NNoto

Privacy Policy

Exactly what we collect, where it goes, and how long we keep it.

1. Overview

This Privacy Policy describes what information Noto (the “Service”) collects when you use it, why we collect it, how it’s stored, and the rights you have over it. It applies to everyone who creates an account or browses the public pages of the Service.

2. Data we collect

2.1 Account data

  • Email address — required to sign in and to send transactional messages such as 2FA email codes and account-recovery emails.
  • Password — stored only as a salted bcrypt hash. The plaintext is never written to disk.
  • Display name — optional, shown only to you.
  • 2FA secret (if you enable TOTP) — stored to verify codes generated by your authenticator app.
  • 2FA email-OTP hash (if you use email 2FA) — stored only as a salted bcrypt hash with a short expiry.
  • Consent record — the version of these legal documents that you accepted and the timestamp of acceptance.
  • Billing identifiers (if you subscribe to Plus) — Stripe customer and subscription ids, plan status, and period end date. Payment card details are handled only by Stripe.

2.2 Content data

  • Notebooks and notes — titles, body content (see password-protected notes below), sort order, and per-note presentation metadata (paper template and background).
  • Version history (optional) — for notes that are not password-protected, we may keep up to thirty prior copies of the note body as automatic checkpoints (about every five minutes while you edit) and as manual checkpoints you name yourself. These are stored in our database alongside the current note and are deleted when the note or your account is removed. Password-protected notes do not get server-side version history while locked.
  • Password-protected notes (optional) — if you set a note passphrase, your browser encrypts that note’s body before it is sent for storage. We keep the ciphertext, salt, and initialization vector; we never receive or store your passphrase, and we cannot recover the body if you forget it. The note title stays readable so lists and navigation still work. Embedded attachments (images, PDFs in object storage) are not encrypted by this feature — only the note body stored in the database is.
  • Note attachments — images, PDFs, and similar files you embed in notes via the editor toolbar. The bytes are stored in our hosting provider’s object-storage service (see “Third parties”); a small index row in the database records the file name, type, and size so we can authorise reads and clean up when a note or your account is deleted.
  • Dashboard preferences — your widget layout, timezone choice, weather location, public-holiday country choice, scratch-pad contents, roadmap entries, RSS feed URL.
  • Calendar connections (optional) — if you connect Google Calendar and/or Microsoft Calendar, we store encrypted OAuth tokens and the email address of each account you linked, so Noto can list, create, and delete events on your behalf in a single Agenda. Google Calendar data is handled under “Google user data (Limited Use)” below. Disconnect anytime in Settings; tokens are removed when you disconnect or delete your account.

2.3 Operational data

  • Server logs — IP address, user-agent string, request path, and timestamps for failed login attempts, security warnings, and runtime errors. Retained for up to 30 days for abuse-prevention and debugging.
  • Session cookie — a signed JWT issued by NextAuth on successful login. Used only to identify your session. No third-party analytics cookies are set.

3. Geolocation

The dashboard’s Weather widget can use your browser’s geolocation to pick a nearby weather station. This requires your explicit one-time browser permission. If granted, the latitude and longitude are stored in your account preferences so the widget can keep working without re-asking. They are sent to the weather provider (see “Third parties” below) but not to any other party. You can clear them anytime in Settings.

4. Third parties

Noto sends data to a small number of third parties strictly to deliver the features you use:

  • Hosting (Railway, which operates on AWS infrastructure) — stores the database, runs the app servers, and keeps automated encrypted backups. Railway has access to the database in the same way any hosting provider has access to the systems it runs.
  • Object storage (Railway Buckets, an S3-compatible service operated by Railway) — stores the raw bytes of files you upload via the editor (images, PDFs). Bucket objects are private; reads are always brokered by Noto and gated on you being signed in as the owner.
  • Open-Meteo (open-meteo.com) — receives your latitude and longitude when the Weather widget fetches a forecast. No identifier is sent.
  • RSS feed origins — when you add an RSS feed, Noto fetches the feed URL from its server. The feed’s host sees a request from the Noto server (not from your browser).
  • SMTP provider (if 2FA email is configured) — receives the recipient email address and the OTP code, only for delivery of that single message.
  • Nager.Date (date.nager.at) — when you enable public holidays on the calendar and open the dashboard, Noto requests the holiday list for your chosen country and year. Only the country code and year are sent; no note content.
  • Stripe (stripe.com) — if you subscribe to Noto Plus, checkout and subscription management run through Stripe. Stripe receives billing contact details and payment information you enter on their pages.
  • Writing suggestions (proofreading) — when you run Check writing on a paragraph or selection, only that snippet of your note text is sent for proofreading (not your whole account, and not Google Calendar data). Noto Plus (bundled) may send the snippet to LanguageTool or OpenAI as you choose in Settings. Bring-your-own-key (BYOK) sends the same note snippet to the AI provider you choose. Your API key stays in your browser unless you opt to remember it on the device. Noto does not use note text or Google user data to train models.
  • Google Calendar (optional) — described in detail in “Google user data (Limited Use)” below. In short: Noto uses Google OAuth only so you can sync events with the Agenda on Today / the dashboard. This is separate from signing in to Noto (email and password).
  • Crossref (crossref.org) — when you look up a DOI in Research mode, Noto sends only the DOI (and standard application identification such as a contact email) to Crossref’s public metadata API. No note content, PDFs, highlights, or project data are sent.
  • Microsoft Calendar (optional) — when you connect Microsoft Calendar (Outlook / Microsoft 365), Microsoft receives your consent and issues OAuth tokens that Noto stores encrypted. Event titles, start/end times, and create/delete actions you perform in Noto are sent to Microsoft Graph for the calendars you authorised. This is separate from signing in to Noto. Microsoft’s privacy statement applies to data held in your Microsoft account.

