Privacy Policy

Last updated: October 12, 2026

This Privacy Policy describes how Notee ("Notee", "we", "us", or "our") collects, uses, protects, and discloses personal information when you use our website, services, and applications at notee.life (the "Service").

1. Personal Information We Collect

We collect only the minimum personal data required to provide and maintain our services:

• Account Information: Your email address, username, password hash (cryptographically hashed using standard one-way algorithms; we never see or store your plaintext password), registration timestamp, and optional genre/category preferences.
• User-Generated Content & Annotations: Playlist titles, descriptions, track-level and video-level notes, timestamps, tags, bookmarks, and sharing settings.
• Connected Third-Party Services (Spotify & YouTube):
  • When connecting Spotify: We access public playlist identifiers, titles, and track metadata to display playlists and allow you to attach commentary.
  • When connecting YouTube: We access public or user-selected playlist and video titles, descriptions, and thumbnails in compliance with YouTube API Services.
  • We do not store or access your third-party account credentials.
• Technical Context (Bug Reports & Security): When you submit a bug report, you may choose to attach relevant browser context (screen dimensions, URL, user agent) to assist our technical team in reproducing issues.

2. How We Use Your Information

We use collected data strictly for the following operational purposes:

• To create and manage your account and authenticate your sessions.
• To enable you to annotate Spotify and YouTube playlists and share them privately or publicly.
• To deliver transactional communications (email validation, password resets, and recipient share notifications).
• To detect, investigate, and prevent bot abuse, link-injection spam, and security vulnerabilities.

3. Security & Data Protection Mechanisms

We apply layered security safeguards designed to protect your data:

• Encryption at Rest: Your track and video annotations are encrypted in our database using authenticated symmetric Fernet encryption (AES-128-CBC + HMAC-SHA256).
• Encryption in Transit: All web communication is encrypted using Transport Layer Security (TLS/HTTPS).
• Session Security: Session cookies utilize HttpOnly, SameSite=Lax, and secure transmission flags.

4. Cookies & Tracking Technologies

Notee uses only strictly necessary, functional cookies required for user authentication, CSRF attack defense, and session persistence. We do not use third-party analytics trackers, marketing cookies, social media tracking pixels, or cross-site advertising networks. Under the EU ePrivacy Directive and GDPR, strictly necessary cookies do not require prior consent.

5. Sharing & Disclosure of Personal Data

We do not sell, rent, or trade your personal information. We disclose data only in the following limited circumstances:

• Service Providers: Trusted infrastructure partners essential to delivering the Service (cloud database hosting via Heroku Postgres/Amazon RDS, transactional email delivery via Office 365/Microsoft). All providers are bound by strict confidentiality and data protection agreements.
• Public Discovery: Notees you intentionally mark as Public are indexed in the community Explore feed and XML sitemap for discovery. Notees marked Private remain strictly unlisted and accessible only by direct link or recipient email.
• Legal Compliance: When required by applicable law, court order, or regulatory authority.

6. Your Rights Under GDPR & UK Data Protection Laws

If you are an individual residing in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have comprehensive rights under the General Data Protection Regulation (GDPR):

• Right of Access (Art. 15): You have the right to view all personal information we hold about you directly from your dashboard and profile.
• Right to Rectification (Art. 16): You can update your password, username, email, and preferences at any time in your profile settings.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You have the absolute right to delete your account. You can trigger permanent, automated cascade deletion at any time in your profile settings (Delete My Account). This permanently erases your account, personal Notees, annotations, bookmarks, follows, and shares from our operational database.
• Right to Data Portability (Art. 20): You can export and download a complete, machine-readable archive (.zip) containing all your account data, personal Notees, and annotations in Markdown and JSON formats directly via the Data Portability button on your profile.
• Right to Restriction of Processing & Right to Object (Art. 18 & 21): You can toggle any public Notee to private at any time, instantly removing it from public feeds and search indexing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

7. YouTube API Services & Google Privacy

Notee's YouTube features use YouTube API Services. By using YouTube integration features, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can manage or revoke Notee's access to your YouTube data at any time via the Google Security Settings page.

8. Data Retention & Backups

We retain your personal data only for as long as your account remains active. When you delete your account, operational data is immediately purged. Encrypted disaster recovery database backups are retained on a rolling 30-day rotation schedule for business continuity and disaster recovery.

9. Data Controller & Contact Information

The Data Controller responsible for your personal data is Notee. If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or have general inquiries, please contact our privacy team at:

Email: support@notee.life
Website: Contact Us Form