Zenodot Privacy Policy

Effective date: 2026-07-29

Summary

Zenodot is a personal note-taking and "Library" app. On Welcome, you can sign in with Apple or Google or choose to create a Guest account. Opening the app alone does not create an account. If you choose Guest, your notes and other app data are stored on our servers in Google Cloud; they are not confined to your device. When you use the Chute or, after linking, ask the Librarian questions, we store account information, note content, and operational metadata on Google Cloud, and we send your note text to Google Cloud Vertex AI so the Librarian can file your notes and answer your questions. We do not sell your data, we do not run advertising on you, and we do not embed third-party analytics. We use Firebase Crashlytics for app stability diagnostics. The third parties that receive your data are: Google (auth, hosting, AI, crash reporting), RevenueCat (linked-account subscription management), and the Apple App Store / Google Play Store (payment processing), and Linear (support and feedback triage, including the device diagnostics you submit with a report).

1. Who we are

Zenodot is published by Jackie C, sole proprietor, d/b/a Zenodot ("we", "us", "our"), an Australian sole proprietorship operating from Victoria, Australia. You can reach us at:

Email: zendotapp@gmail.com

We are the data controller for the personal data described in this policy.

2. What we collect

We collect the following categories of data. The data model is defined in db/src/zenodot_db/models.py in the Zenodot repository.

2.1 Account data

Firebase UID (firebase_uid) — a stable, opaque identifier issued by Firebase Authentication. We use it as the identity key for both Anonymous Guests and accounts linked to Apple or Google.
Account state — Guest, linked, merged, or deleted, plus the destination account identifier when a Guest has been merged.
Email address — only if you link or sign in with Apple or Google and the provider exposes one. Apple may provide a private relay address instead of your personal address. Guests normally have no email address.
Account tier — free or pro. Updated from RevenueCat.
Timestamps — created_at, last_seen_at.

2.2 Library content (the data you create)

Shelves, Books, Pages — your organised notes. Each Page stores a title, structured Page content, visible text derived from that content, free-text tags, a short generated summary, and a 768-dimensional embedding vector used for retrieval. During migration, an older Page may retain its exact legacy Markdown until it is converted without content loss.
Page Snapshots — pre-edit copies of Page content and its derived text, kept so you can roll a Page back to a previous state.
Chute Notes — the raw text you drop into the Chute before the Librarian files it into a Page.

2.3 Operational metadata

Ingestion jobs — job state (queued / processing / done / failed), error text, and links between jobs and the Pages they produced.
Library page changes — an append-only log of Page inserts, updates and deletes, used to keep the mobile app's local Library in sync.
Librarian message usage — one row per Ask query, used to enforce rate limits and to keep the history of your Ask sessions.
Page-sync idempotency log — a record of operations the mobile app has successfully applied, used to safely retry network failures.

2.4 Subscription linkage

revenuecat_original_app_user_id — the identifier we send to RevenueCat for a linked account. Today this is your Zenodot user UUID. We do not configure RevenueCat or create a RevenueCat customer for a Guest.
revenuecat_entitlements_synced_at — the last time we checked your entitlement status with RevenueCat.

2.5 Crash diagnostics

Firebase Crashlytics receives crash stack traces, app and operating-system versions, device model, build environment, and an opaque Zenodot user UUID when you are signed in. We do not intentionally attach email addresses, note text, Page titles, Chute content, or subscription details to crash reports.

2.6 Support and feedback reports

When you use the in-app Support & feedback form, we send the report type, the text you submit, your opaque Zenodot user UUID, hardware model, operating-system name and version, and installed app version and build number to Linear so that we can triage, investigate, and respond to your report. We do not send the user-assigned device name. Do not include sensitive information you do not want shared with our support team in a report.

2.7 What we do not collect

No device advertising identifiers (IDFA / GAID).
No analytics events. The Zenodot app does not import Firebase Analytics, Google Analytics, Mixpanel, PostHog, Amplitude, Segment or any equivalent SDK.
No location data.
No contacts, photos, microphone, camera, calendar, or health data beyond the text you type into the Chute or the Page content you write.
No cookies or third-party trackers on the Zenodot marketing site.

