Privacy policy

Effective 16 October 2026

imanotes turns short notes into small image cards and keeps them in your own Google Drive. This policy explains what personal data that involves, why, where it goes and how long it stays. It covers the imanotes app at imanotes.app and its public pages.

Who we are

imanotes is run by Jacek Skrzypczyński, Moszyce, 56-416, Poland (“we”, “us”). We are the data controller for the personal data described here. You can reach us at imanotes@proton.me.

What we collect and why

• Your account. When you sign in with Google we receive your Google account identifier, email address and name. We use the identifier to tell your data apart from everyone else's, and keep your email and name with your sign-in session. We also keep your name as a display name, shown with the cards you publish and in your circles' member lists — the other members of a circle you are in, and the creator of a circle you ask to join, see it. You can change it in the app.
• Your sign-in session. To keep you signed in we store a session with the access tokens Google issues to imanotes. The tokens are encrypted before they are stored.
• Your notes. The text of a note is sent to our server when you create or edit it, so that we can check it, suggest a folder and tags, generate its image and save it. The note itself is saved in your Google Drive, as an image file and a small data file holding the text, folder and tags. We keep a note's text in our own database only when you publish its card into a circle and choose to include the text (see below).
• An index of your notes. So the gallery loads quickly and can be filtered, we keep a list of your cards: the Drive file identifier, the file name (a date and time), the folder, the tags and when it was created and changed. The index does not contain the note text.
• Image generations. For every image we generate we record when it happened and for which account, to enforce generation limits.
• Published cards. If you publish a card into one of your circles, we store a copy of its image, the circle, the date, and — only if you choose, card by card — its tags and its note text. Only that circle's members can see it, under your display name. The circle's creator and we can take a card down; if that happens we keep a short notice with the reason until you have seen it. To moderate, we can see every published card in every circle, and any text published with it.
• Reports. If you report a card, we store which card, your account, the reason you chose, any note you write and when. Only we see reports: the card's author and the circle are never told who reported it. A card you reported is hidden from you from then on.
• Circles. If you create a circle we store its name, that you created it, and a link code you can send to others. For each member we store when they joined, and for each request to join, who asked, when, and whether it is waiting or was turned down. Members of a circle see its name and each other's display names; the circle's creator also sees who asks to join. Anyone you send the link to — and anyone they pass it on to — can see the circle's name, but not who is in it.
• Feedback. If you send us a message from the Feedback page — you need to be signed in to do so — we store the kind of message you chose (an idea, a problem or something else), what you write, the reply address you leave, if any, when you sent it and whether we have read it, linked to your account. We use it to improve imanotes and, if you leave an address, to reply to you. Only we read feedback.
• Visit statistics. We count visits to the start page and the app, clicks on “Sign in” and successful sign-ins, each with a timestamp. A successful sign-in is linked to your account so we can see who is using imanotes and when they last signed in. We do not record your IP address, device or browser in these statistics.
• Admission. We record that your account was let in — with an invitation or through open sign-up — so that you can come back later without one. The record holds your account identifier and when you were admitted; we also use it to limit how many new accounts join each day.
• Server logs. Our server writes technical logs to diagnose errors. They do not normally contain your note text or email address, but an error message can occasionally include an identifier or part of a file's content.

We process this data to provide the service you asked for (performance of our agreement with you), and to keep it working, secure and affordable — limits, moderation, abuse prevention, simple usage statistics and reading your feedback (our legitimate interests). We do not sell your data, use it for advertising, or build profiles of you.

Data from Google

imanotes asks Google for these permissions:

• Your identity (openid, email, profile): your Google account identifier, email address and name, used to sign you in and to label your data. We do not use your profile picture.
• Files imanotes creates in your Drive (drive.file): imanotes can see and change only the files and folders it created itself, not the rest of your Drive. It creates an imanotes folder with one sub-folder per note folder, saves each card there, reads those files back to show your gallery, and moves, updates or trashes them when you edit or delete a card. Deleting a card in imanotes moves its files to your Drive trash. To suggest a folder for a new note, imanotes reads the names of its own folders and sends them, with the note, to the AI provider described below.

We use data received from Google only to provide and improve the features you see in imanotes. We do not use it for advertising, do not sell it, do not let people read it except where you ask us to (for example, a support request), where it is needed for security or where the law requires it, and do not use it to develop or train AI models.

imanotes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you sign out, imanotes hands back its access to your Google account and ends your session. You can also remove imanotes' access at any time in your Google account's security settings.

