Privacy Policy

NoteLosh ("we", "us", "our") operates the NoteLosh web app and Android app (the "Service"). This policy explains what personal data we collect, why, and your rights over it.

1. Data we collect

Account data

• Email address — required to create an account and sign in.
• Name & profile picture URL — optional, auto-filled from Google OAuth if you sign in with Google.
• Password hash — bcrypt hash for email/password accounts. We never store the plain password.

Content you create

Notes, links, file uploads, reminders, chat threads — stored on our servers so we can show them back to you across devices. Private by default, visible only to you.

Payment data

Card numbers, expiry, CVC are collected directly by Stripe. We never see or store them. We keep the transaction session ID and order details (product, amount, timestamp) for tax and dispute purposes.

Session & usage data

• JWT / session tokens in cookies + local storage on your device.
• Basic access logs (IP, user agent, timestamp) retained 30 days for security & abuse prevention.

We do not collect: location, contacts, microphone audio, camera video, or any data you did not explicitly enter into the app.

2. How we use your data

• Provide the Service — showing your notes, running AI search, delivering reminders, processing marketplace purchases.
• Send transactional emails — password resets, purchase receipts.
• Detect abuse and keep the platform safe.

We do not sell your data. We do not use it for advertising outside the Service.

3. Third-party processors

• Stripe — payment processing. See stripe.com/privacy.
• Google Play Billing — Android in-app purchases. See policies.google.com/privacy.
• OpenAI — powers AI semantic search. We send your search query + snippets of your notes at query time. See openai.com/policies.
• Emergent — cloud hosting & auth. See emergent.host/privacy.

4. Your rights

• Access, export, or delete your account & data at any time from Settings.
• Contact us to exercise GDPR/CCPA rights (see below).

5. Retention

Account data is kept while your account exists. On deletion, personal data is removed within 30 days; anonymised usage aggregates may be retained for analytics.

6. Children

NoteLosh is not directed at children under 13. Do not use the Service if you are under 13.

7. Changes

Material changes will be announced in-app or via email at least 14 days before taking effect.

8. Contact

Email privacy@notelosh.com.