Noto does not use third-party analytics, ad networks, or tracking pixels. If providers change you will see a new version of this policy. Material changes may require you to re-accept before continuing; clarifications may be shown as an in-app notice.

5. Google user data (Limited Use)

This section applies only to information Noto receives from Google APIs when you optionally connect Google Calendar (OAuth scope https://www.googleapis.com/auth/calendar.events). It does not apply to your Noto notes, password, or other non-Google data described elsewhere in this policy.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.1 What we access

  • OAuth access and refresh tokens (stored encrypted at rest) so Noto can call the Calendar API on your behalf.
  • The email address of the Google account you linked (to show which account is connected in Settings).
  • Calendar event data needed for the Agenda feature: event ids, titles, start and end times, and related create / update / delete results for calendars you authorised.

5.2 How we use it (Limited Use)

Google user data is used solely to provide and operate the user-facing calendar Agenda sync in Noto (view events alongside your day, and create or delete events you request in the app). We do not use Google user data for advertising, analytics products, credit scoring, selling data, or training artificial-intelligence or machine-learning models. We do not combine Google Calendar data with writing-check / AI features.

5.3 Storage, sharing, and human access

  • Tokens and the linked email are stored in Noto’s database on our hosting provider solely to run the Agenda feature for your account.
  • Event payloads are requested from Google when you open Agenda or sync, and create/delete actions you take in Noto are sent back to Google’s Calendar API. We do not sell or transfer Google user data to advertising platforms, data brokers, or AI providers.
  • Humans at Noto do not read your Google Calendar event contents except where necessary for security (investigating abuse or a bug you report), to comply with law, or with your explicit consent for a support request.
  • You may disconnect Google Calendar anytime in Settings; we delete the stored tokens (and stop calling Google on your behalf). Deleting your Noto account also removes this data.

6. Encryption

All traffic between your browser and Noto is encrypted with HTTPS (TLS 1.2 or later). All traffic between Noto’s servers, the database, and the object-storage service is encrypted with TLS. Database files, backups, and bucket objects are encrypted at rest by the hosting platform (AES-256 with provider-managed keys). By default, note bodies are stored as plaintext inside the database, and attachment bytes are stored unencrypted in the bucket — this matches the model used by Notion, Evernote, and most hosted note services and allows server-side features such as backups and consistent rendering. If you enable password protection on a note, that note’s body is stored as ciphertext derived in your browser; titles and attachments are handled as described in “Data we collect.” If you need guarantees we do not offer, please don’t store that material in Noto.

7. How long we keep data

  • Account and content data — for as long as your account exists.
  • Note attachments — for as long as the note (or your account) exists; deleting either removes the corresponding bucket objects on the same schedule as the database row. If your Plus subscription ends and you are over the free storage limit, excess files are kept for a limited retention period (45 days if you paid at least once, 14 days for trial-only accounts) and then deleted automatically; note text is not deleted.
  • After account deletion — your row in the active database is deleted immediately, and the bucket objects under your user prefix are deleted on the same pass. Backup snapshots that contain historical copies of your data are rotated out within 30 days.
  • Server logs — up to 30 days.
  • 2FA email codes — until used or until 10 minutes have passed, whichever comes first.

8. Your rights

You have the right to access, correct, export, and delete your personal data, and to object to its processing. You can exercise most of these directly inside the Service:

  • Access and correction — Settings page.
  • Export — use the per-note Export action (or contact us for a full account export).
  • Deletion — Settings → Delete account.

Under the EU/UK GDPR you also have the right to lodge a complaint with your local data-protection authority.

9. Cookies

Noto uses one cookie: a signed session cookie set after you log in. It is essential for the Service to function (without it you would have to re-authenticate on every request) and therefore does not require a separate cookie banner under the e-Privacy Directive. No analytics, advertising, or cross-site tracking cookies are used.

10. Children

Noto is not directed at children under 16. If you believe a child has created an account, please contact us so the account can be removed.

11. Changes to this policy

We may update this policy from time to time. Updates are signalled by a new version label at the top of this page. For material changes to how we process your data or to the contract, we will ask you to re-accept before you continue using Noto. For clarifications and non-material edits, we may show an in-app notice with links to the updated policy; you can dismiss it after reviewing.

12. Contact

For questions about this policy, data-access requests, or security disclosures, write to info@trynoto.app.