3. How we use your data

We use the data above for five purposes, mapped to the data they touch:

Provide the service. Account data + Library content. Without this we cannot show you your notes or sync between devices.
Run the AI Librarian. Chute Note text, library structure, and your Ask questions are sent to Google Cloud Vertex AI so the Librarian can file your notes and answer your questions. Page embeddings are generated by Google Cloud's embedding model and stored in our database.
Manage your subscription after linking. For linked accounts only, we exchange your user ID with RevenueCat to determine whether your account is free or pro and listen for RevenueCat webhooks. Guests are always treated as free and are not sent to RevenueCat.
Operate, secure, and debug the service. Operational metadata is used to triage ingestion failures, prevent abuse, and diagnose sync issues.
Provide support and improve Zenodot. We use in-app support and feedback reports to investigate problems, respond to help requests, and prioritise product improvements.
Comply with legal obligations. We retain the records we are legally required to keep (for example, financial records related to paid subscriptions) and respond to valid legal requests.

We do not use your Library content or Chute Notes to train any machine-learning model, including our own. The only model inference we do is on-demand, scoped to your account, on Google Cloud Vertex AI.

4. AI processing — Google Cloud Vertex AI

This is the most important section of this policy. Read it carefully.

4.1 What we send to Google

When you submit a Chute Note, we send the note text plus a bounded description of your existing Library structure (up to 50 Books and up to 8 Page titles per Book) to Google Cloud Vertex AI. The model may vary, and the request is made from our ingestion worker hosted on Google Cloud.

When you ask the Librarian a question, we send your question, a short rolling history of the Ask session, and a bounded set of Pages, Chute Note excerpts, and ingestion/provenance metadata retrieved from your account as evidence. We never send your entire Library or Chute history in a single request.

To generate and to query Page and Chute Note embeddings, we call Google Cloud's embedding model from the same worker, using the same Vertex AI project. The embeddings are stored in our Postgres database and never leave our Google Cloud project.

4.2 What Google does with it

We use Vertex AI under Google Cloud's terms, which state that customer data sent to Vertex AI is not used to train Google's foundation models and is processed transiently for the inference call only. We do not opt in to any data-sharing programmes, human-review programmes, or model-improvement programmes. Our worker code does not log prompts or model output to disk.

4.3 Opting out

The Chute and Ask features require the Vertex AI model. If you do not want your Chute Notes or Ask questions processed by Vertex AI, do not use those features. Reading and writing Pages directly does not invoke the model.

5. Authentication — Guest accounts and provider linking

If you choose Continue as Guest on Welcome, the app asks Firebase Authentication to create an Anonymous user. The app exchanges that Firebase ID token for a Zenodot Guest session, and we create a matching backend user. Content you create as a Guest is stored and processed on our servers in the same way as other account content.

Firebase normally persists the Anonymous identity on your device, but an unlinked Guest has no independent recovery credential. Clearing app data, losing the device, or otherwise losing the Firebase identity may permanently remove your access to that Guest data. Linking Apple or Google adds recovery and cross-device access.

When you link an unused Apple or Google credential, Firebase attaches it to the same UID and Zenodot keeps the same account and data. If the credential already belongs to another Zenodot account, we ask you to choose: Merge transfers the Guest history to that linked account; Throw away immediately deletes the Guest content; and Cancel leaves the Guest unchanged. After Merge or Throw away, we keep a minimal terminal identity record so old tokens cannot reactivate the Guest and we attempt to delete the source Firebase Anonymous user.

We do not merge Apple and Google identities merely because they expose the same email address. If Firebase reports that an email already uses another provider, you must sign in with that existing provider. Apple may supply a unique address ending in privaterelay.appleid.com when you choose Hide My Email.

