Privacy policy.

Who is responsible

Noteer is run by Sergiy Zyuzko, an individual, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact: hello@noteer.co. Noteer is in testing; this policy describes the service as it runs today.

What Noteer collects

• Your account. Your name, email address and profile photo from Google when you sign in, and the date you joined. For each sign-in session: its expiry, and the IP address and browser it came from (used to keep your account secure).
• Your notes. What you write, dictate, photograph or record, including each note’s earlier versions (kept so an edit made on another device is never lost), due dates, pins, and the lenses and checklists notes belong to.
• What the agent writes and learns. The line and reading under each note, its proposals and questions, your answers, and “What I know”: names and facts you told it. You can read, edit and clear “What I know” in Settings.
• Your setup answers and settings, such as what you write about, the people you mention, your weekly review time, your time zone and theme.
• Google Calendar, if you connect it. Access tokens (stored encrypted, never sent to your devices) and the list of your calendars with the role you gave each. Events are read when needed and not stored.
• Usage events and error reports. Which screens you open and which features you use, and when (for example “a note was saved from voice”, “the Map was opened”, “a note was copied”, “voice failed: no microphone”), whether on a phone or a computer, the site page a new account came from, and error messages with the page they happened on and your browser. These never contain the text of your notes or anything else you wrote.
• “Start free” clicks on this site: the page and the time, nothing about who clicked.

Noteer never asks where you are and tells your browser to refuse location access for the site. It uses no advertising trackers.

Counting visits to this site

On the public pages (not inside the app), visits and page speed are counted with Vercel Web Analytics and Speed Insights. They set no cookies. A visit is recognised for at most a day by a hash of the request, which is then thrown away; nothing ties it to you. What’s counted: the page (without anything after ? or #), the site you came from, the country and region the visit came from (worked out from the network address, which isn’t kept), browser, operating system, device type, and how fast the page loaded. Noteer sees these only as totals.

Google Analytics and PostHog, only if you allow them. A card on the public pages asks whether Google Analytics and PostHog may count your visit; one answer covers both. Until you choose Allow, neither script is loaded at all. If you allow it, Google Analytics sets two cookies (_ga and _ga_ followed by the site’s id, kept for up to 13 months) to tell visits from the same browser apart, and records the pages you read, the site or campaign that brought you, a click on “Start free”, the country and region of the visit (from the network address; Google doesn’t keep the address), browser and device type. Its advertising features and Google signals are off, and Google keeps this for at most 14 months. If you allow it, PostHog (EU cloud, Frankfurt) sets one cookie (ph_ followed by the project’s key, kept for a year) and records the pages you read, the site or campaign that brought you, where you click and scroll on the page (to draw heatmaps of the public pages), a click on “Start free”, browser and device type. It doesn’t record your screen or what you type, and it doesn’t look up where you are (its location lookup is off). If you then make an account from that visit, the app passes on this visit’s random PostHog id once, so PostHog can tell that the visit led to an account. Your choice is kept in your browser for a year. “Analytics choice” at the bottom of every page lets you change it; No thanks removes Google’s and PostHog’s cookies.

Inside the app there is no Google Analytics and no analytics script (PostHog’s runs on the public pages only, after Allow). The usage events described above are kept by Noteer, and Noteer’s server also sends them to PostHog (EU cloud, Frankfurt), which shows how the app is used as charts. PostHog receives the event and when it happened, phone or computer, the day you joined, and your account’s random id. It never receives your name, your email, the text of your notes or your location. Once your account is deleted, what’s left in PostHog can no longer be linked to you.

Cookies and storage on your device

Noteer uses cookies to keep you signed in (and, for a few minutes, to complete a sign-in). On the public pages, Google Analytics and PostHog set their cookies only after you allow them (see above); your choice itself is kept in your browser’s storage, not in a cookie. The app stores your notes, a queue of unsent changes, chat threads and a few preferences (such as the theme) in your browser so that it works offline; signing out clears them from that device. There are no other cookies.

