隐私政策

This policy explains how the operator of Notekrub ("we" or "us"), as the data controller of the Notekrub website and app, collects, uses, discloses and looks after your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

This policy is separate from the terms of use. Signing up for or using the service does not mean you consent to any use beyond what is described here. The one thing you are asked to choose is usage statistics, in the cookie section of the terms of use, where the accept and decline buttons are equally prominent. Until you choose, statistics run on the legitimate-interest basis described there, and a remembered browser is linked to your account once you sign in.

1. Data controller and contact

• Operator: the operator of Notekrub
• The site operator has not published contact details yet.

For anything about your personal data, including the rights in section 7, contact us through the channels above.

2. Data we collect

Your account

• Display name, e-mail address and/or mobile number, verification status, chosen language, role and notification settings.
• Passwords are stored with one-way hashing, so nobody can read the real password. One-time codes and verification links are also kept only in transformed form.
• In records such as the delivery history and the audit log, e-mail addresses and phone numbers are partly masked, for example qa***@example.com and +668*****678.

Your content

• Notes, notebooks, tags, tasks and reminder times, attachments, saved searches and the revision history with the name of each editor.
• This content is private. Only you and the people you share it with (members you invite, or anyone holding a public link you created) can reach it. Administrators do not open it except under the conditions in section 4 of the terms of use.
• Sharing: invitation recipients, roles, how many times a shared link was opened and, for the owner of the link, each opening: when, how long the page stayed open, the note read and the link password used (if any). Viewers who are signed in appear by account name; anyone else appears as a short code made from a random browser cookie. The viewer's IP address and browser type are not kept, and a browser that refused statistics is not remembered. Link passwords are stored only as one-way hashes.
• Link previews and videos: when you paste a link on its own into a note, our server opens that page once to read its title, description and preview picture for a card. The site sees our server, not you. Preview data is kept apart from accounts, shared by every account and fetched again after 7 days. A YouTube or Vimeo video loads that provider's player only when you press play; from then on the provider sees your IP address and may set its own cookies under its policy.
• We do not ask for sensitive data such as health, religion or biometric data. If you write such data in a note yourself, we store it only to show it to you and the people you share it with.

Sign-in, devices and security

• Sign-in sessions: IP address and browser type while the session is active.
• Synced devices and app or Web Clipper tokens: device name, platform and last use.
• Personal API tokens you issue to outside programs (such as an AI assistant over the API or MCP): the name you gave, the permissions, the expiry and the last use (the token itself is not kept, only its hash), and every call made with it is in the audit log.
• Requests for an OTP or a verification link: the masked recipient, time, delivery result and the requesting IP address, to prevent repeated requests and attacks (the code itself is not kept).
• Audit log: who did what, when and to which item, for example sharing, invitations, restores, deletions or password changes, recorded with item ids, field names, the titles or names you gave those items and the search terms you saved, the network part of your IP address (never the full address) and the browser type. Note content is never recorded. This log cannot be edited or deleted, by us included.
• Web server logs (computer traffic data such as IP address, time and the page requested).

Notifications

• E-mail and SMS delivery history: masked recipient, template, time, status and the text of SMS messages sent, such as task reminders.
• Push registrations: the endpoint address issued by your browser's push service and the browser type.
• In-app notifications.

Usage statistics

We collect statistics per person and per session in our own system, with no third-party analytics or advertising service.

• Remembered browsers: a random id for the browser in the notekrub_vid cookie.
• For each visit: pages opened and their order, time on each page, scrolling, the names of buttons or links pressed, starting and sending forms (for errors only the field names), page errors, the referring site and campaign (such as utm tags), device, browser and operating system groups, screen size, browser language, time zone and an approximate country derived from the time zone.
• Key account events, such as completing verification, creating a first note, setting a reminder, sharing, finishing an import and coming back within 7 days of signing up.
• When you sign in on a remembered browser, that browser's statistics are linked to your account.
• Not recorded: IP addresses (a browser that is not remembered gets a daily code calculated from its IP address, browser and language without storing the IP, and the key used for it is deleted within 2 days), anything you type, note titles and content, and the full user agent.

Data kept on your device

The app keeps a copy of synced data, edits waiting to be sent and your choices such as the theme in your browser so it works offline. That data stays on your device and can be removed by clearing this site's data in your browser.

3. Purposes and legal bases

We do not sell personal data, do not use it for advertising and do not pass it to advertising networks. Account data is needed to provide the service; without it we cannot open an account for you.

