Privacy Policy

Account details

Your email address, so you can sign in and we can send you sign-in codes. If you sign in with Google, we also receive your name and profile picture link from Google. We use these to run your account.

Study progress

Which topics you have marked as read, so we can show your progress.

Study assistant questions

The questions you ask are sent to our AI provider to produce an answer. We do not keep them. The next section explains this in detail.

“This seems wrong” flags

When you flag an answer, we store your question as you typed it, the answer you saw, which note passages it used, the topic, and the reason you give (if any). We use this to check the answer and fix our notes.

Usage records

The time of each question the assistant answers for you. We use this to apply question limits. We do not store the question with it.

Trial and subscription records

Whether you have a trial or paid plan, and when it starts and ends. We use this to give you the right access and to enforce one trial per person.

Payment information

Your card details never reach us. Our payment provider collects them directly. To stop repeat free trials, the provider may later give us a card reference. If it does, we keep only a keyed hash of it: a scrambled code that lets us recognise the same card again but cannot be turned back into your card details.

Technical logs

Our hosting and database providers keep technical logs when you use Knotes. These may include your IP address, the pages and features you requested, the time, and error details. We use them to keep Knotes working and secure.

Here is exactly what happens when you ask the assistant a question:

1. Before your question leaves our server, we automatically remove things that look like email addresses, phone numbers and card-like numbers. This is a best-effort filter based on patterns. It will not catch everything, so please do not type personal information into your questions.
2. We use your question to search our notes for matching passages. This search runs on our database provider, Supabase.
3. Your question and those passages are sent to our AI provider, Groq, which writes the answer.

We do not store your questions or the assistant's answers on our servers, except when you press “This seems wrong” (see above).

To show you your recent questions, a short list of them is saved in your own browser on your device. It is not sent to us. You can remove it by clearing your browser's site data.

Giving us your information is voluntary. No law requires you to give it to us. But we need some of it to provide Knotes:

• Without an email address (or a Google account), we cannot create your account.
• Without the question text, the assistant cannot answer. Anything else you type into a question is up to you.
• Without payment through our payment provider, you cannot start a trial or a paid plan.
• A reason on a flag is optional.

We only use your information when the law allows it. For Knotes, that means:

• To provide the service you signed up for (our contract with you). We need your account details, progress, questions and subscription records to run Knotes for you.
• To keep Knotes safe and fair (our legitimate interest). We use usage records, trial records and logs to enforce limits, stop trial abuse and protect the service.
• Your consent. Zimbabwe's law is built mainly on consent. By creating an account after reading this policy, you consent to the uses it describes. You can withdraw your consent at any time (see Your rights), but we may then be unable to provide Knotes.
• A parent's or guardian's consent for anyone under 18 (see Children).

We do not sell your personal information.

We share your information only with service providers who help us run Knotes, and only what each one needs:

• Supabase stores our database, handles sign-in and sends sign-in code emails, and runs the search that matches your question to our notes.
• Vercel hosts the website and keeps technical logs.
• Groq receives your filtered question and the matching note passages to write the assistant's answer.
• Google handles sign-in if you choose “Continue with Google”. Google's own privacy policy applies to your Google account.
• Our payment provider takes payments, handles billing and tax, and checks cards for trials. We have not chosen this provider yet. We will name it here before we take any payments.

We may also share information if the law requires it, for example a valid court order.

Most of our providers are based outside South Africa and Zimbabwe, mainly in the United States and the European Union. This means your information is sent to and stored in other countries.

Both countries' laws allow this only with safeguards. We rely on these:

• Provider commitments. We use providers who commit, in their contracts with us, to protect personal information.
• Needed for your contract. Sending your information to these providers is necessary to give you the service you signed up for.
• Your consent. By using Knotes after reading this policy, you agree to these transfers.

In South Africa this follows section 72 of POPIA. In Zimbabwe it follows sections 28 and 29 of the Cyber and Data Protection Act.

We keep information only as long as we need it for the reasons in this policy, or as long as the law requires.

• Account details and study progress: while your account is open. We delete them when you ask us to close your account.
• Flags: until we have reviewed the answer and fixed our notes if needed, and then only as long as they help us avoid the same mistake.
• Usage records: as long as needed to apply question limits, including the lifetime limit on trial questions.
• Trial records and card hashes: as long as needed to stop the same person or card starting another trial.
• Payment records: as long as tax and accounting laws require. Our payment provider keeps these.
• Technical logs: for a limited time set by our hosting and database providers.
• Recent questions in your browser: until you clear your browser's site data.

• Every table in our database has access rules, so a signed-in user can only reach their own records.
• Information travels between your device, our servers and our providers over encrypted connections.
• Card details never reach our systems.
• Secret keys for our providers stay on our servers and are never sent to your browser.
• We filter likely personal details out of assistant questions before they reach the AI provider.

No system is perfectly secure. If something goes wrong, we will tell you (see If there is a data breach).

Both South African and Zimbabwean law treat anyone under 18 as a child. You must be at least 16 to use Knotes. If you are under 18, a parent or legal guardian must consent before we process your information. This follows sections 34 and 35 of POPIA and section 10 of the Cyber and Data Protection Act.

A parent or guardian can use a child's rights on their behalf, such as asking to see, correct or delete the child's information (section 26 of the Cyber and Data Protection Act). Email us at [Privacy email: to be confirmed].

If we learn that we hold information about a child without the right consent, we will delete it.

You have the right to:

• be told what information we collect and how we use it (this policy);
• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• object to us using your information, free of charge;
• withdraw your consent at any time;
• complain to a regulator (see Complaints).

How to ask

Knotes does not yet have buttons to download or delete your data yourself. Until it does, email [Privacy email: to be confirmed] from the email address on your account and tell us what you want. We may ask you to confirm who you are. We will reply within [Response time: to be confirmed]. Asking is free.

Some information we may need to keep even after you ask us to delete it, for example payment records that tax law requires. We will tell you if that applies.

If someone gets unauthorised access to personal information we hold, we will:

• notify the Information Regulator in South Africa as soon as reasonably possible;
• notify POTRAZ, the Data Protection Authority in Zimbabwe, within 24 hours;
• tell the people affected as soon as reasonably possible, with enough detail to protect themselves.

We keep this to the minimum:

• Sign-in cookies. Strictly needed to keep you signed in. Knotes cannot work without them.
• Theme choice. Whether you picked light or dark mode, saved in your browser.
• Recent questions. Your last few assistant questions, saved in your browser.

We do not use advertising or analytics trackers. If that ever changes, we will update this policy and ask for your consent first where the law requires it.

We will not send you marketing emails unless you choose to receive them. If you do opt in, every email will include a way to unsubscribe.

We do send emails you need to use Knotes, such as sign-in codes and important notices about your account or these policies.

If you are unhappy with how we handle your information, please tell us first at [Privacy email: to be confirmed]. You also have the right to complain to a regulator at any time.

South Africa: the Information Regulator

• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: https://inforegulator.org.za/

Zimbabwe: POTRAZ (the Data Protection Authority)

• Website: https://www.potraz.gov.zw/

We will update this policy when Knotes or the law changes. The date at the top shows the latest version. If we make an important change, we will tell you by email or in the app before it takes effect.

• Privacy requests: [Privacy email: to be confirmed]
• Information Officer: [Information Officer name: to be confirmed]
• Everything else: [Contact email: to be confirmed]
• Address: [Physical address: to be confirmed]