Who we are and what this covers
Nootles Technologies Inc. (“Nootles”, “we”, “us”) operates www.nootles.com (the “Site”) and the application at app.nootles.com (the “App”). This policy covers both, and it is written to be read: if anything in it is unclear, ask us at privacy@nootles.com.
This website
The Site — the pages you are reading now — is static. It sets no cookies, runs no analytics, shows no advertising, and serves its fonts from our own servers, so reading it tells no third party you were here. When your browser requests a page, our hosting provider keeps standard server logs (your IP address, browser type and the page requested) to deliver the pages and defend against abuse; these are kept briefly and we add nothing to them.
A referral link — an address of the form app.nootles.com/r/…, shared by a partner — belongs to the App, not the Site. Following one passes you through the App first, which records the visit and sets the cookie described under “Cookies”, and then sends you on, usually to this site. The Site itself still sets nothing.
What the app collects
The App is in beta, and a beta collects more than a finished product will — both to run, and to learn what to fix. In full:
- Account information. You sign in with a Google account, handled by Clerk, our sign-in provider. We receive your name, email address and profile photo — never a password, because there isn't one. Onboarding asks what you do and what you'll use Nootles for, and the answers are kept with your profile.
- Your documents. The content you create — prose, diagrams, code, tables, files you upload — together with its full edit history and your conversations with the AI, stored so you can come back to them.
- Session recordings and usage data. During the beta we record how the App is used: the actions you take, and, for a sample of sessions, replays that reconstruct your screen inside the App — including document text as you type it. Replays do not record the words of the AI chat, the project context view, or the titles of linked tickets, because those can show content from services you or a teammate connected. Analytics run on PostHog; errors are reported to Sentry along with your account identity and recent console output, so what broke arrives with enough context to fix.
- AI interaction records. The instruction you give the AI, the document context sent with it, and what it proposed and you accepted or rejected — kept to evaluate the AI and to train and fine-tune the models that power the Service. Content that reaches the AI from a connected service (below) is not used to train or fine-tune any model.
- Feedback. Feedback sent from inside the App carries more than the message: a screenshot of your current screen, recent console output, a summary of recent activity, a link to the session replay, and your email address — so a report arrives with enough context to act on. If we track your report as an issue, its text, screenshot and your email address are filed in Linear, which we use to track our work.
- Connected services. You or a teammate can connect other services to a project so the AI can use what they hold. If you connect a GitHub repository, we store your access token, encrypted, and an index of the repository: its file paths, what each file exports, and summaries of its parts. A file's full text is fetched from GitHub when the AI reads it. If you connect a Notion page, we store your access token, encrypted, and the page's text, up to a limit, so the AI can read it. If you upload a file to a project's context, we store the file and the text read from it. If you connect a Linear workspace — with your own Linear account, or through your workspace's install of the Nootles Linear app — we store its access token, encrypted, and read only the teams you choose: their projects and current cycle, and their open and recently closed issues, of which we keep each one's title, state, assignee, labels and a short summary. An issue's full description and comments are fetched from Linear when the AI reads them, not stored. If you allow it, the AI may also file, comment on and update Linear issues — each one only after you approve exactly what will be sent. What a connected service brings in is read with the access of the person who connected it, so it is shown only to the project's owner, to people with a seat in its workspace, and to anyone a project manager chose to let in. Someone who holds only a share link reads the project's pages, never what a connected service brought in.
- Referral links. If you arrive through a partner's referral link, the App records the visit — a random visitor identifier, the time, and which link — and keeps the same three things in a cookie for 30 days. If you then create a new Nootles account within those 30 days, the account is linked to that referral, once and for good; an account that already exists is never linked. If you buy with a promotion code that belongs to a partner, your account may be linked to that partner in the same way. Once linked, the partner's name is set as a tag on you in our product analytics, and is added to your Stripe subscription if you buy one.
- Payment details. Paid plans are billed through Stripe, and you pay on Stripe's own checkout page, so your card details go to Stripe and never reach us. We give Stripe your name and email address, and keep what it tells us back: your Stripe customer identifier, your plan, and the state of your subscription.
How we use it
We use this information to provide and operate the Service; to store and sync your documents; to power the AI; to train and fine-tune the models that power the Service, for as long as the beta lasts; to watch how the App is used so we can fix and improve it; to measure which partners' referral links bring people to Nootles, and how many of them go on to sign up, finish onboarding, reach checkout and pay; to secure it and prevent abuse; to answer you; and to comply with law. We do not use your information for advertising, and we do not sell it — and never have.
AI assistance
When the AI reads or edits your document, the relevant content and your instruction are sent to third-party model providers to generate the response: inline completions go to Mistral, and chat, reformatting, captions and diagram work go to models from Google, OpenAI, Anthropic and DeepSeek, either through OpenRouter or directly to Google, OpenAI, Anthropic or Baseten. When the AI searches the web on your behalf, the search queries leave too. These providers process the content to provide the service and handle it under their own terms.
And plainly, because it is the price of the beta: we keep records of your AI interactions — instruction, document context, what was proposed, what you accepted — and use them to train and fine-tune the models that power Nootles. The exception is content from connected services, which is never used for training. If something you write yourself must stay out of a model's training data, the beta is not yet the place to write it.
Retention
Account information is kept while your account exists, as is the referral it was linked to, if any; both are deleted with the account. Documents and their edit history are kept so you can come back to them — and during the beta, deleting a page or project removes it from your workspace but does not immediately erase every copy from our systems: edit history, uploaded files and AI interaction records can persist until we erase them. To have your account and everything under it erased, write to privacy@nootles.com and we will do it. Records the law requires us to keep, we keep for as long as it requires.
Security
You sign in with Google, so there is no Nootles password to steal. Connections are encrypted in transit, tokens for connected services are stored encrypted, and access to user data inside Nootles is restricted to operating the Service. No system is perfectly secure and we will not pretend ours is the exception; what we promise is that if a breach affects you, we will tell you as the law requires, and plainly.
Your rights
You can ask for a copy of your information, ask us to correct it, and ask us to erase it — write to privacy@nootles.com. Canadian privacy law (PIPEDA and its provincial counterparts) gives you rights of access and correction; the GDPR, if you are in the EEA or UK, adds rights to portability, to object to or restrict certain processing, and to complain to your data-protection authority; California's CCPA does similar work, including the right not to be discriminated against for exercising it. We will verify a request before acting on it, and we answer within the time the law sets.
Where data lives
Nootles is a British Columbia company, but the Service runs on providers in the United States and elsewhere, so your information is processed outside Canada and is subject to the law of the places it is processed in. Where the law requires safeguards for moving data across borders — such as the EU standard contractual clauses — we use them.
Children
The Service is not directed to children under 13 and we do not knowingly collect their information. If you believe a child under 13 has an account, tell us at privacy@nootles.com and we will delete it.
Changes to this policy
We may update this policy as the Service changes. Material changes will be announced — on the Site, in the App, or by email — before they take effect, and the effective date at the top is always the date of the version you are reading.
Contact
Privacy questions and requests go to privacy@nootles.com.