Privacy Policy

NotesGraph · Last updated 29 September 2026

NotesGraph is a note-taking and planning application. This policy describes what data the hosted service at app.notesgraph.com stores, why, and how to remove it. It covers the optional Google Calendar integration in detail, because that involves data from your Google Account.

Data the service stores

Account	Your email address, display name, and authentication credentials. Used to sign you in and to identify your workspaces.
Content	The notes, documents and attachments you create, and the workspaces they belong to. Stored so the service can show them back to you and sync them between your devices.
Operational	Server logs and error reports produced while running the service.

Google Calendar integration

Connecting a Google account is entirely optional. NotesGraph works fully without it, and nothing below applies unless you choose to connect one.

What we ask for, and why

calendar.calendarlist.readonly	List your calendars, so you can pick in settings which ones to show. Read-only.
calendar.events.readonly	Read the events of the calendars you picked, so the day's events can be shown on the matching journal page. Read-only: this permission cannot create, change or delete anything in your Google Calendar.
userinfo.email	Label the connected account so you can tell several apart, and reconnect the right one when a token expires.
userinfo.profile	Show the account's display name next to its calendars in settings.

What is stored, and where

• Connection details — the provider, an account identifier, the account's email and display name, and the granted scopes.
• OAuth tokens — access and refresh tokens, encrypted at rest, used to fetch events without asking you to sign in repeatedly.
• Events from the calendars you subscribe to — title, description, location, start and end times, timezone and all-day flag. Only calendars you explicitly tick in settings are read.

All of it is held in the service's own PostgreSQL database on servers we operate. Google Calendar data is used solely to display your schedule to you inside your own workspace.

What we never do with it

• We do not sell it, rent it, or share it with third parties.
• We do not use it for advertising, or to build advertising profiles.
• We do not use it to train machine-learning or AI models.
• We do not let humans read it, except where you explicitly ask for support and give permission, or where the law requires it.

NotesGraph's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Removing it

Disconnect the account in Settings → Account → Integrations. That deletes the stored connection, its tokens, and the calendar subscriptions and cached events belonging to it. You can also revoke NotesGraph's access at any time from your Google Account permissions page; once revoked, the integration stops fetching and the stored data can be removed by disconnecting as above.

Retention and deletion

Content is kept while your account exists. Deleting your account removes your workspaces, their content, and any connected calendar accounts and cached events. Backups are retained for a limited period for disaster recovery and age out on their own.

Self-hosting

NotesGraph can be self-hosted. If you use someone else's NotesGraph server, this policy does not apply to it — the operator of that server controls the data, and any Google integration there uses their own credentials, not ours.

Security

Traffic is served over HTTPS. OAuth tokens are encrypted at rest. Access to production systems is restricted. No service can promise perfect security, and we do not.

Changes

If this policy changes materially, the date at the top changes and, where the change affects how your data is used, we will say so in the app.

Contact

Questions, or requests to access or delete your data: notesgraph@gmail.com.