Noter privacy policy

Noter is a personal notes, tasks, email and calendar app run by Greymind Research (Balki, sole trader, Amsterdam, the Netherlands). It is not a public service: only the operator and people they invite can use it. This policy says what Noter does with your data, including the data it reads from Google and Microsoft when you connect a mailbox. Contact: [email protected].

What Noter accesses

When you connect a Google account, Noter asks for:

• openid, email, profile: to know which Google account you connected.
• gmail.modify: to read your mail, apply your sender rules (archive, label, mark as read) and keep Noter in step with Gmail.
• gmail.send: to send the mail you write or reply to in Noter, only when you press send.
• calendar.readonly: to show your calendar as an agenda. Noter never changes your calendar.

When you connect a Microsoft account, Noter asks for the equivalent Microsoft Graph permissions: Mail.ReadWrite, Mail.Send, Calendars.Read, User.Read and offline_access, used in the same way.

You sign in to Noter itself through the operator's own sign-in service, which gives Noter your name and email address.

What Noter stores

• Your notes, tasks, things and settings.
• For each connected mailbox: the access tokens (encrypted at rest), the messages Noter has synced (headers, text and attachment details), your sender rules, and your calendar events.
• Your push-notification subscriptions, if you turn notifications on.

All of it is kept in Noter's own database, on servers that Greymind Research runs in the Netherlands. It is not stored by any other service.

Who else processes it

• Google and Microsoft, as the mail and calendar providers you connected. For new-mail alerts, Gmail sends Noter a message ID through Google Cloud Pub/Sub and Outlook sends one through a Microsoft Graph subscription; the mail itself is then fetched from your account.
• Anthropic (Claude API), for one thing only: reading one-time sign-in codes. When an email looks like it carries a verification code and Noter has not yet learned that sender's format, the sender, subject and up to 4,000 characters of that email's text are sent to Anthropic, which returns the code. Anthropic does not use API data to train its models. No other mail, and no calendar data, is sent to any AI service.
• Your browser's push service (Google, Apple or Mozilla, depending on your browser), if you turn notifications on. A notification carries a short title and text, such as the sender and subject of a new email, and is encrypted end to end so the push service cannot read it.

What Noter never does

• It does not sell, rent or share your data, and does not use it for advertising.
• It does not use your Google or Microsoft data to train AI models, its own or anyone else's.
• No person reads your mail except you. The operator looks at your data only with your permission to fix a problem you reported, when the law requires it, or when it is needed for security.

Google API Services User Data Policy

Noter's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting your data

• Disconnect a mailbox in Noter's settings and its tokens and all its synced messages are deleted from Noter straight away. You can also remove Noter's access from your Google account or Microsoft account at any time.
• Ask for everything to be deleted by emailing [email protected]. Your account and all its data are deleted within 30 days.

Your rights

Under the GDPR you can ask to see, correct, export or delete your data, or object to how it is used. Email [email protected]. If you are not satisfied with the answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

Noter is only reachable over HTTPS, behind a sign-in. Mailbox tokens are encrypted in the database with a key kept outside it.

Changes

If this policy changes, the date at the top changes too, and users are told in the app before anything that affects their data takes effect.

See also: Noter terms of service.