Privacy Policy

Note Space is operated by:

This Privacy Policy applies to all users of Note Space, including:

• visitors to our website
• registered users
• workspace members
• desktop application users
• enterprise or organisational users
• trial users
• API and integration users

This Privacy Policy applies regardless of whether you access Note Space via browser, desktop application, or third-party integration.

We collect information necessary to operate, secure, maintain, improve, and support Note Space.

We may collect information you voluntarily provide, including:

• name
• email address
• username
• profile information
• authentication credentials
• billing details
• workspace names
• support requests
• uploaded files
• collaboration information
• user preferences
• communications with us

We may process content you create, upload, sync, store, transmit, or otherwise make available through Note Space, including:

• notes
• documents
• text entries
• attachments
• images
• audio
• metadata
• comments
• workspace data
• AI prompts
• AI-generated responses
• shared links
• organisational data

You retain ownership of your content unless otherwise expressly stated.

You are solely responsible for:

• the legality of your content
• ensuring you have rights to upload content
• maintaining backups where appropriate
• configuring sharing permissions correctly
• reviewing AI-generated outputs before use or distribution

The Windows and macOS applications may collect and process:

• application version data
• operating system information
• crash reports
• diagnostic information
• performance telemetry
• sync state information
• device identifiers
• local cache metadata
• security-related telemetry
• feature usage information

Desktop applications may locally store:

• cached notes
• offline files
• temporary content
• encrypted session information
• application preferences
• sync data

Removing the application may not automatically remove all locally stored files or cached data.

Users are responsible for securing devices they use to access Note Space.

Depending on enabled features, Note Space may request access to:

• local files and folders
• notifications
• clipboard functionality
• microphone access
• camera access
• operating system integrations

Permissions are used solely for providing requested functionality.

Users may revoke permissions through operating system settings; however, some functionality may become unavailable.

We may automatically collect:

• IP address
• browser type
• operating system
• device information
• app version
• timestamps
• referral URLs
• usage activity
• interaction events
• session information
• approximate regional location
• API request metadata
• crash diagnostics
• security logs

We may use:

• cookies
• local storage
• session tokens
• authentication tokens
• analytics technologies
• device identifiers

These technologies help us:

• authenticate users
• maintain sessions
• improve performance
• personalise experiences
• monitor reliability
• prevent abuse
• understand feature usage

Users may disable cookies through browser settings, though some services may not function correctly.

We may use information to:

• provide and operate Note Space
• authenticate users
• sync notes and workspaces
• enable collaboration
• improve performance and reliability
• detect fraud and abuse
• maintain security
• develop new functionality
• provide support
• communicate with users
• process subscriptions and billing
• enforce policies and agreements
• comply with legal obligations
• monitor infrastructure health
• investigate incidents
• train internal operational systems where permitted by law

Note Space includes an opt-in AI writing assistant. The assistant is off by default; you must enable it under Settings → Preferences → Writing assistant before any prompts leave the application.

When the assistant is enabled and you send it a message, that message is processed via the Vercel AI Gateway, which routes requests to one of the following AI infrastructure providers depending on the model selected or the message intent:

• Anthropic, PBC (Claude family) — United States
• OpenAI, L.L.C. (GPT family) — United States
• Google LLC (Gemini family) — United States

We instruct the gateway to forward a no-prompt-training preference where supported by the underlying provider. We do not use your notes to train any model and we do not permit our sub-processors to do so.

What is sent and what is not:

• messages you type into the assistant are always sent to the selected provider
• the body of a note is sent only when you explicitly attach it via the Attach toggle, or when you ask the assistant to read or summarise it
• assistant responses are stored on our infrastructure so you can return to past conversations
• we log message-level metadata (model, token counts, duration) but not the full prompt or response text

When using AI functionality:

• AI outputs are probabilistic and machine-generated
• outputs may contain inaccuracies, hallucinations, offensive material, or incomplete information
• AI-generated content should not be relied upon as factual, legal, medical, financial, professional, or safety advice
• users are solely responsible for reviewing and validating AI-generated content

We do not guarantee:

• factual accuracy
• reliability
• originality
• legality
• suitability for any purpose

Users should not submit:

• highly sensitive regulated information
• classified information
• unlawful content
• information restricted by workplace or contractual obligations
• personal data of third parties without their permission

unless explicitly authorised and legally permitted.

You can disable the assistant at any time from the same settings panel. Doing so hides the assistant pill in the editor; existing chat history is retained until you delete it or your account.

Where applicable under relevant privacy laws, we process information based on:

• contractual necessity
• legitimate interests
• legal obligations
• user consent
• fraud and abuse prevention
• protection of rights and security

We do not sell personal information.

