Your notes are yours. Here's how we handle them.
What we collect
We collect only what Kinjot needs: your email, optional display name, notes, folders, tags, and API-key metadata: each key’s name, prefix, creation date, and last-used date. Keys are stored only as one-way hashes; we can never read them back. For Pro accounts, we also store plan status, a payment-provider customer reference, AI usage counts, and Recall history. Recall history contains your saved questions and answers until you delete them. If you turn on version history (it’s off by default), past versions of your notes are kept too. Separately, kinjot.com and the blog use Cloudflare Web Analytics, a cookieless page-view counter that records the page URL, referrer and load timings and does not identify you; app URLs never contain a note. The operator can see your account details (email, signup date, plan) and usage counts to run the service and handle support and abuse; never your notes, questions or answers.
Where it lives
Your data is stored with Supabase (Postgres), encrypted at rest and in transit. Access is enforced per-account at the database level. Every query runs under row-level security, so one account can never read another’s notes. Your browser also keeps a copy so the app stays fast and works offline. Images you paste into notes are the one exception: on a Pro account they are stored in Cloudflare R2 and served from a permanent public URL that anyone holding it can open, with no sign-in and no expiry. Nothing removes them on its own — there is no expiry and no cleanup. You can delete them yourself at any time from Settings → Usage → Open images, on any plan, and deleting your account deletes them. Local-mode notes exist only in your browser, and we can’t see them. They reach our servers only if you later create an account and choose to bring them along.
What Kinjot is not
Kinjot is not end-to-end encrypted. Server-side encryption protects your data from outsiders, but the service can technically access note content. That access is what makes features like AI recall possible. Treat Kinjot like a notebook, not a vault. Don’t store passwords, keys or other secrets in it.
What we don't do
We don’t sell your data, show ads, or use your notes to train AI models. There is no analytics profile of you built from note content. Our service providers are Supabase for data and authentication, Cloudflare for hosting and for storing pasted images, Lemon Squeezy for payments, and Voyage AI and OpenAI for hosted AI features. Bring-your-own-key Recall can also send data directly from your browser to OpenAI or Anthropic, as described below. For a signed-in Free account, note content leaves Supabase and Cloudflare only when you use bring-your-own-key Recall.
AI features
Hosted AI features send note content to two providers. Voyage AI creates embeddings for meaning-based search. It receives note text when a note changes, questions when you ask them, and saved Recall questions and answers so you can search your history. Voyage receives only text, with no identifier. OpenAI writes one-line search gists and generates Recall answers from your question and matched notes. AI Tidy sends OpenAI note titles, gists, and folder and tag names; it sends a note body only when no current gist exists. The only identifier OpenAI receives is a one-way hash of your account ID, never your email. We ask OpenAI not to retain the response.
Bring-your-own-key Recall sends your question, up to four matching note titles with excerpts and internal IDs, and your provider key directly from your browser to OpenAI or Anthropic. Kinjot receives neither the request nor the key. Before the first send of each browser session, Kinjot shows the exact payload and asks for approval. The key stays in memory for that browser session and is never stored.
What the AI providers may do with it
For hosted features, neither Voyage AI nor OpenAI trains on your notes. We opted out of Voyage AI model training; under its terms, your content is deleted after processing. OpenAI’s API policy says API data is not used for training and may be retained for up to 30 days for abuse monitoring. Those are provider commitments, not guarantees Kinjot can enforce. For bring-your-own-key Recall, your provider’s terms and account settings apply. If provider access concerns you, do not use hosted or bring-your-own-key Recall. A note’s embedding and gist are erased as soon as the note is deleted for good.
Payments (Pro)
Checkout and card handling happen entirely on Lemon Squeezy, our payment provider. To link the subscription we share your email address and account ID with them; Kinjot stores only your plan status and a customer reference. Card details never touch Kinjot.
Self-hosted deployments
A self-hosted app uses the operator’s Supabase project, static host, and provider accounts. The running app makes no license request to Kinjot. Kinjot does not receive the deployment’s notes, database credentials, Supabase access token, or OpenAI and Voyage API keys. The operator controls that environment and is responsible for its privacy, security, backups, migrations, and user disclosures.
When AI features run, each user’s note titles and bodies may be sent to the operator’s OpenAI and Voyage accounts. Those providers process the data under the operator’s account settings and agreements. Initial setup may queue existing users’ notes for this processing, including notes belonging to users who are not the operator.
Self-host purchase and update data
For the upcoming product, Self-host checkout will happen on Lemon Squeezy without a Kinjot account or Kinjot account ID. Lemon Squeezy will collect the buyer and transaction details needed for the purchase and receipt. The license key will be delivered in that receipt email and will never be included in a Kinjot setup URL. Kinjot may use order and contact details available in Lemon Squeezy to provide purchase, refund, and license support.
When distribution opens, the updater will contact Kinjot on its update schedule with the license key, linked deployment instance, installed version, source IP, and request timestamp. Kinjot will send the license key and linked instance to Lemon Squeezy for validation. The check will not send note content. The planned byo.jotnow.dev option separately uses a functional HTTP cookie and an edge license check before serving app files; Cloudflare therefore receives ordinary request data such as IP address and user agent. The app runtime itself does not call a Kinjot license service. Refund and license changes are handled manually, and disabling a license stops future downloads rather than an installed app.
Agents and API keys
When you connect Claude Code, Codex or the CLI, they act with an API key you create. The Kinjot key is scoped to your account, rate-limited, and revocable at any time in Settings. The tools are designed so nothing is saved or changed from an agent session unless you explicitly tell the agent to, and every change an agent makes to a note’s text is kept in that note’s version history.
Deleting your data
Notes you move to the trash can be recovered until you empty it. Emptying the trash removes those notes from your account for good. Their AI embeddings and gists are erased immediately, but a residual copy of the text remains in our database until you close your account. Saved recall answers work the same way: delete one and it leaves your history. Closing your account permanently deletes your notes and versions, folders, tags, API keys, embeddings, Recall history, and billing records. It also cancels active subscriptions, though the payment provider retains legally required transaction records. Closing the account clears the browser copy on that device too. Clearing site data deletes local-mode notes. You can export everything before you go.
Cookies and local storage
We store an auth session, your notes, and a few UI preferences in your browser so the app stays fast and works offline. No tracking cookies, and no third-party tracker beyond the cookieless page-view counter described above, which sets nothing in your browser.
Changes and contact
If this policy changes in a way that matters, we’ll note it in the changelog before it takes effect. Questions: [email protected].