Privacy Policy

Knowtarium is run by Magentix Studio UG (haftungsbeschränkt), Kaiserring 14-16, 68161 Mannheim, Germany. Full company details are on the Imprint page. Magentix Studio UG is the controller for the processing described here, except where this policy names another controller. For anything privacy-related, email support@knowtarium.com.

The short version: your notes are end-to-end encrypted on your device, so we store them but can't read them. We see what we need to run your account (your email, your plan, and the metadata listed below), never your content. There are no ads and no tracking cookies, and the website only counts visits anonymously.

When you create an account, we store:

• your email address, which we use to confirm the account, to sign you in and to send you account emails;
• a one-way hash of your login hash, never your password: your device derives the login hash from your password and sends only that, so the password itself never leaves your device;
• your account's public keys, and your private keys only in encrypted form, locked by your password and by your recovery key, neither of which we ever receive;
• a one-way hash of a value derived from your recovery key, to check a recovery;
• your sessions: an ID, when each was created, was last active and expires, and your browser's user-agent string (which names the browser and operating system), so you can see and end them in the app's settings. We don't store your IP address with a session;
• when your account was last active, in the web app or through an agent or command-line tool you connected, which we use only to apply the rule for inactive Free accounts (see How long we keep data);
• your app settings, not encrypted: your colour theme and your light, dark or system mode, and when you last changed them, so they follow you to every device. They're kept with your account until it's deleted or started over.

To stop password guessing and abuse, we count requests per IP address, email address, account or connected agent. The counters are stored under a keyed hash, not the address itself, and are removed after about a day.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); for the attempt counters, our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

Your notes are encrypted on your device before they are uploaded, with keys only you (and the agents you connect) hold. This covers note text, titles and file names, properties, tags and links, attachments and their names, comments, the records and summaries in your history, and the names of your workspaces, folders and agents. We store this data only in encrypted form and can't decrypt it.

What we can see

To store and sync your data, our servers see some information about it, though never its content:

• how much storage you use, and the size of each encrypted item;
• IDs for your workspaces, folders, notes and attachments, and how they nest;
• version numbers and timestamps: when things were created and changed;
• public keys and digital signatures, which show which person or connected agent made a change, but not what it changed;
• which kind of change each was (an edit, a deletion, an approval or a rejection), and which connected agent posted a proposal, comment or check;
• whether each agent's check was applied or dismissed;
• which notes (by ID) each of your browsers and agents fetches, and when, as the request arrives;
• counts, such as how many comments, checks, pending changes and attachment chunks there are, and which generation of a workspace's keys each item uses;
• your agent settings: which folders let agents write directly and which ask you first (by folder ID), and when you changed them;
• which notes are your instructions for agents (by note ID), in a list you signed, and when you changed it;
• how long each workspace keeps its history (the period you chose), and when each old version's content was removed;
• a history of changes to your folders: who made each and when, and where a folder moved (by folder ID), with its encrypted name before and after; and which folder is a workspace's root (by ID);
• for each connected agent: its access level (read or read-write) and its permissions, with each version of them you signed, and when it was connected and last used;
• your IP address, which reaches our servers with each request. It's used to answer the request, and the sync API doesn't log it.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

You can connect AI agents (for example a coding assistant) to a workspace. An agent receives its own access token and keys, stored encrypted on your computer. We store a hash of the token, the agent's encrypted name, its access level, the IDs of the folders it may access, its permissions (what it may do beyond editing, such as deleting notes) with each version of them you signed, its signing public key with your signature, and when it was created, last used and revoked. We see that an agent made a request or a change, and which items (by ID), but not their content.

The agent decrypts what it reads on your computer and passes it to its AI model. The provider of that model (for example Anthropic or OpenAI) then receives that content, under its own terms and privacy policy. That provider is not our processor; you choose it, and its processing is outside our control. Knowtarium runs no AI models and never sends your data to one on its own.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

The Knowtarium Web Clipper (for Chrome; a version for Edge is coming) saves the page you're on to a workspace's inbox. It asks your browser only for the current tab's link and title, and only when you click its button or press its shortcut, and for storage of its own. It never reads a page's text, your selection, other tabs or your browsing history, and it has no analytics.

Each page you save (its link and title, and the note and category you add) is encrypted in the extension before it leaves your browser, so that only your workspace can open it. We queue it but can't read it; your web app, or a connected agent that can write to the inbox, opens it and files it as a note, and we then delete the queued copy. The extension holds no key that reads your notes, not even the pages it saved.

