Privacy Policy

1. Scope and operator

Notedeck ("Notedeck", "we", "us", "our") is operated as an independent project, not a registered company. This Privacy Policy applies to the Service and to any information you provide to us in connection with it.

If you do not agree with this Privacy Policy, do not use the Service. Contact: [email protected].

2. Information we collect

Account information. When you create an account we collect your email address and, if you choose phone-based authentication, your phone number.

Materials you upload. Documents, images, and any text or files you submit to the Service for processing ("Your Materials").

Generated artifacts. Outputs the Service produces from Your Materials, including knowledge graphs, lessons, summaries, quizzes, and chat transcripts.

Usage telemetry. Pages visited, features used, error events, approximate location derived from your IP address, browser and device type. We use this to operate, secure, and improve the Service.

Payment metadata. If a paid tier launches and you become a paying user, our payment processor handles card or bank details directly. We retain only an order identifier and the email associated with the transaction.

3. How we use your information

Provide the Service: parse Your Materials, build per-document knowledge graphs, run AI tutor lessons, store your generated artifacts.

Communicate with you about service status, security incidents, and significant product changes.

Improve the Service: analyze aggregated usage patterns and error logs to fix bugs and prioritize features.

Train and improve our own AI features. We may use Your Materials to develop, evaluate, and refine the AI features we ship — for example, retrieval quality, lesson generation, knowledge-graph extraction, and quizzing. You can opt out of this use at any time; see Section 8 (Your rights).

Comply with law and protect rights: respond to lawful requests, prevent fraud or abuse, enforce our Terms of Service.

4. LLM (AI model) processing

When you ask Notedeck a question, raise your hand to a tutor lesson, or use any AI-driven feature, your prompt and relevant excerpts of Your Materials are sent to one or more large language model (LLM) providers in order to generate a response.

As of the date of this policy, our LLM providers include Moonshot AI (Kimi), Anthropic, Google (Gemini), and DeepSeek. The current default provider may change as we tune quality and cost.

Third-party providers process your data under their own published privacy and data-handling terms. Where a provider offers an opt-out from training on customer data, we use that opt-out as the default. We do not authorize third-party LLM providers to use Your Materials to train their own general-purpose models.

Notedeck may, however, use Your Materials to develop, evaluate, and refine the AI features we ship to all users (lessons, quizzes, knowledge graphs, retrieval, and similar). You can opt out of this use at any time — see Section 8. Note that we cannot retroactively remove material from a model checkpoint that has already been trained.

We do not sell Your Materials, prompts, or conversations to any party for any purpose.

5. Storage and cross-border transfer

We store and process your data in the United States. Our cloud infrastructure providers (such as Cloudflare) operate from the United States, and our LLM providers operate from the United States and additional jurisdictions disclosed in their own policies.

If you access Notedeck from outside the United States — including the European Economic Area, the United Kingdom, mainland China, or any other jurisdiction — your information will be transferred to and processed in the United States. By using the Service you consent to that transfer.

Where applicable, we rely on Standard Contractual Clauses (or equivalent legal mechanisms) for transfers from the EEA / UK to the United States.

We reserve the right to restrict access to the Service in any jurisdiction where we determine that operation may not comply with applicable law or our operational policies. Users in such jurisdictions may experience reduced functionality or be denied access without prior individual notice.

6. Sharing with third parties

We share data only with the parties needed to operate the Service: cloud infrastructure providers, LLM providers, payment processors, error-reporting tools, and basic analytics providers.

We do not sell, rent, or trade personal information for advertising, marketing, or model-training purposes.

We will disclose information when required by law (subpoena, court order, lawful regulatory request) or where necessary to protect the safety of users or the public, and we will resist overly broad requests where we believe doing so is appropriate.

7. Cookies and tracking technologies

Notedeck uses a minimal set of cookies and similar technologies: a session cookie to keep you logged in, a language-preference cookie to remember your interface language, and basic anonymous analytics to understand how the Service is used.

We do not use advertising cookies, cross-site tracking pixels, or third-party advertising networks.

You can disable cookies in your browser settings. Some Service functionality (such as staying logged in) requires cookies to work.

8. Your rights

Subject to applicable law, you may have the following rights: access the personal information we hold about you; correct inaccurate information; delete your account and the data associated with it; export your data in a machine-readable format; restrict or object to certain processing; withdraw consent where processing is based on consent.

Opt out of AI training. You may at any time request that we exclude Your Materials from being used to train, evaluate, or refine our AI features. Email [email protected] with the subject "AI training opt-out". We will honor the request within 30 days; from that point on Your Materials will not enter any new training or evaluation run. We cannot retroactively remove your data from model checkpoints that were trained before your request.

If you are in the European Economic Area or the United Kingdom (GDPR), you also have the right to lodge a complaint with your local data protection authority.

If you are in California (CCPA / CPRA), you also have the right to know what categories of personal information we collect and disclose, the right to opt out of any sale or sharing of your personal information (we do not sell or share for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights.

If you are a resident of mainland China (PIPL), you also have the right to obtain a copy of your personal information, the right to object to automated decisions that significantly affect you, and the right to designate someone to exercise these rights on your behalf in the event of incapacity or death.

To exercise any of these rights, contact [email protected]. We will respond within 30 days where required by law, and faster on a best-effort basis.

9. Age and children

Notedeck is designed for users 13 years of age or older. We do not knowingly collect personal information from anyone under 13.

If you are between 13 and the legal age of majority in your jurisdiction (typically 18), we encourage you to use Notedeck under the supervision or with the consent of a parent or legal guardian. Some jurisdictions (for example certain EU member states) set a higher minimum age for processing personal data without parental consent; in those jurisdictions a parent or guardian should review this policy and the Terms before you use the Service.

If you are a parent or guardian and believe your child under 13 has provided personal information to us without your consent, please contact [email protected] and we will delete the account and associated data.

10. Security

We use TLS to encrypt data in transit, encryption at rest for stored Materials, and access controls to limit who on the Notedeck team can view production data.

No system is perfectly secure. We do not warrant that the Service will be free from unauthorized access, but we take reasonable steps and respond promptly to incidents.

11. Retention

We retain account data while your account is active and for up to 30 days after deletion to allow account recovery and to fulfil any open legal obligations. After that period we purge personal information except where applicable law requires longer retention (for example, tax records).

Generated artifacts and Your Materials are deleted when you delete them, and within 30 days after account deletion.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email and post a notice on this page at least 30 days before the changes take effect, except where the change is required by law or addresses a security issue, in which case we may act sooner.

13. Contact

For privacy questions, requests to exercise your rights, or any other matter related to this Privacy Policy, contact [email protected].