Privacy Policy

Version 3. Effective October 10, 2026.

Onyx Notes ("Onyx", "we", "us") is operated by Angel Valle, Nashville, Tennessee. This policy explains what we collect when you use onyxnotes.io and the Onyx Notes service, what we do with it, who processes it for us, how long we keep it, and the choices you have. We wrote it to be read. Questions go to onyxnotessupport@gmail.com.

The service is offered in the United States and your data is stored and processed there. If you use it from elsewhere, you agree to that.

1. What we collect

Account. Your first and last name, school, email address, and a hashed form of your password; we never store the password itself. When you sign up you confirm that you are 13 or older and accept our terms; we record the time of both.

Recordings and what we make from them.

Audio. When you record, audio streams from your browser through our server to our transcription provider and is transcribed as it arrives. We do not store audio. Not on disk, not in a database, not in a backup. When the recording ends, no audio exists in Onyx.
Transcripts. The text of what was said, stored with the lecture.
Notes, titles, study guides, resource explanations and answers. Text written by an AI model from the transcript, stored with the lecture.
My notes. Notes you type yourself during or after a lecture. They are never sent to an AI model.
Classes and lecture details. Class names, lecture titles, times and status.

Sharing. When you share a notebook, the email address of the person you share with, and the copies of finalized lectures delivered to them.

Slack, if you connect it. The incoming webhook address you paste, stored encrypted (we show only a masked form of it back to you), whether to include your My notes, which classes send automatically when a recording ends, your browser's time zone when you saved it (for the date in each message), and for each lecture the version and time of its last send.

Feedback. Anything you type into the in-app feedback form.

Usage records. For each AI request we make on your behalf: your account id, the purpose (notes, title, study guide, resources, answer), the number of tokens and the cost. We use these to run the service, to enforce fair-use limits and, when paid plans exist, to bill.

Product usage events. A count of seven things you do in the app: viewing notes during a live lecture, reopening notes after class, opening a study guide, seeing or using the share prompt, viewing an upgrade prompt, exporting or copying a lecture, and sending a lecture to Slack. Each event is stored in our own database with your account id, the lecture's id when there is one, the time, and a short label: which app layout you used, the hours since the lecture, whether the study guide was new, which share action or plan moment, which export you used, and whether a Slack send was automatic or manual. It holds no lecture content, no URLs and no browser or device details, and no third-party script collects it. We keep these for 24 months, and they are included in your account export.

Technical data. Your IP address, used in memory to limit sign-up, sign-in and password-reset attempts. Our application does not log IP addresses. Our hosting provider keeps standard request logs that include IP addresses for a short period, which we use only to investigate abuse or faults. We run no third-party analytics, advertising or tracking scripts, and no device fingerprinting. The only product measurement is the first-party usage events above.

Cookies and browser storage. Section 6.

We do not collect precise location, contacts, photos, payment card numbers (there is no billing today) or any sensitive category of personal information. If an AI-written note happens to contain something sensitive because a lecturer said it, it is part of your lecture content and is handled as such.

2. What we use it for

To record, transcribe and write notes for your lectures, and to let you read, edit, study from and share them.
To sign you in and keep your account secure.
To send the emails the service needs: email verification, password reset, and the confirmation with a cancel link when you ask to delete your account. We do not send marketing email.
To enforce limits that keep the service fair and affordable.
To answer your feedback and support requests.
To learn which features help, from the product usage events in section 1.
To bill you, once paid plans exist and you choose one.
To comply with the law and protect the rights and safety of users and the public.

We do not sell your personal information. We do not share it for advertising. We do not use your recordings, transcripts or notes to train AI models, and we have opted out of model training with the providers that process them (section 4).

3. Who processes data for us

We use a small number of providers under written terms. Each receives only what its job needs.

Deepgram, Inc. What it does for us: speech-to-text. What it receives: streamed audio while you record, plus a short list of class-specific terms. Model training: opted out of Deepgram's model improvement program on every stream; audio is kept only as long as needed to transcribe it.
Anthropic, PBC. What it does for us: writes notes, titles, study guides, resource explanations and answers; searches the public web for resources. What it receives: transcript text, the current notes, the term or question you highlighted. Model training: Anthropic's commercial API terms do not permit training on customer inputs or outputs.
Supabase, Inc. What it does for us: database hosting (United States). What it receives: everything in section 1 except audio. Model training: not applicable.
Railway Corp. What it does for us: hosts our server (United States). What it receives: data in transit. Model training: not applicable.
Vercel, Inc. What it does for us: hosts the website. What it receives: page requests. Model training: not applicable.
Resend. What it does for us: sends verification, password-reset and account-deletion emails. What it receives: your email address and the email text. Model training: not applicable.

