Privacy Policy
Last updated: August 2026
This Privacy Policy explains how Noto ("we", "us") collects, uses, and protects your personal data when you use our application. We are committed to compliance with the data protection laws applicable in your jurisdiction.
1. Data Controller
Noto is the data controller of your personal data. If you have questions about your data, you can Contact at any time.
You also have the right to file a complaint with California Attorney General.
2. Data We Collect
Account data: Your name, email address, and authentication credentials. We use this to identify you and keep you signed in.
Study content: Notes, tasks, calendar events, flashcards, quiz attempts, focus sessions, mind maps, and uploaded files, all content you create while using the app.
Usage data: Anonymous analytics about how you interact with the app (feature usage, crash reports) to help us improve.
Technical data: IP address (for security and rate-limiting on public forms), browser type, and device information.
3. How We Use Your Data
We process your data for the following purposes:
- Providing the service: Storing and displaying your notes, tasks, and study materials (legal basis: performance of a contract).
- Authentication: Verifying your identity and keeping your session secure (legal basis: performance of a contract).
- AI features: Processing your notes and documents to generate summaries, flashcards, quizzes, and chat responses (legal basis: consent, you opt in by using these features).
- Improvement: Analyzing usage patterns to improve features and fix bugs (legal basis: legitimate interest).
- Communication: Sending you service-related emails such as verification codes and password resets (legal basis: performance of a contract).
4. Cookies
We use cookies and similar technologies for the following purposes:
- Essential cookies: Required for authentication and core functionality. These cannot be disabled.
- Preference cookies: Remember your theme, language, and UI settings. These are stored locally on your device.
- Analytics cookies: Help us understand how the app is used so we can improve it. Only enabled if you accept "all cookies".
You can manage your cookie preferences at any time by clicking "Reset cookie preferences" on the How to Use page.
5. Data Sharing & Third Parties
We do not sell your personal data. We share data only with the following service providers, under strict data processing agreements:
- Cloud hosting & database: Your data is stored on secure, encrypted servers.
- AI providers: When you use AI features (summaries, flashcard generation, quizzes, chat), your note content is sent to AI models for processing. We use reputable providers and do not allow them to train on your data.
- Email service: For sending verification codes, password resets, and contact form responses.
- File storage: Uploaded files are stored in secure cloud storage with access controls.
When you share a note with another user, only that specific note's content is visible to them, not your other data.
6. Data Security
We implement industry-standard security measures to protect your data, including encrypted data transmission (HTTPS/SSL), secure password hashing, and row-level access controls that ensure each user can only access their own data. Access to production data is restricted to authorized administrators.
7. Data Retention
We retain your data for as long as your account is active. If you delete a note, it moves to Trash and is permanently removed after 30 days. You can delete your account at any time from Settings, this permanently erases all your data, including notes, tasks, flashcards, uploaded files, and study history.
8. Your Rights
You have the following rights regarding your personal data:
- Right of access: Request a copy of your personal data.
- Right to rectification: Correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): Request deletion of your data (also available via account deletion in Settings).
- Right to restriction: Limit how we process your data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests.
- Right to withdraw consent: Withdraw consent for AI processing at any time (by not using AI features).
To exercise any of these rights, Contact. We will respond within 30 days.
9. Children's Privacy
Noto is designed for students, including those in secondary and higher education. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "last updated" date. We encourage you to review this page periodically.
11. Contact Us
If you have any questions about this Privacy Policy or your personal data, Contact. We're happy to help.
Your rights
- Know what personal data is collected
- Know if data is sold or shared and to whom
- Delete your personal data
- Opt out of sale or sharing of personal data
- Limit use of sensitive personal data
- Non-discrimination for exercising your rights
- Authorized-agent requests
Data-processing inventory
| Data-processing inventory | Legal basis | Retention |
|---|---|---|
Account & profile Identify and authenticate you; manage your account. | Contract | Account lifetime + 30 days |
Study content Provide the study tools you use (notes, tasks, exams, flashcards, calendar, mind maps, revision sheets, AI agents). | Contract | Until you delete it (trash: 30 days) |
Uploaded files Attach and re-open documents in your notes. | Contract | Until you delete the file |
AI inputs Generate AI outputs (summaries, flashcards, quizzes, revision sheets, chat, explain-it-back). | Consent | Up to 30 days (provider abuse monitoring), then deleted, not used for training |
Usage analytics Understand usage and improve the app. | Legitimate interest / consent | Raw events up to 12 months; aggregates longer |
Collaboration data Share notes with collaborators you invite. | Consent | Until you unshare |
Backups Disaster recovery. | Legitimate interest | Up to 30 days |
Contact messages Handle support/contact requests; rate-limiting and audit. | Consent / legitimate interest | Up to 12 months |
“Transient” means we keep the data only long enough to handle your request, then it is deleted. Noto does not store it. The AI provider may keep it briefly, up to 30 days, to check for abuse.
Noto does not train any AI model. Our promise not to train comes from the AI providers' API terms (OpenAI, Google, Anthropic), which say data sent through their API cannot be used for training. AI replies you choose to keep, such as chat history or generated revision sheets, are saved as your own study content. You control this content and can delete it.
Privacy Nutrition Label
Full transparency dashboard, data map, export & deletion controls