Privacy policy

Who is responsible for your data

Ilyas Umalatov, the owner of topsnotes. For anything to do with your data, write to isumalatov@gmail.com.

What data we handle

Only three things:

• Your Google identity. When you sign in, Google tells us your email address, your name and your profile picture. Nothing else. We ask only for the email and profile permissions: we have no access to your Gmail, your Drive, your contacts or your calendar, and we could not get it even if we wanted to.
• What you write. The content of your pages, their titles, icons, covers and any images you upload.
• A count of your AI usage. How many requests you make each day, so we can apply fair-use limits. We do not store AI conversations on our servers.

We use no analytics, no advertising cookies and no third-party trackers. The only cookies set are your session’s: without them you could not stay signed in.

What we use it for

• Identifying you and keeping your session open.
• Storing your notes and showing them to you when you come back.
• Generating the AI responses when you ask for them.
• Applying usage limits so the service keeps working for everyone.

We do not sell your data. We do not share it with advertisers. We do not train any model on your notes.

The AI: exactly what gets sent

This deserves its own section, because it is the part that matters most.

Your notes do not leave the app unless you use the AI. When you do — the side panel, or an editor action like “Improve writing” or “Summarize” — we send the Google Gemini API the title and the text of the page you are on, along with whatever you ask for. Only that page: never the rest of your notes.

Google processes that text to return the response. See its privacy policy and its Gemini API terms for how it handles that text.

What that means in practice: if a note contains something you do not want to send to a third party, do not use the AI on that note. We would rather tell you plainly than hide it in the small print.

Who we share it with

Only the providers we need to make the app work. They act on our behalf and only to provide their service:

Some of these providers are outside the European Economic Area. Those transfers rely on the European Commission’s standard contractual clauses or on adequacy decisions, depending on the provider.

How long we keep it

For as long as your account is active. When you ask us to delete it, we remove your account and all your pages. Our providers’ backups may hold the data for a few more days before they rotate.

Pages you move to Trash stay stored until you delete them permanently.

Your rights

You can ask to access your data, correct it, delete it, take it to another service or object to how it is handled. Write to isumalatov@gmail.com and we will reply within 30 days.

To delete your account, write to that address from the email you signed up with. There is no button for it inside the app right now; we do it by hand.

If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (AEPD) at aepd.es.

Security

Each user can only access their own pages: the restriction is enforced in the database with row-level security policies, not just in the interface. All traffic travels encrypted over HTTPS.

Even so, no system is foolproof. topsnotes is a small project and is not meant for especially sensitive information: health data, credentials or confidential documents.

Minors

The service is not aimed at anyone under 14, and we do not knowingly collect their data.

Changes

If this policy changes in any meaningful way, we will update the date in the footer and tell you inside the app before the change affects you.