Privacy Policy

Overview

Noti (the “Company”) complies with the Personal Information Protection Act (개인정보 보호법). The Noti service operated by the Company is referred to as the “Service”. The Company collects only the minimum personal data necessary to provide the Service, and destroys it without delay once the purpose of collection has been achieved or upon the user’s request. Content data such as your note contents, events, and to-dos is never used for advertising or AI model training purposes.

Personal data we collect

A. Required items

B. Optional items

Collection methods and purposes

Collection methods: Google sign-in (OAuth), input and automatic generation during use of the Service, newsletter subscription form, and customer support inquiries by email.

Retention and use period

Your personal data is destroyed without delay once the purpose of its collection and use has been achieved. However, information that must be retained for a certain period under the following laws is kept for the corresponding period.

Disclosure to third parties

The Company processes your personal data only within the scope of the purposes specified in this policy, and does not provide it to third parties without your explicit consent. The following cases are exceptions.

• When the user has consented in advance
• When required by an investigative authority in accordance with the procedures and methods prescribed by law, pursuant to the provisions of law or for the purpose of an investigation
• When necessary to prevent an imminent danger to the life, body, or property of the user or a third party

Processing entrustment

The Company entrusts certain tasks necessary for operating the Service to the following processors, and clearly stipulates responsibility for safe processing in the entrustment contracts in accordance with Article 26 of the Personal Information Protection Act (개인정보 보호법).

All processors below are located overseas; see Section 7 for the items transferred, destination countries, and timing.

Overseas transfers

The Company transfers personal data overseas for the following items in order to entrust processing necessary for providing the Service, and discloses the details of the transfer through this policy.

Method of transfer: network transmission over HTTPS (TLS 1.2 or higher). Retention period at the transferee: until the entrustment ends or the retention period in Section 4 expires. Users may refuse the overseas transfer by not using the relevant feature; if refused, use of some features may be limited.

In addition, the following services receive information directly from the user’s browser when the relevant feature is used: (1) Open-Meteo (weather service) receives device location coordinates when weather is displayed; (2) the push service provided by the user’s browser (Google, Apple, Mozilla, Microsoft, etc.) relays notification content in end-to-end encrypted form when a notification is sent.

Your rights

Users may exercise the following rights.

1. Right to access — Check the status of how your personal data is processed
2. Right to rectification/deletion — Correct or delete data when there are errors
3. Right to suspension of processing — Request suspension of specific processing
4. Withdrawal of consent — Withdraw consent for items you have already consented to
5. Right to data portability — Download your personal data being processed in a structured format

You can exercise the rights above directly in the Service — export your data at Settings > Data and delete your account at Settings > Account — or by requesting at seanjr28475@gmail.com. Requests are processed within 10 business days. Without signing in, see account deletion.

Destruction procedures and methods

1. Destruction procedure. When a user deletes their account, content, name, profile image, app settings, and push subscription information are deleted from the servers immediately. Information that must be retained under Section 4 (fraud prevention records, records required by law) is used only for the purpose of retention and destroyed without delay once the retention period expires.
2. Destruction method.
   • Electronic files: deleted from the database. Copies remaining in the database provider’s backups kept for failure recovery are deleted sequentially according to that provider’s retention cycle.
   • The Company does not keep personal data in paper form.
3. Data on the device. Data stored in the browser on the user’s device is also erased when the account is deleted. Before deletion, the user may download a backup file to their own device.

Security measures

The Company takes the following measures to process your personal data safely.

• Administrative measures — Designation of a data protection officer and the principle of minimizing access privileges to servers and databases
• Technical measures
  • TLS 1.2 or higher encryption on all communication channels
  • No password collection; login tokens stored in secure cookies inaccessible to scripts (HttpOnly)
  • Identity verification with the Google account on sync and AI requests
  • Signature verification of payment notifications
  • End-to-end encryption of push notification content
  • Optional app lock (PIN) that blocks access to the app on the device
• Physical measures — The Company does not operate its own servers; physical security follows the data center controls of the cloud providers listed in Section 6 (Vercel, Neon).

Cookies and automatic collection

Noti uses cookies only for sign-in, screen preferences, and usage statistics, never for advertising tracking. The Company uses the following cookies in its web service.

In addition, notes, events, and other content and UI preferences such as theme and language are stored in the browser storage (IndexedDB, localStorage) on the user’s device so the Service can work offline.

Users may refuse to store cookies in their browser settings; if refused, some features such as login may be limited. The Company does not use cookies for advertising tracking.

How AI recognizes your notes

Noti recognizes events in your notes in the following two ways.

1. Rule-based recognition on the device. Dates and times detected automatically while writing a note are recognized with rules run directly on the user’s device, and the note is not sent to the server for this purpose.
2. AI recognition. When the user uses a feature that requires AI recognition — such as recognizing a note again, recognizing text entered in quick add, or organizing notes with AI — the following information is sent to the Google Gemini API through the Company’s server.
   • Recognizing a note: the note title and body (up to 4,000 characters) and the names of the user’s projects
   • Organizing notes with AI: the titles and part of the bodies of up to 40 unclassified notes, and the names of the user’s projects
   • The transmitted content is used only to return the recognition result and is processed by Google in accordance with the Gemini API terms.
   • Free plan users can use AI features up to 10 times per month; the Company keeps only the monthly usage count.

Children's personal data

Noti does not provide its service to children under the age of 14, and children under the age of 14 may not register. The Company does not separately collect date of birth; if it is confirmed that the personal data of a child under the age of 14 has been collected without the consent of a legal guardian, the Company destroys such information without delay.

Data protection officer

The Company designates the following data protection officer to protect users’ personal data and to handle complaints and provide remedies related to personal data. As Noti is individually operated, the operator directly serves as the data protection officer.

Remedies for rights violations

To receive relief from personal data infringement, users may apply for dispute resolution or consultation to the agencies below.

• Personal Information Dispute Mediation Committee — 1833-6972 · www.kopico.go.kr
• Privacy Infringement Report Center — (no area code) 118 · privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division — (no area code) 1301 · www.spo.go.kr
• National Police Agency Cyber Investigation Bureau — (no area code) 182 · ecrm.police.go.kr

Changes to this policy

This policy may be revised to reflect changes in law or company policy. In the event of a revision, the Company will announce the changes through in-service notices and email at least 7 days before the effective date (30 days before in the case of changes unfavorable to users).

Revision history