Privacy Policy

1. Introduction

Welcome to Petal. Petal is an AI-integrated note-taking application that helps you capture, organize, and gain insights from your personal notes across all your devices.

We respect and value your privacy. We understand that the notes you write are personal, and we are committed to being transparent about what information we collect, how we use it, and the choices you have. This Privacy Policy explains our practices in plain language, so you can make informed decisions about how you use Petal.

By creating an account or using Petal, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect only the information needed to provide and improve Petal. This falls into three categories:

Account Information. When you create an account, we collect your email address and the authentication data needed to securely sign you in. Authentication is handled through Supabase, our backend and identity provider. If you sign in using a third-party login method, we receive basic profile information from that provider as permitted by your settings there.

User Content. This is the heart of Petal — the notes, text, and any other content you create or upload. We store this content so it is available to you whenever and wherever you sign in. Your notes belong to you.

Attachments. You can attach images and PDFs to a note. These files are stored securely on our servers and are private to your account. PDFs are read on your own device to help categorize the note — the file itself is never sent to any third-party AI provider, and images are never analyzed at all. When you delete a note, its attachments are kept so the note can be restored, then permanently purged from our servers 15 days later.

Usage Data and Device Preferences. To keep your experience consistent across devices, we store preferences such as your interface theme (for example, dark mode or light mode) and other settings. To deliver this, Petal uses browser Local Storage (and/or cookies) on your device to save these preferences — such as your selected UI theme — so they persist between sessions and load instantly. We may also collect limited technical and usage information — such as device type, browser, and basic interaction logs — to operate the service, diagnose problems, and improve performance.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the service — create your account, store your notes, and keep Petal running reliably.
• Sync across your devices — so your notes and preferences (like your chosen theme) are available wherever you sign in.
• Power AI features — process your notes and queries to generate insights, formatting suggestions, summaries, and search capabilities, which are core to how Petal works.
• Communicate with you — send essential account-related messages, such as sign-in verification or important service updates.
• Protect Petal and our users — detect, prevent, and address security issues, abuse, or technical problems.

We do not sell your personal information or your notes to third parties.

4. Third-Party Services & Data Sharing

To deliver Petal, we rely on a small number of trusted third-party providers. We share only what is necessary for them to perform their function.

Hosting, Database & Authentication (Supabase). We use Supabase to securely host your data, manage our database, and handle authentication. Your account information and notes are stored within Supabase's infrastructure, subject to their security practices and applicable data protection safeguards.

AI Processing. Because Petal is AI-integrated, providing certain features requires sending your input — including the content of your notes and any queries you make — to OpenAI, our sole third-party AI provider. This processing happens only to deliver the app's core functionality, such as generating insights, formatting, summaries, or search vectors.

We want to be clear about how this data is handled:

• Your notes are transmitted to OpenAI solely to generate a response back to you, not for any unrelated purpose.
• Under our vendor agreement with OpenAI, your data is not used to train their models and is retained only briefly for abuse monitoring before deletion.
• We encourage you to review OpenAI's privacy practices for details on their handling of data submitted through their API.

Other Service Providers. We may use additional providers for functions such as hosting infrastructure, analytics, or error monitoring. Where we do, they are bound by obligations to protect your information and use it only as instructed.

Legal Requirements. We may disclose information if required to do so by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights, or ensure the safety of our users.

5. Data Security

We take the security of your data seriously and apply standard industry practices to protect it. This includes:

• Encryption in transit — data exchanged between your device, our servers, and our service providers is protected using encryption (such as TLS/HTTPS).
• Encryption at rest — your stored data is protected within our hosting provider's secured infrastructure.
• Access controls — we limit access to personal data to those who need it to operate and support the service.

While no method of transmission or storage is ever completely secure, we work continuously to safeguard your information and to address vulnerabilities responsibly.

6. Your Rights and Choices

You remain in control of your data. You have the right to:

• Access the personal information we hold about you.
• Export your notes and content in a portable format.
• Correct inaccurate account information.
• Delete specific notes, or your entire account along with the associated data.

You can manage much of this directly within the app's settings. To delete your account or make a specific request, you can do so in-app where available, or contact us at the email below. We will respond to verified requests within the timeframe required by applicable law. When you delete your account, we will remove your content from our active systems promptly, and we will purge it from our encrypted backups within 30 days.

7. Children's Privacy

Petal is not intended for children under the age of 13, and we do not knowingly collect personal data from anyone under 13. If you are under 13, please do not create an account or use the service.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at the email below. If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete that information promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you — for example, by posting the updated policy within the app or sending you an email — and we will update the "Last Updated" date at the top of this document. We encourage you to review this policy periodically. Your continued use of Petal after an update takes effect means you accept the revised policy.

9. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

support@petal-notes.com