We may share information with:

• cloud infrastructure providers
• hosting providers
• analytics providers
• authentication providers
• payment processors
• AI providers
• monitoring and security vendors
• customer support platforms
• contractors and service providers
• legal advisers
• regulators or authorities where required

Third parties receive only the information reasonably necessary to perform services on our behalf.

Note Space may integrate with third-party services.

Use of integrations may involve data sharing with the relevant provider.

Third-party services operate under their own:

• privacy policies
• terms
• security practices

We are not responsible for third-party platforms, services, APIs, or infrastructure.

Use of third-party integrations is at your own risk.

Your information may be processed or stored in countries outside your jurisdiction.

These jurisdictions may have different privacy protections than your local laws.

By using Note Space, you acknowledge and consent to such transfers where legally permitted.

We implement commercially reasonable safeguards designed to protect transferred information.

We retain information for as long as reasonably necessary to:

• provide services
• comply with legal obligations
• maintain security
• resolve disputes
• enforce agreements
• prevent abuse and fraud

Deleted data may remain in:

• backups
• logs
• archives
• replicated systems
• disaster recovery systems

for limited periods before permanent removal.

Users may request deletion of their accounts and associated personal information.

Certain information may be retained where reasonably necessary to:

• comply with law
• detect fraud
• maintain security
• enforce agreements
• protect rights
• preserve system integrity

Deletion requests may not immediately remove all cached or replicated copies.

We implement commercially reasonable administrative, technical, and organisational safeguards designed to protect information.

Security measures may include:

• encryption in transit
• access controls
• authentication systems
• monitoring systems
• infrastructure protections
• audit logging
• role-based access restrictions

However:

• no platform is completely secure
• no transmission method over the internet is guaranteed secure
• breaches, attacks, or unauthorised access may still occur
• we cannot guarantee absolute security or uninterrupted availability

Users acknowledge and accept these risks when using Note Space.

Users agree that they are solely responsible for:

• maintaining password confidentiality
• securing their devices
• reviewing AI-generated content
• maintaining independent backups where required
• ensuring compliance with applicable laws
• ensuring uploaded content does not violate laws or third-party rights

Users must not use Note Space to:

• distribute malware
• store illegal content
• infringe intellectual property rights
• harass or abuse others
• violate export controls or sanctions laws
• distribute unlawful or harmful material

We may disclose information where reasonably necessary to:

• comply with legal obligations
• respond to subpoenas or court orders
• enforce our agreements
• investigate fraud or abuse
• protect users or the public
• maintain platform security
• protect our legal rights

We may preserve information where legally required.

Information may be transferred as part of:

• mergers
• acquisitions
• financing transactions
• restructuring
• insolvency proceedings
• sales of assets
• corporate reorganisations

Users acknowledge that such transfers may occur as part of normal business operations.

Note Space is provided on an “as available” and “as is” basis.

We do not guarantee:

• uninterrupted availability
• permanent storage
• error-free operation
• real-time syncing
• compatibility with all systems
• continuous access to content

Services may be interrupted due to:

• maintenance
• outages
• infrastructure failures
• third-party provider failures
• internet disruptions
• security incidents

Users are responsible for maintaining backups of important information.

We may use analytics and diagnostics tools to:

• monitor application health
• identify crashes
• improve performance
• understand feature usage
• maintain reliability
• investigate abuse

These systems may collect technical metadata and usage information.

Note Space is not intended for children under the minimum legal age in their jurisdiction.

We do not knowingly collect personal information from children without legally required authorisation.

Where applicable, we aim to handle personal information in accordance with the Privacy Act 1988 (Cth) and Australian Privacy Principles.

Users in certain jurisdictions may have rights to:

• access information
• correct information
• request deletion
• object to processing
• request portability
• withdraw consent
• restrict processing

Requests may require identity verification and may be subject to legal limitations.

Where applicable, California residents may have rights under laws including the CCPA and CPRA.

We do not sell personal information as traditionally defined under those laws.

Users may not use Note Space in violation of applicable:

• export laws
• sanctions regulations
• trade restrictions
• embargoes

Users represent that they are not prohibited from using the Services under applicable laws.

We may update this Privacy Policy at any time.

Changes may occur due to:

• legal requirements
• operational changes
• security updates
• infrastructure changes
• product functionality changes

Updated versions become effective upon publication unless otherwise stated.

Continued use of Note Space after updates constitutes acceptance of the revised Privacy Policy.

For privacy, legal, or security-related enquiries:

To the maximum extent permitted by applicable law:

• Note Space is provided “as is” and “as available”
• we disclaim all warranties, express or implied
• we do not guarantee uninterrupted, secure, or error-free operation
• we are not responsible for loss of data, corruption, service interruptions, device compromise, or third-party failures
• we are not responsible for reliance on AI-generated outputs
• users assume all risks associated with storing or processing content through the Services

Nothing in this Privacy Policy limits rights that cannot legally be excluded under applicable law.