This policy explains what data Nodi Notes collects, why, who it is shared with, and the rights you have over it. It applies to the website at nodinotes.app and to the app at app.nodinotes.app.
Who we are
Nodi Notes is operated by Luis Felipe Toro, an individual based in Colombia (“Nodi”, “we”, “us”), who is the controller of your personal data. For anything related to your data, write to privacy@nodinotes.app.
What we collect
Account data. Your email address and a password (stored hashed by our authentication provider), or, if you sign in with Google, the email, name and profile picture link that Google shares. We do not show your Google photo; your avatar is generated from your account ID.
Your content. The projects, boards, notes, connections, AI summaries, insights and chat messages you create, and your settings (for example your AI provider, model, language and canvas preferences).
AI provider keys. The API keys you connect (Claude, OpenAI, Gemini, OpenRouter or Hugging Face). They are encrypted on our server with AES-256-GCM before they are stored, are never sent back to your browser, and are only used to call the provider you chose. We keep the last four characters to help you recognize each key.
Technical data. Our hosting providers process your IP address, browser type and request logs to deliver and secure the service. The app stores some data in your browser (local storage) so it works: your sign-in session and, if you use it without an account, your boards.
Website analytics, only with your consent. See Cookies.
We do not sell your data, show ads, or use your content to train AI models.
How we use it
- To provide the service: create your account, sign you in, save and sync your content across devices, and run the AI features you request.
- To keep it secure: prevent abuse, enforce usage limits and fix errors.
- To improve the website, from aggregated analytics you agreed to.
- To contact you about your account or important changes to the service.
We process your data to perform our agreement with you (the Terms of Service), on our legitimate interest in keeping the service secure, and, for analytics, on your consent.
AI features
When you use an AI feature, the notes you chose to analyze (the whole board or a selection), your question and the recent chat messages are sent through our server to the AI provider you connected, using your own key. That provider processes them under its own terms and privacy policy, which you accepted when you created the key. We do not send your content to any AI provider you have not chosen, and nothing is sent until you ask for it.
AI results are saved with your board so you can see them again.
Who we share it with
We use these service providers, which process data on our behalf and only for the purposes above:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication |
| Vercel | Hosting of the website, the app and its server |
| Sign-in with Google, if you choose it | |
| Microsoft (Clarity) | Website analytics, only with your consent |
| The AI provider you connect | Running the AI features you request |
We may also disclose data if the law requires it, or to protect the rights and safety of our users or of Nodi.
International transfers
Our providers may store and process data outside Colombia, including in the United States. We choose providers that offer appropriate security measures and contractual protections for these transfers. By using Nodi you authorize these transfers.
How long we keep it
We keep your account and content while your account is active. You can delete your account at any time from Settings → Account → Delete account: your account, content and AI keys are deleted immediately. If you ask us by email instead, we do it within 30 days. We only keep what the law requires. Backups held by our providers are overwritten on their regular cycle. You can remove an AI key at any time from Settings → AI, and it is deleted immediately.
Security
Traffic is encrypted with HTTPS, each account’s data is isolated in the database with row-level security, and AI keys are encrypted at rest. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
Your rights
Under Colombian law (Law 1581 of 2012) and other laws that may apply to you, such as the GDPR, you can:
- know, access and get a copy of your data (you can also export a backup from Settings → Data);
- correct or update it;
- delete it (Settings → Account → Delete account) or ask us to, or withdraw the authorization you gave us;
- object to or restrict some processing;
- ask what your data has been used for;
- file a complaint with the Superintendencia de Industria y Comercio (SIC) in Colombia, or with your local data protection authority.
To exercise them, write to privacy@nodinotes.app from your account’s email. We answer queries within 10 business days and claims within 15 business days, as Colombian law requires.
Cookies
The app (app.nodinotes.app) does not use analytics or advertising cookies. It only stores what it needs to work, such as your sign-in session.
The website (nodinotes.app) uses Microsoft Clarity to understand how visitors use it, through heatmaps and session recordings. Clarity sets cookies (such as _clck and _clsk) and is only loaded if you click “Accept” in the cookie notice. Clarity hides text typed into forms. Microsoft processes this data under the Microsoft Privacy Statement.
You can change your choice at any time with Cookie settings at the bottom of every page. If you reject after accepting, the Clarity cookies are deleted.
Children
Nodi is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.
Changes to this policy
We may update this policy. We will change the date at the top and, for important changes, notify you by email or in the app before they take effect.
Contact
Privacy questions and requests: privacy@nodinotes.app.