Privacy Policy
- Who we are
- What we collect
- How we use it
- AI assistants and MCP
- Who we share it with
- How long we keep it
- Your choices and rights
- Security
- International transfers
- Children
- This website
- Changes
- Contact
1. Who we are
Fromnote ("Fromnote", "we", "us") is a notebook app for Android, operated by CNCIT in the Philippines. We are the controller of the personal information described in this policy. This policy covers the Fromnote Android app, the Fromnote connector for AI assistants (our MCP server), and this website, fromnote.app.
2. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Name, email address, profile photo and a Google account identifier | Google, when you sign in with Google (through our sign-in provider, Clerk) |
| Your content | Pages, titles, text lines, checkboxes, tags, pen strokes (position, pressure, colour), page images rendered by the app, and text recognised from your handwriting | You, and AI assistants you connect |
| AI connections | Which assistants you've connected, the permissions you approved, and a log of the actions they took (tool name, time, result) | Your AI assistants when they use Fromnote |
| Subscription | Plan, status, renewal date and a Google Play purchase token. We never see your card details | Google Play |
| Device and technical | App version, Android version, device model, a push-notification token, IP address, and error reports | Your device and our servers |
Handwriting recognition happens on your device. The app uses Google's on-device ML Kit to turn handwriting into text; your strokes are not sent to Google for this. The recognised text is stored with your page so you can search it and your assistants can read it.
We do not collect your contacts, location, microphone or camera data.
3. How we use it
- To provide Fromnote — store and sync your pages across your devices, show updates live, and let the AI assistants you connect read and edit pages for you (performance of our contract with you).
- To run subscriptions — check your plan and usage limits, and verify purchases with Google Play (contract).
- To keep it secure and working — prevent abuse, investigate errors, and keep audit logs of AI actions (our legitimate interests).
- To contact you — about your account, security or changes to these terms. Marketing emails only if you opt in (consent).
- To comply with law — when we are legally required to.
We don't sell or rent personal information, we don't use it for advertising, and we don't use your notes or handwriting to train AI models, ours or anyone else's.
4. AI assistants and MCP
Fromnote lets AI assistants such as Claude, ChatGPT, Cursor or Hermes work with your notebook through the Model Context Protocol (MCP). This only happens when you connect an assistant, sign in, and approve its access.
- Once connected, the assistant can do what you approved: for example list, read (including page images and recognised handwriting), create and edit your pages.
- Content an assistant reads from Fromnote is then processed by that assistant's provider under their privacy policy and your settings with them. We don't control how they handle it.
- You can disconnect an assistant at any time in the app (Settings → Connected assistants) or in the assistant itself. Disconnecting revokes its access straight away.
- We keep a log of actions assistants took on your notebook, so you can see what changed and who changed it.
5. Who we share it with
We share information only with service providers who process it for us under contract, and only as needed to run Fromnote:
| Provider | Purpose | Data |
|---|---|---|
| Clerk | Sign-in, accounts, and authorising AI assistants | Account details, sign-in activity |
| Convex | Database, file storage and backend hosting | Your content, account and subscription data, logs |
| Google (Play, Firebase Cloud Messaging) | Subscriptions and push notifications | Purchase records, push tokens, notification content |
| Vercel | Hosting this website | Standard web request logs |
We may also disclose information if required by law, to protect people's safety or our rights, or as part of a merger or sale of the business — in which case this policy will continue to apply to your information.
6. How long we keep it
- Your content — for as long as your account exists. Deleted pages stay in Trash for 7 days (Free) or 30 days (Pro), then are permanently deleted.
- Account deletion — when you delete your account, we delete your account and content within 30 days. Copies in encrypted backups expire within a further 30 days.
- AI action logs and technical logs — up to 90 days.
- Subscription records — as long as tax and accounting law requires, even after account deletion.
7. Your choices and rights
You can view, edit, export and delete your pages in the app at any time, and delete your whole account in Settings → Delete account or as described on our account deletion page.
Depending on where you live — including under the Philippine Data Privacy Act of 2012, the EU and UK GDPR, and California privacy law — you may also have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to your local data protection authority (in the Philippines, the National Privacy Commission). To use any of these rights, email privacy@fromnote.app. We'll respond within 30 days and won't treat you differently for using them.
8. Security
Data is encrypted in transit (TLS) and at rest by our providers. Access to your notebook requires your sign-in, and AI assistants use scoped, revocable tokens. No system is perfectly secure; if a breach affects your information, we'll notify you and the authorities as the law requires.
9. International transfers
Our providers may store and process information in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.
10. Children
Fromnote isn't directed at children under 13 (or the minimum age in your country) and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll delete it.
11. This website
fromnote.app uses no cookies, no analytics and no tracking scripts. Our host keeps standard request logs (such as IP address and pages requested) for security.
12. Changes
We'll update this policy as Fromnote changes. If a change is significant, we'll tell you in the app or by email before it takes effect. The date at the top shows the latest version.
13. Contact
Questions or requests: privacy@fromnote.app · CNCIT, Philippines.