Security and
data handling

Running the product means a small number of named companies handle part of it on our behalf. This is the same list the Privacy Policy publishes, and that document is the authoritative version of it.

• Clerk — authentication and your account.
• Supabase — data storage, on PostgreSQL.
• Stripe — payments. Stripe is a PCI-DSS Level 1 certified payment processor; that certification is Stripe's, not ours. We do not store your full credit card number.
• AI providers, including Google Gemini and OpenAI — content processing.

When you use an AI feature, the content you pointed it at is sent to one of those providers to be processed, under that provider's own data processing agreement, and the output is stored against your account. It is not added to anyone's training data.

Your data is stored securely using Supabase (PostgreSQL) with encryption at rest and in transit. We use industry-standard security measures including HTTPS, secure authentication (Clerk), and access controls.

Ownership is enforced in three independent places rather than one: the route that serves the request checks that the thing belongs to you, the database function that reads the row checks it again, and a row-level policy underneath both refuses to return anything owned by someone else. A request has to pass all three to reach a single note. Requests also travel through a security-headers layer, a cross-origin layer and a per-client rate limiter before they reach any of it.

We retain your data for as long as your account is active or as needed to provide the Service.

Depending on where you live, you may have the right to ask us for a copy of the personal data we hold about you, to correct it, to delete it along with your account, to export a portable copy, to object to processing, or to ask us to restrict it.

Write to [email protected] to exercise any of them. You do not have to wait for us to run an export: your account settings carry a full data export you can run yourself, whenever you like.

Billing is monthly and you can cancel at any time, with the cancellation effective at the end of the current billing period. We give thirty days' notice of any change to pricing, and your data stays available to export for thirty days after an account ends.

There is no compliance badge on this page, and that is deliberate. We publish what we can point at in the product and in the Privacy Policy, and nothing past it. We do not claim a security certification, an independent review, a guarantee about where in the world your data sits, or a promised level of availability, because we have published none of those things. If your procurement process needs something that is not here, write to [email protected] and we will tell you plainly whether we have it.

The same applies to what the product produces. AI-generated content may contain inaccuracies or errors. You should verify important information independently — which is the reason every answer arrives carrying the source it came from, down to the section it was taken from and, on a recording, the moment it was said.