NNoto

Privacy Policy

Exactly what we collect, where it goes, and how long we keep it.

1. Overview

This Privacy Policy describes what information Noto (the “Service”) collects when you use it, why we collect it, how it’s stored, and the rights you have over it. It applies to everyone who creates an account or browses the public pages of the Service.

2. Data we collect

2.1 Account data

  • Email address — required to sign in and to send transactional messages such as 2FA email codes and account-recovery emails. Noto may occasionally send service-related messages (important product changes) and rare, personal requests for product feedback, based on legitimate interest. You can opt out at any time by replying or emailing support; no marketing newsletters are sent without separate consent.
  • Password — stored only as a salted bcrypt hash. The plaintext is never written to disk.
  • Display name — optional, shown only to you.
  • 2FA secret (if you enable TOTP) — stored to verify codes generated by your authenticator app.
  • 2FA email-OTP hash (if you use email 2FA) — stored only as a salted bcrypt hash with a short expiry.
  • Consent record — the version of these legal documents that you accepted and the timestamp of acceptance.
  • Billing identifiers (if you subscribe to Plus) — Stripe customer and subscription ids, plan status, and period end date. Payment card details are handled only by Stripe.

2.2 Content data

  • Notebooks and notes — titles, body content (see password-protected notes below), sort order, and per-note presentation metadata (paper template and background).
  • Version history (optional) — for notes that are not password-protected, we may keep up to thirty prior copies of the note body as automatic checkpoints (about every five minutes while you edit) and as manual checkpoints you name yourself. These are stored in our database alongside the current note and are deleted when the note or your account is removed. Password-protected notes do not get server-side version history while locked.
  • Password-protected notes (optional) — if you set a note passphrase, your browser encrypts that note’s body before it is sent for storage. We keep the ciphertext, salt, and initialization vector; we never receive or store your passphrase, and we cannot recover the body if you forget it. The note title stays readable so lists and navigation still work. Embedded attachments (images, PDFs in object storage) are not encrypted by this feature — only the note body stored in the database is.
  • Note attachments — images, PDFs, and similar files you embed in notes via the editor toolbar. The bytes are stored in our hosting provider’s object-storage service (see “Third parties”); a small index row in the database records the file name, type, and size so we can authorise reads and clean up when a note or your account is deleted.
  • Dashboard preferences — your widget layout, timezone choice, weather location, public-holiday country choice, scratch-pad contents, roadmap entries, RSS feed URL.
  • Calendar connections (optional) — if you connect Google Calendar and/or Microsoft Calendar, we store encrypted OAuth tokens and the email address of each account you linked, so Noto can list, create, and delete events on your behalf in a single Agenda. Google Calendar data is handled under “Google user data (Limited Use)” below. Disconnect anytime in Settings; tokens are removed when you disconnect or delete your account.

2.3 Operational data

  • Server logs — IP address, user-agent string, request path, and timestamps for failed login attempts, security warnings, and runtime errors. Retained for up to 30 days for abuse-prevention and debugging.
  • Session cookie — a signed JWT issued by NextAuth on successful login. Used only to identify your session. No third-party analytics cookies are set.

2.4 Marketing emails

Occasional product news and offers are sent only with your consent (GDPR Art. 6(1)(a)). They may include product updates, tips, and promotional offers from Noto. Opting in (at signup, in Settings, or via an in-app prompt) starts a confirmation step: we email you a link and only treat consent as given after you open that link (double opt-in). Confirmation links expire after 7 days. We store a consent timestamp when confirmation succeeds. Until then you are not on the marketing list and are not synced to our email platform. You can withdraw consent anytime in Settings, via the one-click unsubscribe link in those emails, or by replying / emailing support. We do not send marketing newsletters without this confirmed consent. After confirmation, we sync your email address, first name (from your display name, if set), plan tier (free / trialing / plus), and subscription status to Hostinger Reach so we can send those emails. Hostinger International Ltd (EU) acts as our processor for this purpose only for users who have confirmed opt-in. (Service-related messages about important product changes are described under Email address above and rely on legitimate interest, not marketing consent. The confirmation email itself is transactional and does not include your display name.)

3. Geolocation

The dashboard’s Weather widget can use your browser’s geolocation to pick a nearby weather station. This requires your explicit one-time browser permission. If granted, the latitude and longitude are stored in your account preferences so the widget can keep working without re-asking. They are sent to the weather provider (see “Third parties” below) but not to any other party. You can clear them anytime in Settings.

