Privacy Policy

1.Who we are

Restora (“Restora”, “we”, “us”) is an independent backup-and-restore tool for Notion, operated by Restora. Restora is not affiliated with, endorsed by, or sponsored by Notion Labs, Inc. For the purposes of data-protection law, the operator is the data controller for the limited processing described here. You can reach us at support@restora.cc.

2.What this policy covers

This policy covers the Restora web application, the Restora Partner Program (section 15), and these policy pages. It does not cover Notion or Dodo Payments, who process your data under their own privacy policies (see sections 7 and 8). When you connect Notion or pay through Dodo Payments, their terms and privacy policies also apply to you.

3.What we don’t collect

Restora is built to need as little of your data as possible. We do not:

• create accounts or store passwords — you connect through Notion’s OAuth instead;
• run advertising, cross-site tracking, or any analytics that uses cookies or identifies you personally;
• set advertising, analytics, cross-site tracking or referral cookies — how a Partner Program referral link is credited without one is described in section 6;
• keep server-side logs of your Notion content or of your access token.

We measure usage in two ways. We use Cloudflare Web Analytics, a cookieless, privacy-first tool, to count page visits and see which features are used so we can improve the product. It sets no cookies, does not track you across sites, does not build a profile of you, and never has access to your Notion content or your access token. See section 8.

We also keep limited first-party product telemetry so we can see where features fail. It records which feature and action were involved and whether it completed, failed or was cancelled; a broad error category; the storage type and app version; timestamps and operational identifiers such as a run id; a pseudonymous workspace identifier (a one-way hash, not your workspace id); and a subscription identifier if the app has one for you. It never records your Notion page or database contents, backup contents, raw error messages, card details, or other content you enter.

There is one place where we do process information you send us on purpose: in-app feedback. If you submit feedback, we process the information you provide — your message, the Restora screen you were on, and your email address if you choose to give one. If you choose to attach a screenshot, it may contain workspace content and will be sent through our email provider (see section 8) so we can review your report. Screenshots are never collected automatically: nothing is captured unless you attach it yourself, and feedback is never sent unless you send it. This is separate from, and does not change, the fact that we do not store the contents of your Notion workspace.

4.Your Notion connection and access token

When you connect Notion, Notion issues an access token (and a refresh token) to the Restora integration. We handle that token as follows:

• it is encrypted with AES-256-GCM and stored only inside a cookie in your browser;
• the cookie is HttpOnly (your browser’s scripts and other websites cannot read it), Secure (sent only over HTTPS), and SameSite=Lax;
• only our server holds the key that can decrypt it, and it does so transiently, in memory, to make the Notion API calls you ask for;
• for this cookie-based connection, the token is never written to any database or file on our servers, never returned to your browser as readable data, and never logged (scheduled backups are different — see below);
• when the access token nears expiry we refresh it with Notion and re-encrypt the new token back into the cookie.

The cookie expires after at most 30 days, and is cleared when you log out.

If you turn on automatic (scheduled) backups — an optional, opt-in Pro feature — a small amount of additional data is stored on our servers so backups can run while you’re not there:

• your Notion access/refresh token, and your Google Drive or S3 connection credentials, each encrypted with AES-256-GCM under a separate encryption key (distinct from the session-cookie key above) and decrypted only transiently, in memory, for the duration of a scheduled run;
• schedule settings (frequency, destination, which databases/pages by id — never titles or content);
• run history (when a backup ran, whether it succeeded, byte/row counts) and, so we can tell you what changed between backups, a structural summary of each backup — your databases’ and properties’ names and types, view and row counts, and page ids. This never includes page content or property values. Drift alerts and the change feed are built from this summary;
• your backup files themselves are never stored by us — they stream straight to your own Google Drive or S3 bucket, the same as the manual/CLI paths described in section 5.

You can disconnect a Google Drive or S3 destination at any time from the app, which removes that destination’s stored credentials immediately. To delete all Protection Center data associated with your workspace (including your vaulted Notion connection and run history), email us at privacy@restora.cc and we will remove it. This section does not apply if you only use manual backups, the CLI, or the free Drift Auditor — those remain exactly as described elsewhere in this policy.

5.How your Notion content is processed

When you run a backup, your Notion content passes through our server only in transit: we read it from Notion and stream it straight to a file that downloads to your device. When you run a restore, the backup file you upload streams through our server straight into Notion. We process this content transiently, in memory, to move it — we do not store it, cache it, or keep a copy.

Backups and restores you run in the web app use memory only. Scheduled backups and background restores temporarily use our server’s disk while they run; that copy is deleted when the job finishes, or within 7 days if the job is interrupted. We never keep it as a backup.

Because we keep no copy, you are responsible for storing the backup files you download somewhere safe.