Firebase Auth processes Anonymous creation, Apple and Google sign-in, and linking. We receive the verified Firebase UID, sign-in provider, email if the provider exposes it, and token expiry. Firebase Crashlytics separately processes the diagnostics described in §2.5. We do not enable Firebase Analytics or Firebase Cloud Messaging.

6. Subscriptions — RevenueCat

Zenodot Pro is sold through the Apple App Store and Google Play Store and managed by RevenueCat.

6.1 What happens on your device

The Zenodot app embeds RevenueCat's React Native SDK. For linked accounts only, we configure the SDK with your Zenodot user ID and select that account, which tells RevenueCat to associate any future App Store / Play Store purchases with your Zenodot account. When you open a paywall or the subscription management screen, the SDK presents the standard App Store / Play Store purchase UI. We never see your card details.

6.2 What happens on our server

Our backend calls RevenueCat's REST API at https://api.revenuecat.com/v1/subscribers/{user_id} to read your current entitlement state. We also accept webhooks at POST /api/v1/webhooks/revenuecat so that purchases, renewals and cancellations are reflected in your account within seconds.

6.3 What RevenueCat receives

RevenueCat receives your Zenodot user UUID (as the appUserID), the App Store or Play Store receipt, and standard device / SDK telemetry that the RevenueCat SDK itself collects. RevenueCat's handling of that data is governed by RevenueCat's own privacy policy, not this one.

7. Payments — Apple App Store and Google Play Store

All payment processing is performed by the Apple App Store or Google Play Store. Zenodot does not collect, store, or transmit your card number, CVV, or billing address. We only learn the outcome of the purchase ("subscribed" or "not subscribed") via RevenueCat.

8. Hosting and sub-processors

All Zenodot application data is stored on Google Cloud in the region configured for our project. The following sub-processors handle data on our behalf:

Sub-processor	Purpose	Data shared
Google Cloud	Hosting (Cloud Run), database (Cloud SQL), async jobs (Cloud Tasks), AI inference (Vertex AI Agent Engine)	All application data listed in §2
Firebase Auth (Google LLC)	Anonymous Guest authentication and Apple/Google linking	Firebase UID, sign-in provider, email (if exposed), token expiry
Firebase Crashlytics (Google LLC)	App stability and crash diagnosis	Stack traces, app/OS version, device model, build environment, opaque Zenodot user UUID
RevenueCat, Inc.	Linked-account subscription management	Linked-account app user UUID, App Store / Play Store receipts, SDK telemetry
Linear Orbit, Inc.	Support and feedback triage	Submitted report type and text, opaque Zenodot user UUID, device model, OS version, app version and build number
Apple Inc.	Apple authentication and payment processing (iOS)	Apple identity token, authorization code during deletion, email or private relay address if exposed, and purchase events; Zenodot never receives card data
Google LLC (Google Play)	Payment processing (Android)	Purchase events; Zenodot never receives card data

We will give you reasonable advance notice (in-app or by email) before we add a new sub-processor that handles your personal data.

9. International data transfers

Zenodot is operated from Australia (Victoria) and our data is hosted on Google Cloud. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data may be transferred to and processed in a country other than your own. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs) and a transfer-impact assessment as the legal basis for the transfer.

If you are in Australia, the cross-border disclosure of your personal data to overseas recipients (Apple, Google, RevenueCat — all based in the United States) is governed by Australian Privacy Principle 8. We rely on Google LLC's binding corporate rules / equivalent undertakings, the data-processing addenda signed with each sub-processor, and contractual safeguards in our agreements with RevenueCat as the basis on which APP 8 permits the transfer.