Slack is a destination you choose, not a provider we use. If you connect Slack, we post the lectures you choose to send, and for each class you turn on, each lecture once when its recording ends, to the incoming webhook you gave us. What reaches Slack is governed by your workspace's Slack terms and settings, not by this policy. Remove the webhook in the app at any time and nothing more is sent.

We may change providers. We will update this list and the trust page before a change takes effect, and we will not move your data to a provider whose terms allow training on it.

We do not otherwise disclose personal information, except: to comply with a valid legal demand (we tell you when the law allows); to protect users, the public or our rights; or to a successor if Onyx is acquired, in which case this policy continues to apply until you are told otherwise.

4. Sharing with other people

Sharing in Onyx is a copy, not a window. When you share a notebook with someone, they receive their own copy of each finalized lecture, which they can edit and keep. You cannot take back a copy that has been delivered; you can stop future deliveries at any time. Your My notes are included only if you tick the box for that person. Shares reach only accounts with a confirmed email address. There are no public links.

5. How long we keep things

Your account and its content: while your account exists.
Audio: never stored.
Lectures you delete: hidden at once and kept for 30 days, then permanently deleted. During those 30 days you can ask us to restore a lecture, and a lecture shared with you that you hid can be restored yourself with Show hidden. Lectures deleted before October 8, 2026 are kept until November 7, 2026.
Your account after you ask to delete it: signed out everywhere at once; permanently deleted no sooner than 14 days later, when our daily deletion runs, including classes, lectures, transcripts, notes, study guides, My notes, share settings, Slack settings, feedback, usage records and product usage events. Copies already delivered to people you shared with are theirs and are not deleted.
Verification links: 48 hours.
Password reset links: 1 hour.
Usage records: 24 months, for billing and abuse control.
Product usage events: 24 months.
Slack settings: until you remove the webhook or delete your account.
Provider backups: our database provider may keep backup copies for up to 7 days; deleted data can remain in those backups until they expire.

6. Cookies and browser storage

onyx_session. Kind: cookie; HttpOnly, Secure. Purpose: keeps you signed in. Lifetime: 30 days, renewed as you use the service.
onyx_dev. Kind: cookie; HttpOnly, Secure. Purpose: recognises a browser you have signed in from, so our sign-in abuse protection does not slow you down. Lifetime: 30 days.
Browser local storage. Kind: not a cookie. Purpose: your theme and interface preferences, a marker for an unfinished recording, and that you have read the recording notice. Lifetime: until you clear it.

Both cookies are strictly necessary for the service. We set no other cookies: none for analytics, advertising or third parties. We run no third-party analytics, advertising or tracking scripts; the only product measurement is the first-party usage events in section 1. We do not track you across sites, so there is nothing for a "Do Not Track" or Global Privacy Control signal to turn off; we honour the intent of both by design.

7. Your choices and rights

Anyone can do the following, from the app, without asking us:

See and export. Export everything in your account as one file from the account menu.
Correct. Notes and transcripts are editable at any time.
Delete. Delete a lecture, or your whole account, from the app.
Stop sharing. Revoke a share to stop future deliveries.

You can also email onyxnotessupport@gmail.com with any request about your personal information, including to access, correct, delete or receive a copy of it, or to ask what we hold. We answer within 30 days and we do not treat you differently for asking.

California residents. You have the right to know what personal information we collect and how we use and disclose it (this policy), to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not use or disclose sensitive personal information for any purpose beyond providing the service. You may use an authorised agent; we will verify the request through your account email.

Residents of Tennessee and other states with privacy laws. The same rights apply to you on request, whether or not a statute requires it of a service our size.

Outside the United States. The service is designed for US users and your data is processed in the US. If you use it from elsewhere, you have the same rights on request.

8. Recording other people

You are responsible for having the right to record. Laws differ on whether everyone being recorded must agree. As commonly listed in 2026, states requiring all parties' consent to record a private conversation include California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington; this list can change and you should check the law where you are. Many schools and employers have their own rules about recording lectures and meetings. Our recording notice explains this before you start a recording on a device for the first time, and again every 90 days. We never record anything you do not start, and we never store the audio.

9. Children

Onyx is for people 13 and older. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has an account, email us and we will delete it promptly. Users aged 13 to 17 confirm at sign-up that a parent or guardian has permitted their use.

10. Security

Passwords are hashed with scrypt. Sessions are random tokens stored hashed. All traffic is encrypted in transit. Our server is the only thing that talks to our database and to our providers; your browser never holds a provider key. We limit sign-up, sign-in and reset attempts and we rotate device tokens on every sign-in. No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify you without unreasonable delay and as the law requires, by email to your account address.

11. Changes

We will post changes here with a new effective date and version. If a change reduces your rights or expands what we collect or share, we will tell you in the app or by email before it takes effect, and continued use after that date means you accept it.

12. Contact

Angel Valle, Nashville, Tennessee, onyxnotessupport@gmail.com