What reaches AI models, and what never does

The agent is the reason Noteer exists, so your notes are processed by AI models:

• Reading notes, chat, polishing and lenses: Claude models from Anthropic (USA). A read sends the note, a few of your recent notes, your lens names, what the agent knows that is relevant, and calendar events around the note’s time. Under Anthropic’s commercial terms, this content is not used to train their models.
• Voice notes: the audio is sent to Groq (USA), which runs Whisper and returns the text. Noteer has Groq’s zero data retention setting switched on, and doesn’t store the audio itself. If Groq refuses a clip, it goes to Deepgram instead.
• Recorded conversations: the audio is sent to Deepgram (USA) to be written down with speakers told apart, with Deepgram’s model-improvement program switched off. Noteer holds the audio in pieces only until it is written down, then deletes it; pieces that couldn’t be written down are removed within a day.

Secrets never reach a model. Before any text is sent to an AI model, code (not a model) finds passwords, PINs, door and Wi-Fi codes, card numbers, IBANs, identity numbers, API keys and seed phrases, and replaces them with a placeholder such as “[secret: password]”. Each secret is stored encrypted (AES-256-GCM) with a key of your own. The one exception: a secret you say out loud reaches the transcription service, because detection works on text.

Your notes are never used to train models, by Noteer or by the providers above, and the agent only acts outside Noteer (for example, adding a calendar event) when you tap to approve it.

AI apps you connect yourself. You can let AI apps you already use, such as Claude Code, Codex, the Claude app or Cursor, read your notes (Settings › Connections). Noteer asks you on its own page first. The app can then find and read your notes, never change them. It gets a note’s text with every secret replaced by a placeholder, its number, lens and dates; photos are not sent. What that app does with them is up to its provider and their terms. Disconnect it in Settings › Connections and it can’t read anything from that moment.

Where your data is stored and who processes it

Your data is stored in a Postgres database run by Neon in Frankfurt, Germany, encrypted on disk by Neon. The app runs on Vercel, in its Frankfurt region. Noteer is not end-to-end encrypted: the operator can technically access your notes. They are accessed only to fix a problem you report, to keep the service secure, or when the law requires it.

These providers process data on Noteer’s behalf, only to run the service:

Where data goes to the USA, it is transferred under the safeguards these providers offer for EU data, such as the EU Standard Contractual Clauses. Noteer does not sell your data or share it with anyone else, except when required by law.

Why your data is used (legal bases)

• To provide Noteer (contract): storing and syncing notes, the agent’s reading, chat, voice and conversations.
• With your consent: connecting Google Calendar (you can disconnect any time in Settings), recording conversations, and Google Analytics and PostHog on the public pages (change it any time with “Analytics choice”).
• Legitimate interests: keeping accounts secure, preventing abuse (such as daily limits on agent use), understanding which screens and features are used from events that contain no note text (kept by Noteer and shown through PostHog), and counting visits to the public pages without cookies.

How long it is kept

• Notes stay until you delete them. Fading and archiving hide notes; they don’t delete them.
• Delete forever removes a note, its earlier versions, the agent’s line and its proposals from the database and from your other devices. Only the note’s id and the time it was deleted are kept, so an offline device can’t bring it back.
• Voice audio is not stored. Conversation audio is deleted once written down, and within a day at most.
• Unanswered questions and proposals expire after 14 days.
• Your account and everything in it are deleted within 30 days of your request.

Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to its use, and receive it in a portable format. Any note can be copied as Markdown in the app; for everything else, including deleting your account, write to hello@noteer.co and you will get an answer within 30 days. If you think your data is mishandled, you can also complain to your local data protection authority.

Security

Connections use HTTPS. Secrets in notes and calendar access tokens are encrypted in the database with keys that are not stored there. The site can’t be shown inside other sites’ frames, and the browser is told to allow the microphone and camera only for Noteer itself. Found a security problem? Write to hello@noteer.co (see also security.txt).

Children

Noteer is not meant for children under 16, and doesn’t knowingly collect their data.

Changes to this policy

When this policy changes, the date at the top changes. Significant changes will also be announced in the app before they take effect. Each one is listed here, newest first.

• 30 October 2026. The app’s usage events (which screens and features are used, never note text) also go to PostHog’s EU cloud; you can let AI apps you use, such as Claude Code or Cursor, read your notes; the public pages count visits with Google Analytics and PostHog only if you allow it.