6.Cookies and local storage

Restora uses only what it needs to function:

• an encrypted session cookie holding your Notion authorization (described in section 4);
• a short-lived cookie holding an anti-forgery value during the Notion sign-in redirect;
• a single value in your browser’s local storage holding your Dodo Payments subscription id, so the app can re-check your subscription when you return.

We set no analytics, advertising, or cross-site tracking cookies.

Partner referral links (no cookie)

Restora has a Partner Program: people who recommend Restora can earn a commission when someone they referred subscribes. To credit the right partner we do not set a cookie, and we store nothing in your browser. Instead, when you arrive through a partner’s referral link (an address beginning restora.cc/r/), the address you land on carries a referral code.

• What it is: a sealed code in the page address (?ref=…). It is taken out of the address bar as soon as the page loads and is carried only in the links that lead on: this site adds it to its links to the Restora app and to its own pages, and the app passes it along when you sign in with Notion.
• What it contains: an encrypted value naming the partner whose link you followed, the campaign tag on that link if it had one, and the time of the click. It contains no Notion workspace content, no name, no email address, and no identifier for you or your device.
• What it is for: partner referral attribution — crediting that partner if you go on to subscribe. Nothing else: it is not used for advertising or analytics, it does not build an advertising profile of you, it is never sold, and it is not shared with the partner or anyone else.
• What we record, and when: when the link is followed we count that click, with its campaign tag and the time. That count holds nothing about you. We do not store your IP address with it; the address is used only momentarily, in memory, to limit abuse of the link. If you then connect a Notion workspace in that same visit, we record that the workspace was referred by that partner. A code is accepted for at most 60 days after the click.
• If you leave: because nothing is kept in your browser, reloading the page, closing it, or coming back to Restora later on your own means no partner is credited. Restora works exactly the same either way.

Your choices. There is nothing to accept or decline, because nothing is stored on your device. If you would rather not be counted as a referral, open restora.cc directly instead of following the link. You can also ask us to remove a referral already recorded against your workspace (section 15).

If you are a Partner Program member, signing in to the partner dashboard sets one further cookie, rst_partner: an encrypted, HttpOnly session cookie that keeps you signed in for up to 30 days, or until you sign out.

7.Billing data (Dodo Payments)

Payments are processed by Dodo Payments, which acts as the Merchant of Record (the reseller of the subscription). Dodo Payments — not Restora — collects and processes your payment details, billing address, and any tax information, under Dodo Payments’s own privacy policy and buyer terms. We do not receive or store your card details. To check whether your subscription is active, our server asks Dodo Payments’s API about your subscription each time you use the tool, and our servers keep only subscription and payment identifiers, never your card or billing details; your subscription id is also saved in your browser. See Dodo Payments’s policies at dodopayments.com.

8.Third parties and sub-processors

The only third parties involved in running Restora are:

• Notion — the workspace you connect; the source and destination of the data you back up and restore.
• Dodo Payments — our payment reseller and Merchant of Record (billing only).
• Railway — hosts the Restora application (a containerised server in the United States). Your requests and your Notion content pass through Railway’s servers in transit while a backup or restore runs. Restora does not persist the contents of your Notion backups on Restora’s servers. Restora does keep limited operational metadata required to run the service, such as account and workspace identifiers, billing records, job metadata and Partner Program records.
• Cloudflare — provides DNS for our domains, hosts the separate marketing and policy pages (at restora.cc), and provides Cloudflare Web Analytics, the cookieless, privacy-first tool we use to count visits to the web app. It collects aggregate page and performance metrics without cookies and without identifying individuals, and never receives your Notion content or token. The application’s data traffic otherwise goes directly to Railway and is not proxied through Cloudflare.
• Resend — our transactional email provider. It delivers the change-alert and account emails you opt into, Partner Program emails to partners and applicants (section 15), and any feedback you send us, including a screenshot if you choose to attach one (see section 3). It does not otherwise receive your Notion content, and never receives your access token.

We do not sell or share your data, and we use no advertising providers. Our only third-party analytics provider is Cloudflare Web Analytics, described above; our product telemetry (section 3) is first-party and is not shared with an analytics provider.

9.International data transfers

Restora is operated from the United Arab Emirates and the application is hosted on Railway in the United States; Notion, Dodo Payments, and Cloudflare also operate internationally. Your data may therefore be processed in countries other than your own. Where required, we rely on the transfer protections offered by those providers.

10.Data retention

By default (manual backups, restores, the CLI, and the free Drift Auditor) we retain only limited service data needed to run the product, such as the product telemetry described in section 3 — no Notion content, no backup contents, and no request logs. The encrypted session cookie lives in your browser and expires after at most 30 days, or immediately when you log out. The subscription id in your browser’s local storage stays until you clear it or use “Remove from this browser.” Billing records are retained by Dodo Payments under its own policy.

