
read a page's text when you choose to publish it, so a public copy can be made
make images and attachments in a published page readable, and private again when you unpublish

Fenex does not scan, index, analyse, or transmit your Drive contents for any other purpose.

AI actions - the text you send passes through our server

Fenex has optional AI actions (ask, translate, summarize, extract to-dos, suggest a title, shorten, make a table). Nothing is sent automatically. Text leaves your browser only when you press one of those buttons.

When you do, the text you selected - or the current page, if you used the page-level button - is sent to our server, which forwards it to Cloudflare Workers AI and returns the answer to you.

Voice notes - your voice never leaves your device

Voice notes are not an exception to the rule above, because they never reach us at all. The speech is recognised by your own browser, on your own device, and only the resulting text is placed in your page.

No audio is uploaded. Not to us, not to Cloudflare, not to anyone. There is no code in Fenex

that sends a recording anywhere.

No recording is kept. The sound is turned into text as you speak and then it is gone.
Because this requires on-device speech recognition, the button only works in browsers that

support it. If your browser cannot do it on-device, Fenex refuses to record rather than falling back to a service that would receive your voice.

Your microphone is used only while the button shows that it is listening.

We do not store it. The text is used to produce the answer and is not written to any database,

file, or log by us.

Cloudflare processes it as our AI provider, under

Cloudflare's privacy policy.

Only what you send. Other notes, file names, and your Drive contents are not included.
If you never press an AI button, no note text ever reaches our server.

Published pages

If you publish a page, we hold a copy of that page's text for as long as it stays published, together with the one-way hash described under Publishing below. Deleting the published page removes both. We hold nothing about pages you never publish.

Technical data

Fenex is hosted on Cloudflare Pages. Like any website, requests reach the host with an IP address and browser user-agent, and Cloudflare processes these to serve the site and protect it from abuse. We do not add our own analytics, advertising, or tracking scripts, and we do not build profiles of visitors.

Your browser also stores small amounts of data locally - your interface preferences, a cached copy of your notes so the app opens instantly, and unsaved changes so nothing is lost if the app closes unexpectedly. This stays in your browser and is not sent to us.

Publishing - please read this part carefully

Publishing a page is optional. Nothing is public unless you choose to publish it. When you do:

A copy of the page's text is sent to our server, which places it in a public folder owned by the operator of Fenex. That copy is readable by anyone with the link, and it is listed in Explore. This copy is the only thing that becomes public.
Your original file stays private. Its sharing settings are not changed. Nobody can read it through Google Drive.
Only the text is copied. The metadata Fenex keeps at the top of your file - its internal id, creation time, page hierarchy - is stripped before the copy is made.
Images and file attachments are an exception. A published page still points at the images and files stored in your Drive, so those individual files are made readable by anyone with the link while the page is published. They are made private again when you unpublish. If a page contains an attachment you do not want public, remove it before publishing.
We record a one-way hash of your Google Drive user id on the published copy. This is how the server checks that you - and only you - can unpublish it. It is a hash, not your account, name, or email: it cannot be reversed to identify you, and a different hash is produced for a different service. Nothing else about you is stored.
Unpublishing deletes the copy, but does not undo what has already happened. We delete the published copy immediately. However, search engines, caches, archives, and people who already saved or copied the content are outside our control. Content that has been indexed by a search engine may remain visible in search results for some time after you unpublish it, and copies made by others cannot be recalled.
Publishing is unattributed, not anonymous. No name or account is shown on a published page, and the copy is owned by the operator rather than by you. But we can connect a published page to the account that published it, through the hash described above, in order to handle reports and abuse. Do not treat publishing as a way to say something anonymously.

Please do not publish anything you would be harmed by having read - by anyone, permanently.

Who else is involved

Fenex relies on two third parties. Their handling of your data is governed by their own policies.

Provider	Role	Their policy
Google	Stores your notes in your Drive; stores published copies in the operator's Drive; provides sign-in	Google Privacy Policy
Cloudflare	Hosts the site and the authentication endpoint; runs the AI model when you use an AI action	Cloudflare Privacy Policy

We do not sell data, share it with advertisers, or transfer it to anyone else.

Your rights

Because we do not hold your notes, most requests about them are things you can do yourself, immediately:

See your data - open Google Drive. The files are there, named after your pages.
Export it - the files are plain markdown. Download them from Drive, or use the download button in Fenex.
Delete it - delete the files in Drive, or delete pages in Fenex.
Withdraw consent - revoke access at Google Account permissions, and sign out to clear the cookie.

If you believe we hold personal data about you and you want it accessed, corrected, or deleted, write to withtommykim.lab@gmail.com. Under Korean law you may also lodge a complaint with the Personal Information Protection Commission (privacy.go.kr) or the Korea Internet & Security Agency (privacy KISA, 118).

Children

Fenex is not directed at children under 14. We do not knowingly collect personal data from them. If you believe a child has used Fenex in a way that created such data, contact withtommykim.lab@gmail.com and we will act on it.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we will update the effective date above and note the change in the app. Material changes will be announced before they take effect.

Contact

Questions, requests, or reports: withtommykim.lab@gmail.com

This document describes how Fenex actually works. It is written by the developer, not by a lawyer, and it is not legal advice.