Privacy notice
draft

1. Scope

This draft covers the public website at jotgrove.com, the JotGrove web application at dash.jotgrove.com, and related synchronization, AI, speech-transcription, link-processing, and MCP connection services.

A third-party website or AI client that you choose to connect is also governed by its own privacy terms.

2. Information JotGrove processes

Account and authentication

This can include your email address, verification status, verification-challenge and delivery metadata, session records, security events, and timestamps. The application is designed not to store plaintext verification codes or raw session tokens in its database.

Workspace content

This can include jots, notes, titles, text, checklists, links, link previews and summaries, tags, wall positions and appearance, plans, tasks, archive state, revisions, conflict evidence, AI drafts, and approval history. Uploaded images also include the file, filename, media type, size, and attachment metadata.

Information stored on this device

The web app stores account-scoped content in IndexedDB. Browser storage is also used for settings such as language and interface preferences, and browser cache storage may preserve previously loaded application files. Signing out currently keeps that account’s local database on the device for a later sign-in.

Reset Desk responses currently stay in this browser’s local database. If you save a compiled blueprint as a note or plan, or send it into an AI run, the resulting content follows the ordinary synchronization and AI rules.

Actions you choose to run

An AI planning run processes the source note, only the extra notes you explicitly associate, selected roles, generated drafts, status, and usage metadata. The current planning flow does not automatically enable web research.

A tag-suggestion request may provide the note title and body, current tags, and available workspace tags to the configured provider. A link summary may fetch the public URL and provide the URL, page metadata, an extracted part of the page, or a YouTube reference to the configured provider.

A speech-transcription request sends audio to the configured provider. The current API holds the audio and returned transcript only for that request and does not write them to its database, attachment volume, or application logs. Transcript text becomes durable if you then save it in a note.

Technical and security information

This can include IP address, request time and route, information made available in network requests, device identifiers used for synchronization, rate-limit events, and authentication or MCP access events. Some application security records use a keyed IP digest; infrastructure access logs may still process the source IP and request metadata.

3. AI Connections and MCP

If you authorize an MCP client, it receives separate, scoped, revocable credentials. Depending on the approved scopes, it can search and read synchronized, non-deleted notes, plans, and tasks; list recent content or tags; and submit a new draft for review.

MCP tools do not return attachment bytes, account details, security settings, deleted content, or internal AI records. A submitted draft cannot edit or delete an existing note. JotGrove saves it as a pending review item; approval creates a separate note, while rejection does not.

The connected client and its provider may separately store or use the content they receive. Review that provider’s settings and terms before granting access, and revoke the connection when it is no longer needed.

4. Why information is used

JotGrove uses information to authenticate accounts; store, synchronize, search, and display workspace content; provide private attachments; perform transcription, link summaries, tag suggestions, and AI drafts that you request; provide and secure MCP connections; prevent abuse; diagnose failures; preserve revision and conflict evidence; and maintain the service.

Legal bases, where required, must be confirmed before final publication. Expected categories may include providing the service, consent for optional features, legitimate interests in security and operation, and compliance with legal obligations. [LEGAL REVIEW REQUIRED]

5. Service providers and disclosure

JotGrove may disclose only the information needed for a task to infrastructure and database providers, email-delivery providers, bot-protection providers, configured AI or speech providers, and an MCP client you authorize.

• Resend is used to deliver email verification codes and receives the destination email address and delivery content.
• Cloudflare Turnstile may be enabled for bot protection and processes information needed to verify the challenge.
• AI, tag, link-summary, and speech providers depend on production configuration. Their legal names, locations, retention terms, and subprocessors remain to be confirmed.
• Hosting, database, backup, CDN, and operational providers: [TO BE CONFIRMED].

The public website is built without advertising SDKs, behavioral analytics, or marketing cookies. The application uses necessary session and security cookies. Any jurisdiction-specific “sale” or advertising-sharing statement requires operator review.

6. Storage, synchronization, and retention

Local-first does not mean local-only. Edits are written on the device first, while signed-in content, plans, tasks, revisions, and attachments can also synchronize to JotGrove’s server. Optional providers and authorized clients receive the limited content described above. JotGrove does not claim end-to-end encryption.

Local browser data remains until the application removes it, you clear site data, or the browser removes it. Signing out does not currently clear the local account database. Archived content remains stored and can be restored; archive is not deletion.

Server content is generally retained while an account is active or until the relevant record or account is deleted. The service implements account deletion for owned workspace records and attachments, but the user-facing request path, backup-deletion window, log retention, and legally required preservation periods must be confirmed.

MCP access-event cleanup is configurable and currently has a 90-day default. A complete production retention schedule is still required.

7. Your choices and controls

You can choose whether AI stays quiet, offers suggestions, or prepares a draft after a short undo window. Results still require review before plans or tasks are created. You can choose which extra notes enter a run, dismiss a draft, revoke MCP connections, archive and restore content, or permanently delete supported archived records.

You can clear local browser data through browser controls, but doing so can remove unsynchronized changes. The final notice must identify a supported account-deletion and privacy-request procedure before relying on it.

Depending on applicable law, you may have rights to access, correct, delete, restrict, object, obtain a copy, or withdraw consent. How to submit and verify a request: [TO BE CONFIRMED].

8. International processing

JotGrove and its providers may process information outside your country. Actual hosting and provider locations, transfer mechanisms, and required safeguards must be documented before final publication. [TO BE CONFIRMED]

9. Security

JotGrove uses measures such as HTTPS in production, scoped account storage, HttpOnly session cookies, CSRF protection, token digests, rate limits, private attachment access, and revocable MCP credentials. No storage or transmission method is completely secure, and this draft does not promise encryption at rest or end-to-end encryption.

10. Children

The service’s minimum age, intended markets, and any parental-consent process have not been set. [AGE AND CHILDREN’S PRIVACY REVIEW REQUIRED BEFORE FINAL PUBLICATION]

11. Changes and contact

The final notice must explain how material changes will be communicated and show an effective date. Questions or privacy requests should be sent to: [PRIVACY EMAIL TO BE CONFIRMED].