Last updated 27 September 2026

Privacy policy

This policy explains what information TheNoteMaker (“we”, “us”) collects when you use the NoteMaker service at thenotemaker.com and app.thenotemaker.com (the “Service”), how we use it, and the choices you have. TheNoteMaker is a proprietorship based in Rangareddy district, Telangana, India.

Information we collect

Account information. When you create an account we store your name, email address, a hashed password (if you sign in with a password), and, if you enable two-factor authentication, the secret needed to verify your codes. If you sign in with Google, Microsoft or GitHub, we receive your name, email address and profile picture from that provider.

Content you create. Pages, collections, forms, form responses, comments, uploaded files (images, diagrams, documents) and Agent Mode conversations are stored so that the Service can show them back to you and the people you share them with.

Usage and technical information. Our servers keep standard logs (IP address, browser type, the pages requested and when) for security and troubleshooting. We use cookies for signing in, for security tokens, and to remember small preferences such as the workspace you last opened and your theme.

Analytics. We may use Cloudflare Web Analytics or Google Analytics to understand how the public website is used. Cloudflare Web Analytics does not use cookies or track individuals across sites. If Google Analytics is enabled, it sets its own cookies; we do not send it your name or email address.

Information from forms. When someone submits a form published through the Service, the responses belong to the workspace that owns the form. If you submit a form, the workspace owner decides how that information is used; this policy covers our role in storing and delivering it.

How we use information

To provide the Service: sign you in, store and display your content, deliver form responses and notifications, and send emails you have asked for (invites, password resets, form notifications, budget alerts).
To operate Agent Mode: when you send a message, the text of that message, the relevant parts of your workspace, and any files or images you attach are sent to the AI model provider configured for the Service so that it can respond. Those providers process the content to generate the reply; we choose providers whose terms do not permit training on this data.
To keep the Service secure: detect abuse, enforce rate limits, and investigate incidents.
To improve the Service: aggregate, non-identifying usage statistics.

We do not sell your information, and we do not use your content for advertising.

We share information only with providers that help us run the Service, and only to the extent needed:

Hosting and storage. The application, its database and uploaded files run on cloud infrastructure providers (currently Railway and its storage buckets). Data may be stored in regions outside India, including Singapore and the United States.
Email delivery. Transactional email is sent through Zoho ZeptoMail.
AI model providers. Agent Mode requests are processed by the model providers configured for the Service, such as Google, OpenAI or Anthropic, through an OpenAI-compatible API.
Web search. Agent Mode’s web search runs through a search service operated by us; queries are not sent to advertising networks.
Network and analytics. Cloudflare provides DNS, proxying and, where enabled, web analytics.

We may also disclose information if required by law, or to protect the rights, safety or property of our users, the public or ourselves.

Pages and collections are private to their creator until they are shared with a workspace, published to a link, or published on a custom domain. Anything you publish is public and may be cached or indexed by third parties. Form responses are visible to members of the workspace that owns the form, and are sent to any notification email or webhook that workspace has configured.

If you connect an MCP client such as claude.ai to a workspace, that client can read and write the workspace’s content under your account, as far as your role allows, until you revoke its token in Settings.

Retention

Your content is kept for as long as your account or workspace exists. Deleted pages go to the trash and can be restored; permanently deleted content is removed from our database, though copies may persist in backups for up to 30 days. Agent Mode conversations are kept until you delete them. Server logs are kept for up to 90 days.

When a workspace or account is deleted, its content is deleted with it, subject to the same backup window.

Security

We use HTTPS everywhere, store passwords hashed, encrypt stored secrets such as API keys, support two-factor authentication, and sign webhook deliveries so recipients can verify them. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at support@thenotemaker.com.

Your rights

You can view and edit your profile, change your email or password, and export your content (Markdown, HTML, CSV) from within the Service. You can delete pages, forms, conversations, workspaces you own, and your account. To exercise any right you cannot exercise in the Service, including access, correction, deletion or a copy of your data, email support@thenotemaker.com and we will respond within 30 days.

If you are in a jurisdiction with specific data-protection laws (including the Digital Personal Data Protection Act in India, or the GDPR), you may have additional rights, and we will honour them as they apply.

Children

The Service is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

Changes

We will post any changes to this policy on this page and update the date above. Material changes will also be announced in the Service.

Contact

TheNoteMaker, Rangareddy district, Telangana, India. Email: support@thenotemaker.com for privacy and data requests, info@thenotemaker.com for everything else.