If you opt into automatic scheduled backups (section 4), the encrypted connection credentials and schedule/run metadata described there persist in our database until you disconnect that storage destination or delete your Protection Center data, at which point they are removed.

Feedback you send us (section 3) is kept as a support record — your message, the screen you were on, and your reply address if you gave one — until we have dealt with it, and is deleted along with the rest of your data when you delete your Protection Center data. An attached screenshot is not stored on our servers: it is passed straight through to the email and discarded, and we keep only a note of its file size and type. The copy that reaches our support mailbox persists there like any other support email.

A referral code (section 6) is accepted for at most 60 days after the click, and is never stored in your browser. Partner Program records — referral clicks, which workspace a partner referred, and the commission ledger — are kept for as long as they are needed to calculate, pay and account for partner commission, and partner applications and partner records for as long as the partner takes part and for our accounting records afterwards (section 15).

11.Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we process your data to: perform the service you requested (running your backups and restores); pursue our legitimate interest in keeping the service secure and preventing abuse; and perform our contract with you for the paid subscription (through Dodo Payments).

For the Partner Program: we read the referral code a partner’s link carries and record referrals on the basis of our legitimate interest in running the program and crediting partners accurately — a narrow use that involves no advertising, no profiling, nothing stored on your device, and no content from your workspace, and which you can avoid by opening restora.cc directly instead of following the link, or have undone by contacting us (section 6). We process partners’ and applicants’ own data to take steps at their request and to perform our agreement with them (the Partner Program Terms), and to meet our accounting obligations.

12.Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your personal data. Because Restora stores almost nothing about you:

• you can end our access at any time by disconnecting Restora in your Notion settings and logging out;
• you can clear the subscription id we hold in your browser with “Remove from this browser,” or by clearing your browser storage;
• for any personal or billing data held by Dodo Payments, please contact Dodo Payments, who holds those records;
• a referral link leaves nothing in your browser to remove (section 6); you can ask us to delete a referral recorded against your workspace, or — if you are a partner or applicant — your application and partner record, subject to what we must keep for accounting (section 15).

To make a request or ask a question, contact us at support@restora.cc.

13.Children

Restora is a paid tool intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a minor has used Restora, contact us and we will help.

14.Security

We protect your data with measures including: AES-256-GCM encryption of the Notion token; HttpOnly, Secure, SameSite cookies; no persistent server-side storage of your content, and of your Notion token only if you turn on scheduled backups (section 4); and a deliberately small set of third parties. No method of transmission or storage is ever completely secure, and we cannot guarantee absolute security.

15.Partner Program: referrals and partner data

This section applies only if you follow a Partner Program referral link, or apply to be a partner.

If you were referred by a partner

• If you connect a Notion workspace to Restora in a visit that started from a partner’s referral link (section 6), we record that the workspace was referred by that partner: the workspace’s Notion id, the partner, the campaign tag, and the time of the click.
• If that workspace then subscribes, we record against the referral the payment and subscription identifiers, the plan, the payment date, and the amount commission is calculated on, so that the partner’s commission can be worked out, and reversed if the payment is refunded or charged back. We also check, without storing it in our partner records, whether the payer’s email address is the partner’s own, to catch self-referrals.
• What the partner sees: a numbered entry (for example “Workspace #003”) with the campaign tag, whether it is on a monthly or annual plan, its status, the date of the last payment, and the commission earned. We do not show a partner your name, your email address, your workspace’s name, or any of its content. A partner who has referred only a few people may still be able to work out which entry is yours from its timing.
• None of this changes what is said elsewhere in this policy about your Notion content: the Partner Program never reads, stores, or shares it.

If you apply to be, or are, a partner

• We keep what you give us in your application: your name, email address, brand or business name, the kind of work you do, your website and profile links, your main platform, an audience-size range, what you tell us about how you would recommend Restora, your preferred contact method and handle, your country, and the version of the Partner Program Terms you accepted and when.
• If you are approved we also keep your referral link, your payout method and the payout details you enter, and the records of your clicks, referrals, commission and payouts, together with a log of administrative actions on your account.
• You sign in with a one-time link sent to your email address; there is no password. Emails about your application, sign-in and payouts are sent through Resend (section 8).
• To pay you, we give your payout details to the payout provider you chose (for example PayPal or Wise), which handles them under its own privacy policy.
• If you add your logo to a co-branded graphic in the promotion kit, the graphic is made in your browser. Your logo is not uploaded to us.
• The application form may use Cloudflare Turnstile to check that a submission comes from a person rather than a script.

To have a referral, an application, or a partner record removed, email us at privacy@restora.cc. We will remove it, except for the commission and payout records we need to keep for our accounts.

16.Changes to this policy

We may update this policy as the product or the law changes. When we do, we will revise the “last updated” date above and, for material changes, surface a notice on this page or in the app.

17.Contact

Questions about this policy or your data: support@restora.cc.