Privacy Policy

1. Who We Are

NoteSmith is operated by VARO Industries. We are committed to protecting your personal data and respecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding it.

2. Information We Collect

We collect the following types of information:

• Account information: Name, email address, and hashed password when you register.
• Content: Documents, chat messages, and comments you create within the Service.
• Usage data: Pages visited, features used, and session timestamps for product improvement.
• Security data: Two-factor authentication secrets (encrypted at rest), login timestamps, IP addresses for fraud prevention.
• Location (optional, off by default): If you turn on location tagging in Settings, notes you create can record where you were. This is never collected unless you switch it on, and your browser will ask your permission first. You can remove a location from any note you are able to edit, or turn the setting off, at any time.

How location is handled. Coordinates are encrypted at rest with a key derived for your account, in the same way as your note content, so a database breach alone would not expose them. A location travels with the note it is attached to: anyone you share that note with can see it, and if you publish a note the location is published with it. People who can edit the note see the exact position; people who can only read it see it rounded to roughly 110 metres. To turn coordinates into a place name we send the rounded position to OpenStreetMap — never your exact position, and no account, device, or user identifier. If you would rather not send anything at all, you can type a place name in by hand instead.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate you and keep your account secure
• To send transactional emails (email verification, invite emails, security alerts)
• To respond to your support requests
• To comply with legal obligations

We do not sell your personal data. We do not use your content for advertising.

4. Data Storage & Security

Your data is stored on servers in the European Union (Hetzner, Germany). We use industry-standard security practices including encrypted connections (TLS), hashed passwords (bcrypt), and isolated database access. Two-factor secrets are stored encrypted. No security measure is 100% foolproof — if you discover a vulnerability, please contact us at [email protected].

5. Third-Party Services

We use the following sub-processors:

• Hetzner — server hosting (EU)
• Self-hosted mail server — transactional email is delivered from our own SMTP server; we do not use a third-party email processor
• OpenStreetMap (Nominatim) — used only if you enable location tagging, and only to turn a position into a place name. Our server makes the request, not your browser, so OpenStreetMap never sees your IP address, your account, or anything identifying you as an individual; the request identifies NoteSmith as the application, and nothing more. The position we send is rounded to roughly 110 metres.
• Anthropic, OpenAI, Google — used only when you invoke the AI assistant, and only for the content of that request. These are US-based providers.
• KnotDo — used only if you connect the KnotDo integration or send feedback. Receives the task or feedback text you write, your name and email for feedback, and a link back to the note where a task was created. KnotDo is operated by us and runs on the same EU servers as NoteSmith.

Each sub-processor is contractually bound to protect your data and process it only as instructed.

6. Cookies

We use essential cookies only: a session cookie to keep you logged in, and an optional 2FA verification cookie. We do not use tracking or advertising cookies.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict processing of your data
• Data portability

To exercise any of these rights, contact us at [email protected].

8. Data Retention

We retain your account data for as long as your account is active. You may request deletion at any time. Backups may retain data for up to 30 days after deletion.

9. Changes to This Policy

We may update this policy. We will notify you of material changes via email or an in-app notice. Continued use of the Service after changes constitutes acceptance.

10. Contact

Privacy questions? Contact [email protected] or VARO Industries via varo.industries.