Zorem is a notebook that your agents write and that you share with links that expire. This page explains what we store and why. We do not sell your data, show ads or use analytics or tracking cookies.
What we store
Your account. Your email address, and depending on how you sign in: a password hash (bcrypt), your Google account id, and a two-factor secret if you turn it on. We use them only to let you sign in and to send you account emails (sign-in links, verification, important notices).
Your notes. The title, folder and markdown content of each note, and every version of it: when it was written, the label the agent sent (for example "Claude Code · laptop") and whether it came from one of your devices, a link or a restore. Versions are kept until you delete the note.
Device tokens. For each token: the name you gave it, the first characters of the token so you can recognise it, and a SHA-256 hash of the token. We never store the token itself, so we cannot show it again.
Links. For each link: a SHA-256 hash of its token (never the token), what it points to, its permission, options, label and expiry, how many times it was read and when it was last used. Each read, write and change is logged with the time, a keyed hash of the IP address (not the address itself) and the user agent, so you can see how a link is being used. These logs are deleted after 90 days.
Contributions. When someone writes through a link that needs your approval, their text waits in Zorem until you accept or reject it, together with the label they sent and, if they used a Zorem account, which account it was.
Secret scanning
Before any version is stored, its content is checked against patterns for well-known credentials (for example cloud keys, access tokens and private keys). If one matches, the write is refused and only the type of secret and its line are reported back. The check is a safeguard, not a guarantee: do not rely on it to keep secrets out of your notes.
Who can see your notes
Only you, the agents you gave a device token to, and whoever holds a link you created, until it expires or you revoke it. A link works for anyone who has it: a person in a browser or an agent. Shared pages are marked so search engines do not index them and so their address is not sent to other sites.
Cookies
Zorem sets one cookie, zorem_session, which keeps you signed in. It is http-only (scripts cannot read it) and expires on its own. There are no analytics, advertising or third-party cookies. The web loads its fonts from Google Fonts, which receives your IP address when it serves them.
Services we rely on
- The web app is hosted on Vercel.
- The API and its database run on a server we operate on Amazon Web Services (Lightsail).
- Emails are sent through Resend.
- If you choose "Continue with Google", Google handles that sign-in.
How long we keep things
- Notes and their versions: until you delete them. Deleted notes stay in the trash for 30 days, where you can restore them, and are then erased.
- Link logs: 90 days.
- Your account: until you delete it from the Devices page. Deleting it erases your notes, versions, folders, links and tokens. Versions you wrote in other people's notes through their links stay in their history, without your account attached.
Your choices
You can read, export (by copying or through the API) and delete your notes at any time, revoke any link or token, and delete your account. For anything else about your data, contact us on X at @zoremstudios.
Changes
If this policy changes, we will update this page and the date at the top.