Privacy Notice

1. Information EpiNote processes

• Account data: name, username, organization name, email address, password hash, account status, and acceptance records.
• Your content: workspaces, Books, Notes, formatting, submitted source URLs, imported public-page evidence, attachments when supported, and content-derived AI results.
• Service and security data: session identifiers, expiry times, browser/user-agent information, privacy-preserving network hashes, request errors, and operational logs.
• Feedback: bug reports, feature requests, and context you deliberately submit.
• Browser data: an essential sign-in cookie plus local drafts and preferences stored on your device.

EpiNote does not store your plain-text password.

2. Why the information is used

Information is used to create and secure accounts, store and retrieve Notes, provide features you request, preserve drafts, operate and troubleshoot the service, prevent abuse, respond to feedback, and comply with legal obligations.

3. Note access and AI processing

EpiNote does not routinely inspect or have people read your Notes. A limited operator may access content only when you explicitly authorize it for support, when reasonably necessary to investigate or contain a security incident, or when disclosure is legally required. Access should be limited to what is necessary for that purpose.

Ordinary writing and saving do not require AI. When you explicitly request organization, summaries, concept extraction, Follow link, or another AI feature, EpiNote sends the relevant bounded content and instructions to its configured AI gateway and model provider. EpiNote requires a provider route that declares zero data retention and denies data collection. If no compatible route is available, the AI request fails instead of relaxing that requirement. EpiNote does not use Note content to train models. Provider processing may occur in another country and is subject to that provider's service terms. Do not submit sensitive information for AI processing.

4. Sharing

When you share a Note or Book, EpiNote shows the recipient your display name and source organization. The owner's access list shows the recipient's display name, username, and organization. Account email addresses are not exposed to other users through sharing. Shared content remains visible only to the authenticated recipient until access is revoked, although a recipient can copy information while it is visible.

Information may be processed by infrastructure providers needed to host the application, database, network, transactional email, and—only when requested—AI features. The email provider receives the destination address and limited account-service message needed for delivery; EpiNote does not put Note content in those messages. EpiNote may also disclose limited information when legally required or necessary to protect users and the service. EpiNote does not sell personal information and does not share it for behavioral advertising.

6. Retention and deletion

Account and active Note data are retained while the account is active. Deleted Notes may first be archived for recovery and operational records may be retained for security and troubleshooting. Expired sessions are deleted automatically. Derived AI snapshots may be retained until their source Book or account is removed. Recovery copies, when enabled, may take additional time to expire.

7. Security

EpiNote uses HTTPS, one-way password hashing, secure HTTP-only session cookies, scoped organization/workspace access checks, and restricted service credentials. Off-site recovery backups are encrypted before they leave the application server; the private recovery key is stored separately from that server. The live service is not end-to-end encrypted: the server must be able to process Note content to save, search, export, and run features you request. No internet service can guarantee absolute security, so do not use EpiNote as your only copy or as a vault for sensitive information.

8. Your choices and requests

You can edit and export Notes, delete individual Notes, choose whether to invoke AI, and sign out to end the current session. For access, correction, account deletion, or privacy questions, use Help → Feedback after signing in. Some requests may require identity verification and some records may need to be retained where law requires it.

9. Children

EpiNote is not intended for children under 18 and should not be used to collect children's personal information. If you believe a child's information was submitted, report it through the in-app Feedback feature.

10. Changes and questions

This notice will be updated when data practices materially change. The effective date and version appear at the top. Signed-in users can use Help → Feedback for privacy questions. Also read the Terms of Use.