NoteSageNoteSage
← Back to home

Privacy Policy

Last updated: September 10, 2026

1. Introduction

This Privacy Policy describes how NAAICO ("we", "us", or "our") collects, uses, and protects information in connection with the NAAICO NoteSage desktop application and the website at notesage.naaico.com (collectively, the "Service").

NAAICO NoteSage is a product of NAAICO. By using the Service, you agree to the practices described in this policy.

2. Data We Collect on This Website

The NoteSage marketing website collects minimal data. If you contact us via email (for example, with a support question), we receive the information you provide in your message.

This website is hosted on Vercel, which may collect standard request logs (such as IP address, browser type, and pages visited) as described in Vercel's Privacy Policy.

We do not use cookies or analytics trackers on this marketing website unless explicitly added and disclosed in a future update to this policy.

3. Desktop Application Data

NAAICO NoteSage is designed with a local-first architecture. By default:

  • Audio is processed on your device using local speech-to-text engines
  • Transcriptions, notes, and meeting recordings are stored locally on your machine
  • Your audio is not sent to NAAICO or third-party servers unless you explicitly configure cloud processing

4. Credentials for Third-Party Services

When you connect third-party AI or transcription providers (such as OpenAI, Anthropic, Google, or Groq), you provide your own API keys. These keys are stored locally on your device using your operating system's secure storage (Keychain on macOS, DPAPI on Windows, libsecret on Linux) via Electron's safeStorage API.

NAAICO does not receive, store, or have access to your BYO API keys unless you use NAAICO-hosted cloud services.

Credentials for outbound integrations (see Section 6) are stored the same way: encrypted on your device, under a key held in your operating system's secure storage. They are not transmitted to NAAICO in the course of using the integration, and they are deleted from your device when you disconnect it.

Connecting an integration. Some integrations are connected through an authorization flow that NAAICO operates on your behalf, because the destination service requires a credential exchange that an application installed on your computer cannot perform on its own. In that flow, a NAAICO-operated endpoint receives the credential from the destination, encrypts it so that only your installation of NAAICO NoteSage can read it, and passes it to your device. The credential is held only for the duration of that single request. We do not store it, log it, or retain any copy. No note content passes through this endpoint at any time.

5. Optional Cloud Sync

If you choose to enable cloud sync (NoteSage Cloud), your notes and related data may be stored on NAAICO-managed infrastructure powered by Supabase and Neon Postgres. Cloud sync is entirely optional and disabled by default. You can switch between local-only and cloud sync modes in the application settings at any time.

6. Third-Party Providers and Outbound Integrations

When you configure cloud AI or transcription providers, your audio and text data may be sent directly from your device to those providers. Their handling of your data is governed by their respective privacy policies. NAAICO is not responsible for third-party provider data practices.

Outbound integrations. NAAICO NoteSage can send content from a note to a destination you connect, such as a Slack workspace. These integrations are optional and inactive until you connect one.

  • Content is sent only when you select it and confirm the destination. Nothing is published, synced, or forwarded automatically or in the background.
  • What is sent is the content you selected, together with the title of the note it came from. Audio recordings are never sent.
  • Content travels directly from your device to the destination. It does not pass through NAAICO servers, and we do not receive, store, or inspect it.
  • Once content reaches the destination, it is handled under that service's own privacy policy and under the retention, search, and administrative controls of the workspace or account you sent it to.

Where an integration posts using your own account with the destination, the content appears there as though you posted it and is attributable to you. Note that a note may contain transcribed speech from other people; you decide what to send, and sending it discloses that content to everyone with access to the destination.

7. Google Calendar Data

If you connect a Google Calendar, NAAICO NoteSage reads your list of calendars and the events in a rolling four-week window ahead. It uses the read-only scopes calendar.events.readonly and calendar.calendarlist.readonly. It never requests write access and cannot create, change, or delete anything in your calendar.

Event details — the title, start and end time, organizer, attendee list, and any conference link — are stored locally on your device so that meeting reminders and calendar-triggered capture work without a network connection. They are deleted when you deselect that calendar or disconnect the account. Calendar data is not sent to NAAICO servers.

NAAICO NoteSage's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Referrals and Invitations

If you invite someone to NAAICO NoteSage, the email address you enter is sent to NAAICO so that we can deliver the invitation and credit the referral to you. We use it for those two purposes and no other: it is not added to a marketing list, and it is not sold or shared.

If you have received an invitation and want your address removed from our records, email contact@naaico.com and we will delete it.

9. Cookies and Analytics

The NAAICO NoteSage desktop application does not include telemetry or usage analytics. It collects no usage metrics and sends no crash or performance reports. The marketing website does not currently use cookies or third-party analytics. If this changes, we will update this policy accordingly.

10. Data Retention and Deletion

You control your data through the desktop application. You can delete transcriptions, notes, audio recordings, and other stored data at any time through the application's settings. Audio retention periods can be configured in the Privacy & Data settings section.

11. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. Changes and Contact

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

If you have questions about this Privacy Policy, contact us at contact@naaico.com.