When you connect the extension, we store a hash of its access token, its encrypted name, its signing public key with your signature, the workspace it saves to (by ID), and when it was connected, last used, last saved a page and disconnected. For each page waiting in the queue we see its encrypted size, when it arrived and which extension sent it. For the workspace, we store which folder is its inbox (by ID) and the inbox's public key, with your signature. Your IP address reaches our servers with each request, as described above.

On your device, the extension keeps its keys and access token, your account and workspace IDs, your workspace's name and inbox category names, and pages waiting to be sent (at most 100) in the browser's storage for extensions. Disconnecting it from its popup, or removing it from your browser, clears them. If you disconnect it from Knowtarium instead, the pages waiting to be sent stay in the extension: connecting it again to the same workspace sends them, and connecting it to a different workspace discards them (the extension warns you first).

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We don't sell it, use it for advertising or transfer it to anyone, except as this policy describes.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

The Free plan involves no payment data. The Starter and Pro plans are sold by Polar Software, Inc. (Polar), USA, as merchant of record. Polar runs the checkout and handles your payment details, billing address, invoices and tax as an independent controller, under Polar's privacy policy. Polar uses Stripe to process card payments. We never see your card details.

When you upgrade, we give Polar your account ID and your email address (to prefill the checkout). Polar sends us your customer ID, the plan and billing period you bought, the status of your subscription (for example active, cancelled or past due, when it started, the paid period, and any change of plan scheduled for your next renewal) and your payments (the amount paid and the amount before tax, the amount refunded, currency, date and status, and why a payment was charged: a renewal or a plan change). Polar's notifications also include the billing details it holds, such as your name and billing address; we don't store those, though we can see them in Polar's dashboard. We store the rest with your account to apply your plan, to change it when you ask, and to work out refunds, and we open Polar's customer portal for you when you manage your billing.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal bookkeeping obligations (Art. 6(1)(c) GDPR).

We send emails your account needs: the link to confirm your email address, the link to start over if you lose both your password and your recovery key, and notices about your account and these policies (such as a change to the Free plan's limits, or the reminders 30 and 7 days before we delete an inactive Free account). Receipts and billing emails for Starter and Pro come from Polar. We don't send newsletters or marketing emails.

Our emails are delivered by Resend as our processor; Resend receives your email address and the email's content.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

The website (knowtarium.com) and the web app (app.knowtarium.com) are hosted by Vercel. To deliver pages and protect them from attacks, Vercel processes your IP address and technical request data such as the browser type, in short-lived server logs. The web app's pages contain no analytics and no third-party scripts.

Visit statistics on the website

On knowtarium.com we count visits with Vercel Web Analytics to see which pages people read and where they came from. It uses no cookies, does no cross-site tracking and builds no profiles. For each page view it records the page, the referring site and any campaign tags in the link, your country and region, your browser, operating system and device type, and the time. Visitors are told apart by a hash of the request that is discarded after 24 hours, so a visit can't be tied to you, your IP address or your activity on other websites. We only see aggregated numbers.

There is no advertising and there are no third-party trackers. Fonts are served from our own domain, so loading a page doesn't contact Google or any other font service.

Legal basis: our legitimate interest in delivering a secure website and app and understanding, in aggregate, how the website is used (Art. 6(1)(f) GDPR).

The website stores these items on your device:

The web app stores these on your device:

Your keys and decrypted notes are kept only in the app's memory, never in any of these. The web app's items are needed for features you use (§ 25(2) TDDDG). The checkout runs on Polar's own pages, which may set cookies needed to process the payment; Polar's policy covers them.

We don't sell, rent or share your data with advertisers or data brokers. These providers process data on our behalf:

• Cloudflare (USA): runs the sync API and stores your account data and your encrypted notes (Cloudflare Workers, Durable Objects, R2 and D1), in Cloudflare's EU jurisdiction, so the stored data stays in the EU; the sync API's short logs are kept by Cloudflare's logging, outside that setting
• Vercel (USA): hosting of the website and the web app, and anonymous visit statistics on the website
• Resend (USA): delivery of account emails

Polar (USA) is not our processor: as merchant of record it sells Starter and Pro to you and is the controller for the checkout and payment data.

