Privacy Policy

If you only use guest mode: your workspaces and Quick Notes are stored on your device, not on our servers. What reaches us is limited to ordinary request data - IP address, browser type, pages viewed - and anything you deliberately send, such as running an AI summary.

If you create an account, we hold:

• Your email address, display name and profile details. Passwords are stored as bcrypt hashes - we cannot read them.
• If you sign in with Google: your Google account identifier, email and name. We do not receive your Google password.
• Your workspace content - Editor documents, Boards, Canvases - plus uploads and Quick Notes.
• Two-factor secrets and hashed backup codes, if you enable 2FA.
• Collaboration data: invites you send or receive, workspace roles, and your activity feed.
• Plan and billing status. Card numbers go to our payment providers, never to us.
• Usage and diagnostic data: sign-in times, AI runs and their cost, error reports.

If you pre-registered earlier: we no longer run a waitlist, but we still hold the email address you submitted at the time and which part of the page you submitted it from. Nothing else. Ask us and we'll delete it.

• To run the service: signing you in, storing and syncing your work, sending invites.
• To enforce plan limits and process subscription payments.
• To keep accounts secure - detecting abuse, rate-limiting, and supporting two-factor authentication.
• To send transactional email you asked for: verification, password resets, invites, and the single email telling you V4 has opened.
• To understand aggregate usage so we know which features earn their place.

We do not sell your personal data, and we do not use your workspace content to train our own models or anyone else's.

Nothing is sent to an AI provider until you actively run a summary or open the assistant. There is no background processing of your workspaces.

When you do run one, the text of that workspace's active views is serialised and sent to whichever provider answers first from our fallback chain - currently OpenAI, Groq, Google Gemini and Anthropic Claude. Content beyond roughly 12,000 characters is truncated before sending. We use these providers under their API terms, which do not permit training on data sent through the API.

Summaries are cached against a hash of the content so that regenerating identical content does not re-send it. If you would rather no workspace text ever leave our infrastructure, do not use the AI features - the rest of the product works without them.

We use these providers to run NotesLite+. Each gets only what it needs for its job.

We will also disclose data where the law requires it, and we may transfer it as part of a merger or acquisition - in which case we will tell you before it changes hands.

We set a session cookie so you stay signed in, and a guest-session cookie so guest work survives a page reload. Both are strictly necessary - the service does not function without them. Site analytics come from Vercel Analytics, which does not use cookies and does not build a cross-site profile of you.

We do not run advertising trackers.

• Account and workspace data: for as long as your account exists.
• Deleted workspaces and deleted accounts: removed from live systems promptly, and from encrypted backups within 30 days as those backups age out.
• Pre-registration emails: until V4 opens, or until you ask to be removed - whichever comes first.
• Billing records: kept as long as tax and accounting law requires, typically several years.
• Diagnostic logs: a short rolling window, normally under 90 days.

Whatever country you are in, you can ask us to give you a copy of your data, correct it, or delete it, and you can object to a particular use. Most of this you can do yourself from account settings; for anything you cannot, write to hello@noteslite.xyz and we will respond within 30 days.

If you are in the UK, EU or a similar jurisdiction, you also have the right to complain to your data protection authority. We would appreciate the chance to fix it first.

Traffic is encrypted in transit. Passwords are bcrypt-hashed, two-factor authentication with single-use backup codes is available on every account, and access to production data is limited to those who need it.

No service is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as the law requires.

NotesLite+ is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Our providers operate internationally, so your data may be processed outside the country you live in - including in the United States and the European Union. Where the law requires a transfer safeguard, we rely on our providers' standard contractual clauses.

We will update this page when what we do changes, and we will change the effective date at the top. For material changes - a new category of data, or a new purpose - we will tell you by email or in the app before it takes effect. The Terms of Service cover the rest of the relationship.