Privacy policy

What we store

• Your account — the email address you sign up with, used for authentication and nothing else. You can sign in with a password, with a one-time link sent to that address, or with your Google account; signing in with Google tells us your email address and tells Google that you signed in to NoteMCP, and your Google password is never seen by us.
• Your notes — the text, titles, tags, and threads you create, with their timestamps.
• Captured media — photos and voice recordings you attach to notes, and transcripts of those recordings.
• Link previews — when a note carries a URL, our server fetches that page's public metadata (title, description, thumbnail) and stores it with the note.
• Search vectors — numeric embeddings derived from your note text so semantic search works. Producing them sends the note's text to DeepInfra, which runs the embedding model and returns the numbers; see below.
• Access credentials — hashed personal access tokens and OAuth grants for the agents you connect.

Where it lives

NoteMCP runs on a small set of infrastructure providers, each used for one job:

• Netlify — hosting. Every request to NoteMCP passes through it, including note text you save and the calls your connected agents make.
• Supabase — authentication, the notes database, and server functions.
• Cloudflare R2 — storage for photos and voice recordings.
• AssemblyAI — voice recordings are sent there once, to be transcribed. The transcript comes back to your note; we don't use the audio for anything else.
• DeepInfra — runs the embedding model behind semantic search. A note's text is sent there to be turned into the numbers described above, which come back and are stored with the note. That single call is the only thing DeepInfra is used for, and nothing is sent there for training or for any other purpose.
• Google — an optional way to sign in. If you use it, Google confirms your email address to us and records that you signed in to NoteMCP. Nothing in your notes is sent to Google, and choosing a password or an email link instead keeps Google out of it entirely.
• Creem — payments, if you subscribe. Creem is the merchant of record: it collects your payment and billing details directly, issues your receipt and handles any tax, under its own privacy policy. Card details never reach NoteMCP's servers, and none of your notes are sent to Creem. Creem may also contact you about a checkout you have started, under its own privacy policy. Any such message can be unsubscribed from, and doing so changes nothing about your notes or your account.

There is no advertising, no analytics or tracking scripts, and we never sell or share your data with anyone beyond the processors above.

Connected agents

NoteMCP's purpose is to let AI assistants you choose (Claude, ChatGPT, and other MCP clients) read and write your notes on your behalf. An agent only gets access after you approve it through the OAuth consent screen or create a personal access token yourself. Once a note is delivered to an assistant, that copy is handled under the assistant's own privacy policy. You can revoke any agent's access at any time from your Account page — revocation takes effect immediately.

Getting your data out

Your notes are readable in full by any assistant you connect — list_recent_notes pages through them, get_note returns each one whole, and get_note_asset fetches attached photos. That works on every plan, free included, and it is the same interface the product is built around rather than a separate export feature. There is no one-click download today. Ask us at the address below for a copy of everything we hold about you and we will send it.

Retention and deletion

Notes are kept until you delete them. Deleting a note is a soft delete: it disappears immediately from the app and from everything your agents can reach, but the row is retained in the database rather than erased, and there is currently no self-serve way to restore it or to purge it permanently.

To recover a deleted note, or to permanently erase individual notes or your whole account, email us at the address below and we'll do it.

Changes and contact

If this policy changes, the new version will appear at this address with a new effective date. Questions or deletion requests: hello@notemcp.com. See also the documentation and support.