Where a provider is outside the EU/EEA, transfers rest on an adequacy decision (the EU-US Data Privacy Framework, where the provider is certified) or on the EU Standard Contractual Clauses. Your notes reach these providers only in encrypted form.

• Your account and encrypted data: for as long as your account exists, except your notes' older versions, below.
• Your notes' history: each workspace keeps it for the period its owner chooses, from 1 day to 1 year (30 days unless changed). Once a version has been replaced by a newer one for longer than that period, a daily cleanup deletes its encrypted content, and if a workspace's owner shortens the period, the content of versions past the new period is deleted right away; the version's entry in the history (its date, author, size and signature) stays. A version still needed for something open, such as the version a pending change was proposed against, is kept until it isn't. A note you delete follows the same rule: its content stays in the history, and counts toward your storage, until the period has passed, and is then deleted. Deleting a workspace or your account deletes everything in it sooner.
• Your folders' history (each change to a folder, with its encrypted name before and after): for the same period as your notes' history. A daily cleanup deletes the changes older than that, so if a workspace's owner shortens the period, the older ones go within a day.
• Inactive Free accounts: if an account on the Free plan has no activity for 12 months (no use of the web app, and no request from an agent or command-line tool you connected), we delete it with every workspace in it, as if you had deleted it yourself. We email you 30 days and again 7 days before; any activity before then keeps the account. Because we can't read your notes, you can only export them by signing in. The rule never applies while the account has a paid subscription that hasn't fully ended: one that's active, paused, past due after a failed payment, or cancelled but running until the end of the period you've paid for. Once a paid subscription has fully ended, the account is a Free account and the rule applies to it, with the 12 months counted from when the subscription ended or from the last activity, whichever is later.
• Deleting your account: we first cancel any paid subscription with Polar and ask Polar to delete the customer record it holds for your account and anonymize it. Then we delete every workspace with all its encrypted data, and finally the account itself. The records of the checkouts you started are kept until 7 days after each checkout expires, or 60 days after you started it if Polar gave it no expiry. If you ever started a checkout and Polar can't be reached at that moment, the deletion is refused and nothing is deleted. If a deletion of your account is already in progress (for example from another tab), a second one is refused. As merchant of record, Polar keeps the transaction records it's legally required to keep, such as invoices and tax records; see Polar's privacy policy. Our database provider keeps an automatic recovery history for up to 30 days, after which the deleted records are gone from it too.
• Unconfirmed sign-ups: an account whose email address is never confirmed is deleted after 24 hours.
• Sessions: until you sign out, end them in the app, or they expire (at most 7 days without use).
• Abuse counters: removed after about a day.
• Checkouts: when you start buying a paid plan, we keep a record of the checkout (your account ID, the product, when you started it, when it expires, and the subscription it led to, if any). One that led to a subscription is kept for as long as your account exists. One you never paid is deleted 30 days after it expires, or 60 days after you started it if Polar gave it no expiry.
• Plan, billing period, subscription status and your payment records (amounts, currency, date and status): for as long as your account exists. Records of Polar's notifications: 30 days. Purchase records and invoices: kept by Polar as merchant of record, for as long as tax law requires.
• Account emails: delivery records are kept by Resend for a limited period, then deleted.
• Server logs: the website's and the web app's logs are kept by Vercel for a short period for security, then deleted. Sync API logs are kept by Cloudflare for a short period, then deleted. The sync API logs no IP addresses or request contents. For errors it logs the request method and route, the status, the error name and technical details such as a request ID and where in our code the error happened, never your content. For unusual billing notifications from Polar (one for a product, organization or checkout we don't know, say) it logs what happened and Polar's notification ID.
• Visit statistics: kept only as aggregated numbers; the hash that tells visits apart is discarded after 24 hours.

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing and a portable copy, and you can object to processing based on legitimate interest.

Because your notes are encrypted with keys we don't have, we can answer these requests only for the data we can read: your email, your account and billing records, and the metadata described above. For your notes themselves, you have the tools in the app: you can export them in full at any time, change or delete them, or delete your account with everything in it.

To exercise any of these rights, email support@knowtarium.com, ideally from your account's email address so we can find your account. We respond within one month.

You can also lodge a complaint with a data protection authority. For us, the competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

Knowtarium isn't directed at children under 16, and we don't knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.

When this policy changes, we update this page and the date at the top. We tell account holders by email about changes that matter.