4. Disclosure and data processors

• People you share with see what you share, your display name and the names of editors in the history.
• Outside programs you connect yourself (such as an AI assistant you gave an API or MCP token of your account) see and change only what that token's permissions allow; you can revoke a token at any time under Account settings › API and MCP, and you must guard it like a password.
• The administrators' tools, including an AI assistant an administrator connects through the admin API, reach account data, statistics, settings and the audit log to run the service, but never the content of your notes and files; every call is logged.
• Video providers (YouTube, Vimeo) receive a request from your browser only when you press play on a video in a note or a shared page, and process it under their own policies. Nothing is sent to them before you press play.
• Data processors acting for us, who must follow our instructions and keep the data secure under section 40: the server and database provider hosting the system, the e-mail (SMTP) provider, the SMS provider for OTPs and task reminders, and the push service of your browser's maker (such as Google, Mozilla, Apple or Microsoft), which receives only the notification text and the endpoint.
• Government authorities or courts when the law requires it or under a lawful order.
• A buyer of the business in a merger or transfer, who must protect the data at least as well as this policy.

Transfers abroad: browser push services, video providers when you press play, and some providers may process data outside Thailand. We send only what is needed to provide a service you asked for, such as notifications you turned on, or send it to providers with appropriate safeguards, in line with sections 28 and 29.

5. How long we keep data

This system keeps its history so work can be restored and checked later, so the periods are:

• Account and content: for as long as the account is open. Deleted notes and files stay in the trash, can be restored and still count against your storage. When you press "delete permanently" or "empty all", or the trash is emptied automatically after the number of days you or an administrator set, the item leaves your account and no longer counts, but the system keeps it under its no-deletion principle and an administrator can restore it at your request. Permanently deleted data is erased from the system only when an administrator has set a retention period (the default is to keep it). When an account is closed on request, we act as described in section 7.
• Note revisions: the latest versions per note, up to the number the system is set to keep.
• Audit log, delivery history and OTP request records: kept permanently, with recipients partly masked; the audit log keeps only the network part of IP addresses, the OTP request records keep the full address. The audit log also keeps the name or title of items that were deleted permanently or erased, for later review, but not their content.
• Sign-in sessions: no longer than the session lifetime, or until you sign out.
• Usage statistics: kept permanently to see trends, without names, e-mail addresses, phone numbers or IP addresses. A remembered browser's visits are linked to your account id so usage can be seen per person; declining statistics unlinks them. The random-id cookie lasts as shown in the cookie section and daily keys are deleted within 2 days.
• Web server logs: at least 90 days as required by section 26 of the Computer-Related Crime Act, and longer if an authority orders it.
• System backups: used only to restore the system after a problem. If we ever restore from a backup holding data from before an anonymisation under section 7, we anonymise that data again.

6. Security

• Connections use HTTPS, passwords are hashed and system secrets are stored encrypted.
• Access is limited by role: only assigned administrators can reach the back office, and every important change is recorded in the audit log.
• Sign-in attempts and OTP requests are rate-limited to stop guessing.
• If a personal data breach happens, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, unless it is unlikely to affect anyone's rights and freedoms, and if the risk is high we will tell you without delay along with the remedies (section 37(4)).

7. Your rights

Erasure requests: this system keeps a permanent history, so instead of deleting we close the account and anonymise your personal data: sign-in is stopped, shared links and invitations are revoked, your name, e-mail address and mobile number in the account are replaced with values that cannot identify you, and statistics are unlinked from the account. If you also want note content deleted or anonymised, say so in your request. Data that the law requires us to keep, or that is needed to establish, exercise or defend legal claims, is kept only as long as necessary (section 33, second paragraph).

Making a request: contact us through the channels in section 1. We may ask for information to confirm that you own the account, and we will act without delay and within 30 days of receiving the request. If we refuse a request, we will tell you why.

8. Cookies

The list of cookies, their purposes and lifetimes, and the buttons to accept or decline statistics are in the cookies and usage statistics section of the terms of use. This site has no cookie banner, no advertising cookies and no cross-site tracking cookies.

9. Minors

If you are under 20, you need the consent of your legal representative before you sign up (Civil and Commercial Code section 21), and where the PDPA requires consent, a person aged 10 or under needs the holder of parental authority to give it (section 20). If we learn that data was collected without a required consent, we will close the account and handle the data as described in section 7.

10. Changes to this policy

We may update this policy to match the service or the law. The "Last updated" date above shows the current version. For an important change, such as collecting a new kind of data or using it for a new purpose, we will tell you in advance by e-mail, an in-app notification or a notice on the site, and ask for consent again where the law requires.