AI processing

imanotes uses AI models through OpenRouter, a service that passes each request on to the model's provider. Each time you ask for suggestions or an image:

• the note text is checked for prompt injection and harmful content (using OpenRouter's moderation);
• the note text and the names of your existing imanotes folders are sent to a language model (currently OpenAI GPT-4.1 mini) to suggest a folder and tags;
• the note text and its tags are sent to a language model to write a description of the image; that description can quote your note;
• the description is sent to an image model (currently Google Gemini 2.5 Flash Image) to generate the card.

Only what you are creating or editing at that moment is sent; we never send other notes from your Drive. AI output can be wrong or unexpected; see the terms of use.

Where your data is stored

We use these service providers to run imanotes:

• Google — sign-in, and your Drive, where your notes and cards live.
• Fly.io — runs the imanotes server, in Stockholm, Sweden. Server logs are held there for a short period set by the provider; we do not export or archive them.
• Supabase — our database: sessions, the index of your notes, display names, circles and their members and requests, published-card records (including note text you chose to publish), generation records, visit statistics, invitations, take-down notices and feedback you send.
• Our card server — stores the images of published cards. Hosted by mikr.us, in Finland.
• OpenRouter and the model providers it routes to (currently OpenAI and Google) — AI processing as described above. These are based in the United States.

Where data is transferred outside the European Economic Area, the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on the provider's standard contractual clauses.

The pages at imanotes.app, including this one, load no third-party scripts, fonts or trackers.

Cookies

imanotes uses only cookies it needs to work. There are no analytics or advertising cookies.

• session — keeps you signed in; lasts 7 days and is renewed while you use the app.
• oauth_state — protects sign-in against forged requests; lasts 10 minutes.
• oauth_invite — carries an invitation through sign-in; lasts 10 minutes.
• oauth_circle — carries a circle's link through sign-in, so your request to join is sent once you are in; lasts 10 minutes.

The app also stores a few things on your device, not on our servers: your light/dark preference, an unsaved draft of a note you are writing (ignored after 24 hours), whether you have seen the welcome screen and the notice about how imanotes uses your Drive, when you last closed the beta notice, and the app's files and your notes list (folders and tags) for offline use. They stay until you clear this site's data in your browser. The start page, this policy and the terms set no cookies.

Retention and deletion

• Sessions end after 7 days without use, and after 90 days at most. Signing out ends your session immediately; an expired session cannot be used again and its record is removed the next time it is looked up, or when you delete your account.
• The index of your notes follows your notes: when you delete a card in imanotes its entry goes too.
• Published cards stay in their circle until you withdraw them, delete the note, leave the circle or are removed from it, the card is taken down, the circle is removed, or you delete your account. When the card server is full, the oldest published copies are removed first.
• Reports are kept until the reported card leaves its circle, or until you delete your account. When we decide to keep a card, its reports are closed but kept, so the card stays hidden from the people who reported it.
• Feedback is deleted once we have dealt with it, and in any case when you delete your account.
• Take-down notices (including a notice that a circle you were in was removed) are deleted once you have seen them.
• Circles are kept while anyone is in them. When you leave a circle your membership is deleted; when its creator leaves, the member who joined earliest becomes its creator; when the last person leaves, the circle and its requests are deleted. A request turned down is kept, so the circle's creator is not asked again by the same person within 7 days.
• Generation records, visit statistics and invitations are kept to run limits and to see how imanotes is used over time. When you delete your account they are detached from you (see below) and no longer identify you.
• Your notes and cards in Google Drive are your files. imanotes never deletes them permanently; you decide what happens to them.

Deleting your account. You can delete your account in the app, under your account settings, or from the web at imanotes.app/delete-account without installing anything. This immediately deletes the copies of your published cards (and any text published with them), the index of your notes, your display name, your circle memberships and requests to join (circles you created pass to their next member, or are deleted if nobody else is in them), your sessions on every device, any unread take-down notices, the reports you filed and the feedback you sent; detaches your generation records, visit statistics and invitation from your account; and hands back imanotes' access to your Google Drive. If any step does not go through, the app tells you which one. Write to us and we will finish it — in any case, all data we hold about you is gone within 30 days of your request.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Much of this you can do yourself: your notes are ordinary files in your Drive, and you can delete your account in the app at any time. For anything else, write to imanotes@proton.me; we will answer within one month.

You also have the right to complain to a data protection authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) — or to the authority where you live.

imanotes is not meant for children under 16.

Changes to this policy

If we change how imanotes uses your data, we will update this page and the date at the top. If a change matters for how your data is used, we will tell you in the app before it takes effect.

Contact

Jacek Skrzypczyński, Moszyce, 56-416, Poland — imanotes@proton.me