4. Third parties

Noto sends data to a small number of third parties strictly to deliver the features you use:

  • Hosting (a virtual private server rented from Hostinger in Germany) — runs the Noto application, the primary database, and our self-hosted LanguageTool instance. Hostinger, as infrastructure provider, can access the systems it hosts in the same way any VPS provider can.
  • Object storage (Cloudflare R2 in the EU) — stores the raw bytes of files you upload via the editor (images, PDFs, and similar). Objects are private; reads are always served through Noto after an ownership check. Until early November 2026, a temporary copy of files uploaded before 25 October 2026 remains with our previous provider (Railway) and is then deleted.
  • Backups — encrypted database backups are kept for up to 30 days in Cloudflare R2 (Western Europe), and up to 7 days on the server. Uploaded files are mirrored daily to a second private R2 bucket in the EU; deleted or changed files are kept there for up to 30 days. Our hosting provider also keeps weekly server snapshots for a limited time under its own retention policy.
  • Open-Meteo (open-meteo.com) — receives your latitude and longitude when the Weather widget fetches a forecast. No identifier is sent.
  • RSS feed origins — when you add an RSS feed, Noto fetches the feed URL from its server. The feed’s host sees a request from the Noto server (not from your browser).
  • SMTP provider (if 2FA email is configured) — receives the recipient email address and the OTP code, only for delivery of that single message.
  • Hostinger Reach (Hostinger International Ltd, EU) — email marketing platform. Receives your email address, optional first name, plan tier, and marketing subscription status only if you opted in to marketing emails. Used solely to send those emails.
  • Nager.Date (date.nager.at) — when you enable public holidays on the calendar and open the dashboard, Noto requests the holiday list for your chosen country and year. Only the country code and year are sent; no note content.
  • Stripe (stripe.com) — if you subscribe to Noto Plus, checkout and subscription management run through Stripe. Stripe receives billing contact details and payment information you enter on their pages.
  • Writing suggestions (proofreading) — when you run Check writing on a paragraph or selection, only that snippet of your note text is sent for proofreading (not your whole account, and not Google Calendar data). LanguageTool (the default when configured) runs on Noto’s own server; text checked with it is not sent to any external proofreading service. Noto Plus (bundled OpenAI) and bring-your-own-key (BYOK) send the same note snippet to OpenAI or the AI provider you choose. Your API key stays in your browser unless you opt to remember it on the device. Noto does not use note text or Google user data to train models.
  • Google Calendar (optional) — described in detail in “Google user data (Limited Use)” below. In short: Noto uses Google OAuth only so you can sync events with the Agenda on Today / the dashboard. This is separate from signing in to Noto (email and password).
  • Microsoft Calendar (optional) — when you connect Microsoft Calendar (Outlook / Microsoft 365), Microsoft receives your consent and issues OAuth tokens that Noto stores encrypted. Event titles, start/end times, and create/delete actions you perform in Noto are sent to Microsoft Graph for the calendars you authorised. This is separate from signing in to Noto. Microsoft’s privacy statement applies to data held in your Microsoft account.
  • Crossref (crossref.org) — when you look up a DOI in Research mode, Noto sends only the DOI (and standard application identification such as a contact email) to Crossref’s public metadata API. No note content, PDFs, highlights, or project data are sent.
  • Railway (temporary) — until early November 2026, a temporary copy of files uploaded before 25 October 2026 may remain with Railway; that copy is then deleted. Railway no longer hosts the app or database.

Noto does not use third-party analytics, ad networks, or tracking pixels. If providers change you will see a new version of this policy. Material changes may require you to re-accept before continuing; clarifications may be shown as an in-app notice.

International transfers

Your account data and uploaded files are stored in the European Union. Some processors listed above are companies based outside the EU, or may use infrastructure outside the EU. In particular: Cloudflare, Inc. (United States) provides Cloudflare R2 storage and backups under its Data Processing Addendum, relying on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (SCCs); Hostinger may use sub-processors such as AWS, Google Cloud, and Cloudflare under SCCs; Stripe and OpenAI process billing and writing-suggestion data as described above and publish their own transfer safeguards (including SCCs where applicable). Until early November 2026, the temporary Railway file copy described above may also be held outside our EU R2 storage and is then deleted.

