Privacy Policy

Noto is the data controller of your personal data. If you have questions about your data, you can Contact at any time.

In accordance with Article 34 of the French Data Protection Act, you also have the right to file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) at California Attorney General.

Account data: Your name, email address, and authentication credentials. We use this to identify you and keep you signed in.

Study content: Notes, tasks, calendar events, flashcards, quiz attempts, focus sessions, mind maps, and uploaded files — all content you create while using the app.

Usage data: Anonymous analytics about how you interact with the app (feature usage, crash reports) to help us improve.

Technical data: IP address (for security and rate-limiting on public forms), browser type, and device information.

We process your data for the following purposes:

• Providing the service: Storing and displaying your notes, tasks, and study materials (legal basis: performance of a contract).
• Authentication: Verifying your identity and keeping your session secure (legal basis: performance of a contract).
• AI features: Processing your notes and documents to generate summaries, flashcards, quizzes, and chat responses (legal basis: consent — you opt in by using these features).
• Improvement: Analyzing usage patterns to improve features and fix bugs (legal basis: legitimate interest).
• Communication: Sending you service-related emails such as verification codes and password resets (legal basis: performance of a contract).

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication and core functionality. These cannot be disabled.
• Preference cookies: Remember your theme, language, and UI settings. These are stored locally on your device.
• Analytics cookies: Help us understand how the app is used so we can improve it. Only enabled if you accept "all cookies".

You can manage your cookie preferences at any time by clicking "Reset cookie preferences" on the How to Use page.

We do not sell your personal data. We share data only with the following service providers, under strict data processing agreements:

• Cloud hosting & database: Your data is stored on secure, encrypted servers.
• AI providers: When you use AI features (summaries, flashcard generation, quizzes, chat), your note content is sent to AI models for processing. We use reputable providers and do not allow them to train on your data.
• Email service: For sending verification codes, password resets, and contact form responses.
• File storage: Uploaded files are stored in secure cloud storage with access controls.

When you share a note with another user, only that specific note's content is visible to them — not your other data.

We implement industry-standard security measures to protect your data, including encrypted data transmission (HTTPS/SSL), secure password hashing, and row-level access controls that ensure each user can only access their own data. Access to production data is restricted to authorized administrators.

We retain your data for as long as your account is active. If you delete a note, it moves to Trash and is permanently removed after 30 days. You can delete your account at any time from Settings — this permanently erases all your data, including notes, tasks, flashcards, uploaded files, and study history.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of your personal data.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data (also available via account deletion in Settings).
• Right to restriction: Limit how we process your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for AI processing at any time (by not using AI features).

To exercise any of these rights, Contact. We will respond within 30 days.

Noto is designed for students, including those in secondary and higher education. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "last updated" date. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or your personal data, Contact. We're happy to help.