Security
Last updated: September 30, 2026
Notes about the people in your network are personal. This page explains how Rolodink protects them, and where the limits are.
Encryption
Your notes, meeting place, company, email and phone number are encrypted with AES-256-GCM inside the browser extension before they are sent to us, and that is how they are stored. Entries saved with older versions of the extension, from before this encryption was added, can still be stored unencrypted; they are encrypted as soon as you edit and save them. Traffic between the extension and our servers runs over HTTPS.
Every account has its own encryption key. We generate it on first use and store it wrapped with a master key that is kept as a secret in our hosting environment, separate from the database. The extension keeps your key in memory and session storage only while you are signed in, and clears it when you sign out.
What this is not: end-to-end or zero-knowledge encryption. Because we manage the keys, your notes are available on every device you sign in on, but it also means that someone with access to both our database and our master key could decrypt them. We would rather say that plainly than overstate it.
Access control
Row-Level Security is enabled on the database, so an account can only read its own rows, even if another layer were to fail. Sign-in runs through Supabase authentication with token-based sessions.
Protection against abuse
The API applies rate limits per IP address, with a stricter limit for signing in and signing up. The API only accepts requests from approved origins (CORS allowlist), and user input is validated before it is processed.
Secrets and dependencies
API keys and secrets are stored as environment variables and are never committed to the code. Every commit is automatically scanned for leaked secrets, and our dependencies are checked for known vulnerabilities as part of our build pipeline.
Your data, your control
You can export all your data or delete your account and everything stored with it at any time. If deleting your account from the extension does not work for you, email privacy@rolodink.app and we will delete it for you. Your notes are private: the people you write about cannot see them, and we never sell your data or share it for anyone else's purposes. We use Supabase and Vercel to host Rolodink.
Reporting a vulnerability
Found a security issue, or have a question about how we handle your data? Email us and we will respond as soon as we can.