5. Google user data (Limited Use)

This section applies only to information Noto receives from Google APIs when you optionally connect Google Calendar (OAuth scope https://www.googleapis.com/auth/calendar.events). It does not apply to your Noto notes, password, or other non-Google data described elsewhere in this policy.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.1 What we access

  • OAuth access and refresh tokens (stored encrypted at rest) so Noto can call the Calendar API on your behalf.
  • The email address of the Google account you linked (to show which account is connected in Settings).
  • Calendar event data needed for the Agenda feature: event ids, titles, start and end times, and related create / update / delete results for calendars you authorised.

5.2 How we use it (Limited Use)

Google user data is used solely to provide and operate the user-facing calendar Agenda sync in Noto (view events alongside your day, and create or delete events you request in the app). We do not use Google user data for advertising, analytics products, credit scoring, selling data, or training artificial-intelligence or machine-learning models. We do not combine Google Calendar data with writing-check / AI features.

5.3 Storage, sharing, and human access

  • Tokens and the linked email are stored in Noto’s database on our hosting provider solely to run the Agenda feature for your account.
  • Event payloads are requested from Google when you open Agenda or sync, and create/delete actions you take in Noto are sent back to Google’s Calendar API. We do not sell or transfer Google user data to advertising platforms, data brokers, or AI providers.
  • Humans at Noto do not read your Google Calendar event contents except where necessary for security (investigating abuse or a bug you report), to comply with law, or with your explicit consent for a support request.
  • You may disconnect Google Calendar anytime in Settings; we delete the stored tokens (and stop calling Google on your behalf). Deleting your Noto account also removes this data.

6. Encryption

All traffic between your browser and Noto is encrypted with HTTPS (TLS 1.2 or later). Traffic between Noto’s servers, the database, object storage, and backup storage uses TLS where the protocol allows. Database volumes, object-storage objects, and backup objects are encrypted at rest by the respective providers (AES-256 / provider-managed keys, as offered by Hostinger and Cloudflare R2). By default, note bodies are stored as plaintext inside the database, and attachment bytes are stored unencrypted in the bucket — this matches the model used by Notion, Evernote, and most hosted note services and allows server-side features such as backups and consistent rendering. If you enable password protection on a note, that note’s body is stored as ciphertext derived in your browser; titles and attachments are handled as described in “Data we collect.” If you need guarantees we do not offer, please don’t store that material in Noto.

7. How long we keep data

  • Account and content data — for as long as your account exists.
  • Note attachments — for as long as the note (or your account) exists; deleting either removes the corresponding bucket objects on the same schedule as the database row. If your Plus subscription ends and you are over the free storage limit, excess files are kept for a limited retention period (45 days if you paid at least once, 14 days for trial-only accounts) and then deleted automatically; note text is not deleted.
  • After account deletion — we delete your account row and cascaded application data from the active database, remove bucket objects under your user prefix, cancel any active Stripe subscription (customer and invoice records remain with Stripe for legal accounting retention), revoke calendar OAuth tokens where the provider allows, and remove your marketing contact from Hostinger Reach (or retry shortly if that step fails). Stripe invoices and tax records are kept by Stripe under their retention obligations and are not deleted by Noto. Deleted data disappears from our backups within 30 days. Our hosting provider’s weekly server snapshots are kept for a limited time under its own retention policy.
  • Server logs — up to 30 days.
  • 2FA email codes — until used or until 10 minutes have passed, whichever comes first.

8. Your rights

You have the right to access, correct, export, and delete your personal data, and to object to its processing. You can exercise most of these directly inside the Service:

  • Access and correction — Settings page.
  • Export — use the per-note Export action (or contact us for a full account export).
  • Deletion — Settings → Delete account.

Under the EU/UK GDPR you also have the right to lodge a complaint with your local data-protection authority.

9. Cookies

Noto uses first-party essential cookies only, by purpose: a signed sign-in session cookie after you log in; short-lived security cookies that protect forms and sign-in (and calendar connect flows); and an interface language preference so the UI can load in your chosen locale. On the Windows desktop app, a first-party cookie may also identify that you are using the desktop client. These are necessary for the Service to function and therefore do not require a separate cookie banner under the e-Privacy Directive. No analytics, advertising, or cross-site tracking cookies are used.

10. Children

Noto is not directed at children under 16. If you believe a child has created an account, please contact us so the account can be removed.

11. Changes to this policy

We may update this policy from time to time. Updates are signalled by a new version label at the top of this page. For material changes to how we process your data or to the contract, we will ask you to re-accept before you continue using Noto. For clarifications and non-material edits, we may show an in-app notice with links to the updated policy; you can dismiss it after reviewing.

12. Contact

For questions about this policy, data-access requests, or security disclosures, write to info@trynoto.app.