Privacy Policy

Information we collect

• Account information. Your email address, when you accepted the terms, login sessions, and hashes of one-time login codes and links.
• Synced data. The body of synced notes and attachments, and the search indexes (full-text and vector) built from them. Content is stored unencrypted.
• Credentials. LiveSync connection credentials, MCP client authorizations (OAuth tokens) and API tokens you issue.
• Logs. Server logs for incident response (IP address, user agent, request time and parts of the request).

How we use it

• Providing the Service (sync, search, access over MCP).
• Preventing abuse and enforcing limits.
• Understanding usage for incident response and quality improvement.
• Sending important notices.

Where data lives and third parties

• Data is stored on Cloudflare infrastructure (Workers, Durable Objects, D1, R2, KV, Vectorize).
• Search indexes are built with embedding models on Cloudflare Workers AI. Note content is sent to Cloudflare for processing.
• MCP clients (Claude, ChatGPT and others) receive only the notes you allowed when connecting. How they handle the returned content is governed by each client's own policy.
• Login codes are sent through Cloudflare's email sending service.
• Beyond the above, data is not shared with third parties except as required by law.

Operator access

The operator may access your data to the extent needed for incident response or abuse investigation, and does not view content for any other purpose.

Retention and deletion

• Deleting your account from the settings screen promptly removes server-side data (synced data, search indexes, settings, credentials and MCP authorizations).
• Server logs are deleted automatically after a fixed period.
• Data of accounts inactive for a long time may be deleted by the operator.

Cookies

Cookies are used only to keep you logged in. There is no advertising and no third-party analytics.

Changes to this policy

This policy may change. Important changes will be announced in the Service.