Privacy Policy

1. Data we process

• Account data: Google account identifier, email address, name, avatar URL, language, time zone, and the time and version of your privacy agreement at registration.
• Note data: notes you enter or import, colors, associated message/thread identifiers, email subjects, and creation/update times. Imports or API submissions may also contain a sender field.
• Authentication and connection data: website sessions, browser authorization tokens, pairing details, and server request logs for security and troubleshooting. Logs may include IP addresses, request paths, timestamps and errors.
• Local data: the extension stores authorization tokens, unsynchronized note drafts and temporary connection state. The test script stores tokens and drafts through its script manager.

2. Gmail and Google access

Google sign-in requests only the basic openid, email and profile scopes, without Gmail or Google Drive API permissions. The extension and test script read the current account, message identifiers and subjects from Gmail pages to associate and display notes. We do not upload email bodies or attachments to the Gmail Notes server or download your entire mailbox. Content you paste into notes or import is stored as note data.

3. Purposes and sharing

We use data only for authentication, note synchronization, list tags, search, import/export, language and time preferences, security, maintenance and necessary support. We do not sell or rent personal data or use it for advertising, credit assessment or training general-purpose AI models. Google processes authentication. Hosting providers that operate the website and data storage (currently Vultr) may process data to provide the service. Authorized administrators may access data when necessary for maintenance or support. We may disclose data to competent authorities when legally required. Your notes are not made public to other users.

4. Storage, security and retention

Synchronized data is stored on the Gmail Notes server rather than Google Drive. We use HTTPS and account access controls. Notes are not end-to-end encrypted; avoid entering passwords or unnecessary sensitive information. Accounts and notes are retained while providing the service until you delete them or request deletion. Security logs and backups, if present, may remain temporarily during rotation or necessary legal retention rather than disappearing immediately with live database deletion. No transmission or storage method guarantees absolute security.

5. Your choices and deletion

You can view, search and export notes on the website, delete a note by clearing and saving it in Gmail, and revoke browser connections on the website. You can also revoke Google's access grant in your Google account security settings. Revoking authorization or uninstalling the extension does not automatically delete your server account or notes. From your profile, open “Your account data and deletion” to download your account data, read the deletion terms, verify your identity, and delete your account and related server data. Existing logins and extension authorizations become invalid. Infrastructure backups and security logs remain subject to the retention described above. If you cannot sign in or have other data requests, contact us below; we verify account ownership before processing requests. Signing out of the extension revokes that connection token. Uninstalling the extension clears its remaining local drafts. Use your script manager to clear the test script's local data.

6. Cookies and external services

The website uses cookies/sessions required for sign-in, form security and service operation. Pages may request fonts from Bunny Fonts and account avatars from Google. These services may receive ordinary connection information, such as your IP address and browser details, under their own policies. Gmail Notes does not use advertising tracking cookies.

7. Changes and Google user data

Updates appear on this page with a revised version date. New members must explicitly check their agreement before registration; we record its time and version. Gmail Notes' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

8. Contact

For privacy questions or data deletion requests, contact the Gmail Notes operator at [email protected]. Do not send passwords or authorization tokens.