Privacy Policy
Last updated 29 August 2026
Notestify (“we”, “the service”) is operated by Lester Lawrence Sanchez, based in the Philippines. This policy explains what we collect, why, who else sees it, and how to remove it.
What we collect
- Account details. Your email address, and — if you sign in with Google — the name and profile picture your Google account provides. We never receive your Google password.
- Content you create. Notebooks, notes, decks, flashcards, quizzes, and annotations you make on documents.
- Files you upload. PDFs you add, plus the text extracted from them and any summary generated from that text.
- Tutor conversations. Every message you send the AI tutor and every reply, stored so you can return to past sessions.
- Study activity. Which cards you reviewed and how you graded them, and your quiz attempts and answers. This is what streaks, due counts, and progress are calculated from.
We do not collect payment details, we do not run advertising or third-party analytics, and we do not buy or sell personal data.
Where your content goes
AI features send your content to Google.
When you generate flashcards, quizzes, or a summary, the relevant text is sent to Google's Gemini API. When you use the AI tutor, your messages and the recent history of that conversation are sent too — along with any deck, note, or document you attach to the session.
Notestify runs on Google's free Gemini API tier. On that tier Google may use the content sent to it to improve their products, and it may be reviewed by people. That is Google's policy, not ours, and we cannot waive it for you. If a document contains something you would not want a third party to process or read, do not run AI features on it.
Feedback you send through the in-app form takes a different path from your study content. It goes to a private Discord channel we monitor, and its text is sent to Gemini so it can be summarised and prioritised. Please do not put passwords or anything you consider sensitive in a bug report.
We rely on these providers to run the service:
- Supabase — accounts, database, and file storage. All of your content lives here.
- Google (Gemini API) — processes text for the AI features. On our current free tier, Google may use that content to improve their products.
- Google (Sign-In) — only if you choose to sign in with Google.
- Vercel — hosting. Handles requests and keeps standard server logs.
- Resend — delivers reminder emails, and only if you switch them on. Receives your email address and the number of cards you have due, never your study content.
- Discord — receives bug reports and feedback you submit, so we see them promptly. Only what you wrote in the feedback form, never your notes, decks, or documents.
Each of these processes data under its own terms, and may store it outside your country.
We send email for two reasons. Sign-in and account messages are sent by Supabase and are part of running the service. Daily study reminders are optional, off by default, and only go out on days you actually have cards due — never as marketing. Every reminder carries a one-click link that turns them off without signing in, and you can change the setting at any time under Settings.
Cookies and local storage
We use no advertising or tracking cookies. What we do store on your device is limited to:
- Session cookies set by Supabase to keep you signed in. Without these the service cannot work.
- Two preferences in your browser's local storage — your light/dark choice and your accent colour. These never leave your device.
How your data is protected
Every table is protected by row-level security, enforced by the database itself: a signed-in account can only ever read or write its own rows. Traffic is encrypted in transit. That said, no service is perfectly secure, and this one is maintained by a small independent team rather than a dedicated security department — please weigh that when deciding what to upload.
Keeping and deleting data
We keep your content until you delete it or close your account. You can delete individual tutor sessions, notes, decks, and documents from within the app at any time; deleting a conversation removes its messages with it.
To delete your account and everything attached to it, contact us at realserted@gmail.com. Account deletion cascades to all of your content. Copies may persist in encrypted backups for a short period, and text already sent to Google is governed by Google's retention terms rather than ours.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to withdraw consent, or to complain to a data protection authority. We extend these to everyone regardless of location. To exercise any of them, write to realserted@gmail.com.
Age
Notestify is not intended for children under 13, or under the minimum age of digital consent in your country where that is higher. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Changes
If this policy changes in a way that materially affects you, we will update the date at the top and give notice in the app before the change takes effect.
Contact
Questions about this policy, or a request about your data: realserted@gmail.com.