NotesBridge Privacy Policy

Last updated: July 15, 2026

NotesBridge lets you use your Apple Notes from AI assistants such as ChatGPT. It is built so that your notes live on your own Mac — the service relays requests, it does not host your notes.

Data we collect and why

• Account data: your email address and a salted, hashed password (scrypt). Used solely to operate your account. We never store plaintext passwords.
• Device pairing tokens: a signed token identifying the Mac agent you paired. Used to route your requests to your own device.
• Note content in transit: when your assistant requests a note operation, the request and its result pass through our relay queue. This content is transient: it is held in encrypted storage (Supabase Postgres, in our own project) with a time-to-live of 45–60 seconds and is not logged, indexed, or retained. We do not maintain any copy of your notes. (Demo/reviewer accounts use fictional sample notes stored server-side instead.)
• OAuth tokens: standard access/refresh tokens so your assistant can act on your behalf. Refresh tokens rotate on every use.

What we do NOT do

• No selling or sharing of personal data with third parties for their own purposes.
• No advertising, tracking, surveillance, or behavioral profiling.
• No storage of your notes at rest, and no access to password-locked notes (macOS excludes them from automation).
• No collection of payment card data, health records, or government identifiers.

Data recipients (subprocessors)

Infrastructure only: Vercel (application hosting), Supabase (transient job queue & account records, Postgres), and Resend (sends the one-time email-address verification message — receives only your email address, never note content). Your assistant provider (e.g., OpenAI) processes the content you exchange with it under its own privacy policy.

Retention

Note content in transit: ≤ 90 seconds (automatic expiry). Account records and pairing tokens: until you delete your account. OAuth refresh tokens: 90 days or until revoked/rotated.

Your rights & deletion

Email us to access or delete your account data at any time. Unpairing your Mac (deleting ~/.apple-notes-agent.json and stopping the agent) immediately severs all access to your notes, regardless of any tokens outstanding.

Security

All traffic is TLS-encrypted. Authentication uses HMAC-signed tokens with PKCE-protected OAuth flows. Write actions require explicit confirmation in your assistant before they execute.

Contact

Questions or requests: isaiahdupree33@gmail.com · Support