Privacy Policy

Nowted is local-first. Your notes live on your device. This policy covers the Nowted desktop app, the Nowted Web Clipper browser extension, and the optional AI Connections feature.

1. Data that never leaves your device

Note titles, contents, notebooks, tags, attachments, settings, and the clip queue are stored locally (on-disk files and a local database). We operate no Nowted servers that receive, store, or process this data, and we run no analytics, crash beacons, or advertising trackers in the app or the extension. The one optional exception is AI Connections (section 5), which you turn on yourself and which stores none of your note content.

2. Web Clipper: what happens on a clip

When you explicitly clip a page, the extension sends the captured content to the Nowted desktop app on the same computer (http://127.0.0.1:4567). That traffic never leaves your computer. Clips wait in an on-device offline queue if the app is closed and deliver when it opens.

Clipping a YouTube page additionally contacts YouTube's public services (InnerTube player API and oEmbed) from your browser to fetch the video title, thumbnail, and transcript — the same requests the YouTube page itself makes. This happens only when you clip a YouTube page.

3. Browser permissions and why each is needed

• Read page content on click (`activeTab`, `scripting`, host access): readability extraction runs only when you invoke a clip — never in the background.
• Storage: your clipper settings, per-site rules, and pending offline queue.
• Tabs, context menus, alarms: the popup, right-click clipping entries, and offline-queue retries.

The extension loads no remote code. Updates ship only through official browser-store releases of the extension package.

4. Data we never collect

No accounts, no names, no emails, no browsing history, no keystrokes, no location. There is nothing to sell, share, or breach, because it is never transmitted to us in the first place. (AI Connections stores only the technical identifiers listed in section 5.)

5. AI Connections (optional)

AI Connections lets an AI app you choose read and add to your notes. It is off until you turn it on in Settings → AI Connections, and every connection starts read-only.

• AI apps on your computer (for example Claude Desktop or Cursor) connect directly to Nowted on your own computer. Nothing goes over the internet.
• Cloud AI apps (for example Sesame, ChatGPT, Grok or Claude) cannot reach your computer, so they talk to mcp.nowted.com. That relay runs on Cloudflare and passes each request to the Nowted app on your computer through a connection your app opens, and passes the answer back. The relay does not store note content.

What is sent, and where. Only what an AI app you connected asks for, and only while Nowted is running on your computer. The notes it reads are sent to that AI app's provider (for example Sesame or OpenAI), through the relay, and from then on that provider's own privacy policy applies. Locked notes are never shared. If Nowted is closed, the AI app is told Nowted is offline and nothing is sent.

What Nowted stores in the cloud. A random device id, your device's public key, and the OAuth registration and token records for the AI apps you connected (which app, and when). Pairing codes are kept only as a one-way hash for ten minutes. No note titles, note text, tasks or attachments are stored. Cloudflare, which hosts the relay, may process standard connection data such as IP addresses to operate the service and prevent abuse.

What stays on your computer. The list of connections, what each one may do, and an activity log of what each AI app did. Deleting a note through an AI app moves it to Trash first and asks you to confirm.

How to revoke. In Settings → AI Connections, remove a connection to cut it off immediately, press Pause to stop all AI access at once, or turn off cloud AI apps entirely. You can also disconnect Nowted inside the AI app itself.

6. Google User Data & Calendar Integration

Nowted provides an optional integration that allows you to connect your Google Calendar account to view and manage your schedule alongside your notes and tasks in the desktop app.

• Data Accessed: When you connect your Google account, Nowted accesses your Google account email address (used strictly to identify the connected account), calendar metadata (calendar names, colors, and identifiers), and event information (event titles, descriptions, locations, start/end dates and times, and recurrence rules).
• How Data is Used: Google user data is used solely to display your schedule in Nowted's calendar and timeline views, and to synchronize events you create, edit, or delete within the app back to your Google Calendar.
• Data Sharing & Transfer: Nowted does not share, disclose, transfer, or sell Google user data to any third parties. All network communications occur directly between your local device and Google's official API endpoints over secure, encrypted HTTPS/TLS connections. Nowted operates no intermediary cloud servers that intercept, process, or store your Google Calendar data.
• Data Protection & Storage: OAuth authentication tokens (access and refresh tokens) and cached calendar events are stored locally on your device within Nowted's secure local SQLite database and protected user data directory. Tokens are transmitted only to Google's official OAuth and Calendar endpoints.
• Data Retention & Deletion: Google user data is retained on your device only for as long as your account remains connected in Nowted. You can disconnect or completely remove your Google account at any time in Settings → Calendar. Disconnecting or removing an account immediately and permanently deletes all stored tokens, credentials, and synchronized Google Calendar event records from your local device. You can also revoke Nowted's access at any time through your Google Account Security Settings.
• Google API Limited Use & AI/ML Prohibition: Nowted's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Furthermore, Google user data—including raw, aggregated, or derived data—is never used, transferred, or sold to create, train, retrain, or improve foundational or generalized machine learning or artificial intelligence models.

7. Children

Nowted collects no personal data from anyone, including children under 13.

8. Changes to this policy

Material changes will be noted here with a new effective date and, where reasonable, announced in release notes before they take effect.

9. Web Clipper summary

Clips go to 127.0.0.1 — your computer — not our servers. YouTube clips additionally query YouTube's public APIs for title, thumbnail, and transcript. Everything else stays local.

10. Contact

Questions about this policy: support@nowted.com.