NoteLink
The short version: We collect your email, your notes, and the AI key you choose to bring. We use them only to run NoteLink. We never train AI models on your notes, never sell your data, and never show ads. AI requests are sent to the provider you chose (Anthropic or OpenAI) using your own key.
1. Information we collect
Account information. Your email address and a password. Passwords are stored only as argon2id hashes; we cannot see them.
Your content. Notes, folders, tags, links between notes, and files you upload (images and attachments such as PDF, DOCX, TXT, or MD). This content is stored on our servers so it is available on all your devices.
AI provider API keys. If you use the Ask NoteLink assistant, you provide your own Anthropic or OpenAI API key. Keys are encrypted with AES-256-GCM before storage and are never returned to any client device. All AI calls are made from our servers on your behalf.
Third-party integration tokens. If you use Notion import, you provide a Notion integration token so we can fetch the pages you shared with it.
Technical data. Standard server logs (such as IP address and browser type) used for security, rate limiting, and debugging.
Analytics. We do not use advertising trackers.
What we do not collect: we do not sell personal data, we do not show ads, and we do not track you across other apps or websites.
2. How we use information
We use your information to provide and maintain the service (storing and syncing your notes across devices), to process your AI requests when you use Ask NoteLink, to secure the service (authentication, rate limiting, abuse prevention), to respond to support requests, and to send essential service emails (such as security notices). We do not use your information for advertising.
3. AI features and your notes
When you use Ask NoteLink, relevant parts of your notes, your messages, and any files you attach are sent from our servers to the AI provider you configured — Anthropic or OpenAI — using your own API key. Their handling of that data is governed by their own terms and privacy policies, which we encourage you to review. According to both providers' published API policies, API inputs are not used to train their models by default.
We never train AI models on your notes, and we never allow anyone else to.
4. How we share information
We share data only with the following categories of service providers, and only as needed to run NoteLink:
- Hosting and storage: Vercel (application hosting), Supabase (file storage), which store data on our behalf.
- AI providers: Anthropic or OpenAI, only when you use AI features and only under your own key, as described above.
- Legal requirements: we may disclose information if required by law or to protect the rights, safety, or security of NoteLink or others.
We do not sell or rent personal information to anyone.
5. Data retention and deletion
Your content is retained while your account is active. You can delete individual notes, folders, and files at any time.
You can delete your entire account. Deleting your account removes your notes, files, stored API keys, and personal information from our production systems, and residual copies are removed from backups within 30 days.
6. Security
We protect your data with encryption in transit (HTTPS/TLS), argon2id password hashing, AES-256-GCM encryption for stored API keys, httpOnly session cookies, strict per-account data isolation, sanitization of rendered content, and rate limiting.
Please note that notes are not end-to-end encrypted: our systems must be able to read them to provide search, linking, and AI features. No method of transmission or storage is 100% secure.
7. Your rights
Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. You can exercise most of these rights directly in the app (editing or deleting content, deleting your account). For anything else, contact us at support@notelink.us and we will respond within the timeframe required by applicable law. We do not discriminate against you for exercising your rights.
8. International data transfers
Our servers are located in the United States. If you use NoteLink from outside that region, your information will be transferred to and processed there.
9. Children
NoteLink is not directed at children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. For material changes, we will notify you by email or an in-app notice before the change takes effect. The "Effective date" above always reflects the current version.
11. Contact
Questions or requests: support@notelink.us