10. Retention

Data	How long we keep it
Active account data	Until you delete or discard the account, subject to the terminal identity record below
Library content (Shelves, Books, Pages, Snapshots)	Until you delete the row or close your account
Chute Notes	Until you delete the row or close your account
Operational metadata (ingestion jobs, sync log, message usage)	While your account is active + 30 days; longer if required to resolve an open support case
Subscription linkage (RevenueCat app-user-id, last sync timestamp)	While your account is active + 30 days for billing reconciliation
Crash diagnostics	According to the configured Firebase Crashlytics retention period; the app clears its user association on sign-out or deletion
Support and feedback reports	According to the configured Linear retention period; contact us to request deletion of a report linked to your account
Merged/deleted identity record	A minimal Firebase UID, state, and merge destination where applicable is retained to prevent old credentials from reactivating a transitioned account
Backups	Per Google Cloud's default Cloud SQL backup retention policy

We do not currently automatically purge inactive, unlinked Guest accounts after two years. Such a purge is future work and outside the current service; this policy does not promise that schedule. A Guest's server data otherwise follows the retention periods above unless the user chooses Throw away, deletes content, closes the account, or valid legal requirements apply.

11. Your rights

11.0 If you are in Australia

Zenodot is published from Australia and the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) apply to the personal data we collect, use, and disclose.

You have the right to:

Access the personal data we hold about you.
Correction of inaccurate, out-of-date, incomplete, or irrelevant data.
Deletion of personal data we hold about you, subject to legal exceptions (for example, financial records tied to a paid subscription).
Complain to us about our handling of your personal data, and to escalate that complaint to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

To exercise these rights, contact zendotapp@gmail.com. We will respond within 30 days.

11.1 If you are in the EEA, the UK, or Switzerland (GDPR)

You have the right to:

Access the personal data we hold about you.
Rectification of inaccurate data.
Erasure ("right to be forgotten").
Restriction of processing.
Data portability — receive your data in a structured, commonly used, machine-readable format.
Object to processing based on our legitimate interests.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with your local data-protection authority.

11.2 If you are in California (CCPA / CPRA)

You have the right to know what personal data we collect, to delete it, to correct it, and to limit the use of sensitive personal information. Zenodot does not sell or share your personal data for cross-context behavioural advertising. We do not discriminate against you for exercising these rights.

11.3 For everyone

You can:

View, edit, and delete your Library content (Shelves, Books, Pages, Chute Notes) from inside the app at any time.
Export your data as a JSON archive. The in-app export flow is on the roadmap; until it ships, email zendotapp@gmail.com and we will provide a JSON archive of your account + Library within 30 days.
Close your account and request deletion of all your data by emailing zendotapp@gmail.com. We will action your request within 30 days. We will retain only the records we are legally required to keep (for example, financial records tied to a paid subscription), and we will tell you exactly what we are retaining and why.

12. Children

Zenodot is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact zendotapp@gmail.com and we will delete the account and all associated data.

13. Security

We protect your data with the following measures:

Encryption in transit — all client / server traffic is over HTTPS.
Encryption at rest — Google Cloud SQL encrypts databases at rest by default.
Row-Level Security (RLS) — every user-owned table is protected by a Postgres RLS policy keyed on the authenticated user. Our go-live checklist (see GO_LIVE_PREREQUISITES.md) requires FORCE ROW LEVEL SECURITY on protected tables so that even the database owner cannot bypass the policy.
No shared secrets in the app — the only secrets on the device are the public Firebase and RevenueCat SDK keys. The RevenueCat server-side secret is held only in our backend.
RevenueCat webhook authentication — the webhook endpoint requires a shared authorisation header that is verified on every request.
Least-privilege IAM — production uses Google-managed IAM and Cloud Tasks OIDC tokens for internal calls; we do not use application-level shared secrets between the API and the worker.

Data-breach notification. If we have reasonable grounds to believe that your personal data has been involved in an eligible data breach, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)).

No system is perfectly secure. If you discover a vulnerability, please email zendotapp@gmail.com rather than filing a public issue.

14. Changes to this policy

We may update this policy from time to time. When we do, we will bump the Effective date at the top of this document, and we will show an in-app banner the next time you open Zenodot. If the changes are material, we will give you at least 30 days' notice before they take effect, either in-app or by email.

15. Contact

Questions, complaints, data requests: zendotapp@gmail.com.

We aim to respond within 30 days.