Your notebook starts in your browser
No NoteTisa account is required for ordinary note-taking. Notes, original attachments, recordings, annotations and note history are stored in this browser’s IndexedDB. Local preferences, provider configuration and device information also use browser storage. A service worker caches workspace files for offline use.
The normal local notebook does not upload itself to a NoteTisa notes database. A different browser, profile or device has separate storage. Browser saving and sync are not independent backups.
When information leaves this device
| When | Information and destination |
|---|---|
| Visiting the website | The hosting service receives network requests, including IP and browser/request information. Hosting analytics can measure page views, referrers, country and device information. This is separate from storing your notebook. |
| Cloud sync you configure | Notebook packages go to your chosen Google Drive, Dropbox or OneDrive account. Sign-in also contacts that provider. Availability depends on provider setup and permissions. |
| Live collaboration you enable | Shared document updates go to the shared folder and/or connected peers. Shared-folder Google access uses broader Drive permission than ordinary hidden-app-folder sync. Optional WebRTC/STUN can expose connection and IP information to peers or the configured network service. |
| Optional text/image AI | Selected content and your provider key go directly from the browser to Anthropic when you request that action. Provider usage charges and policies apply. |
| Optional audio transcription | The recording and your OpenAI key go directly to OpenAI when you request transcription. This is separate from local recording and playback. |
| Local OCR and PDF viewing | The app loads optional engine/model files and processes the selected source on this device. This local OCR route does not send the source to an AI provider. Optional asset downloads still make network requests. |
| Publishing and sharing | Selected content goes to the destination you choose. WordPress.com publishing, when configured, uses a NoteTisa server bridge. Self-hosted WordPress sends directly from your browser. Medium/Substack use copy-and-open-editor handoff. Email and social sharing can put selected text in an external service’s compose URL. |
| External links or content | Opening an external link, or loading externally hosted content where supported, contacts its host. Imported clipping packages do not automatically fetch the source page or remote images. |
Core notebook functions do not require an AI key. Local OCR, manual transcripts and normal recording/playback do not require external AI. Downloaded assets may be cached; offline availability depends on completed downloads and browser storage.
NoteTisa Companion — Chrome extension Privacy Policy
Last updated: 9 November 2026. This section applies to the optional NoteTisa Companion Chrome extension. You can use NoteTisa without installing or pairing it.
NoteTisa Companion handles user-created notes, selected website content, page URLs and titles, connection credentials, and limited tab-activity information to provide its disclosed features. Much of this information is stored locally in the browser. Content is transferred to the paired NoteTisa app or external destinations as needed for features the user enables or requests. NoteTisa Companion does not sell user data, use it for unrelated advertising or profiling, or use it to determine creditworthiness or for lending.
Information handled and why
- Notes and website content: quick-note drafts, selected text, article content, links, images, screenshots, tables, highlights and snippets support capture, reading and research. Captures and notes may contain personal information or communications you choose to include.
- Page URLs and titles: identify sources, support open-tab collection and locate your configured NoteTisa workspace. The extension does not read Chrome’s complete historical browsing database.
- Connection credentials: the pairing code authenticates communication with your NoteTisa workspace. Optional publishing connections use the usernames, API keys, tokens or application passwords you supply; connection checks may return account/profile names.
- Limited tab activity: tab activation times are held in session storage to support inactive-tab sleeping. This is not general keystroke logging, mouse tracking or advertising analytics.
Local storage, transfers and security limits
Extension preferences, pairing configuration, queued captures, drafts, highlights, snippets and reader settings use the extension’s browser storage. Temporary connection state and authorized notebook information use session storage. Extension storage is separate from notebook storage and is not protected by your NoteTisa notebook password. Locally stored drafts, queued content and connection credentials are not generally encrypted by the extension; protect your device and browser profile.
Pairing is separate from permission to share notebook information. Review the access choices in NoteTisa before enabling them. Captures sent to NoteTisa require review and saving in the app; delivery alone is not proof of saving. Optional publishing, email, sharing and other external actions send selected content to the destination you choose. Those services apply their own privacy and retention terms and can receive network information such as your IP address. Visiting the NoteTisa website is also subject to the hosting disclosures on this page.
NoteTisa Companion’s use and transfer of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Information is used to provide the disclosed functionality, not sold or transferred for unrelated purposes.
Your choices, retention and deletion
Grant website access only where needed. You can remove site permissions in Chrome, disconnect optional destinations, forget the pairing code in the extension, and revoke the Companion connection in NoteTisa. Revoking a connection does not automatically erase previously stored extension content.
Local drafts and other persistent extension records remain until you remove them, clear extension data or uninstall the extension, subject to browser storage behavior. Queued captures remain until acknowledged as saved by NoteTisa or removed by you. Temporary session records are cleared when the browser session ends or the connection is reset, as applicable. Use the extension’s queue, backup/export and data controls before deleting anything you need. Browser storage is not a backup.
Deleting extension data does not delete notes already saved in NoteTisa, exported files, shared links or copies held by recipients and external services. Remove those copies separately where possible. For privacy questions or requests, contact amani_9@hotmail.com. Review this section when the extension changes; the date above identifies this policy update.
Keys, sign-in tokens and cookies
Text/image AI and transcription keys are kept in the active tab’s memory, not saved in notebook backups. Reloading, disabling the feature or locking the notebook clears those session keys.
Cloud-provider access tokens and, where supported, refresh tokens are stored separately in this browser’s key/value store so reconnecting is possible. They are not covered by notebook password encryption. Disconnect a provider and revoke its grant in that provider’s account settings when needed.
Configured WordPress.com publishing uses a secure, HTTP-only, SameSite=Lax session cookie limited to its API path. Its authorization token and request receipts are held in server memory, not a notes database. The publishing session expires after at most 30 minutes; expired entries are removed on a later cleanup request, disconnection or process restart. Provider copies and hosting records are separate.
Hosting analytics and technical records
The published site uses Replit hosting. Its analytics can collect traffic and browser information; a hosting-provided analytics script was observed in the published HTML during review. Local-first does not mean that visiting the site makes no external requests.
The application API logger records request method, URL path without its query, status and timing; it does not intentionally log note request bodies. Authorization and cookie headers are redacted in its logger configuration. The hosting platform and external providers have their own records and retention practices. A universal deletion deadline or a zero-tracking guarantee is not offered here.
Read Replit’s analytics documentation and Replit’s privacy notice for hosting context. Provider policies, configurations and laws can change.
Your choices
- Use the local notebook without setting up sync, AI, publishing or team sharing.
- Review the content and destination before every external action.
- Use a password and a trusted browser/device; read the encryption limits on the Security page.
- Export a backup before deleting data, restoring a notebook or changing browsers.
- Remove provider copies, published posts and downloaded files separately where necessary.
See Data ownership, backups and deletion for practical steps and Help and contact information for the currently published contact status.