TreeNote
Sign inSign up
GDPR & CCPA Compliant

Privacy Policy & Data Protection

TreeNote is designed from the ground up as a zero-knowledge, local-first outliner. We do not inspect, sell, or train AI models on your private thinking.

Open TreeNote free
Zero Model Training

Your notes, outlines, and prompts are never used to train TreeNote models or third-party AI models.

TLS 1.3 & AES-256

Bank-grade encryption in transit (TLS 1.3) and client-side at rest (AES-256 GCM) with passkey protection.

Local-First Storage

Primary copy stored on your machine. Cloud sync moves through your own Google Drive or Dropbox.

Effective Date: September 5, 2026 | Version 2.4 | Applicable Worldwide

1. Overview & Our Philosophy

TreeNote (“TreeNote”, “we”, “us”, or “our”) builds productivity tools based on the principle of User Data Sovereignty. Unlike traditional cloud note apps that maintain centralized plaintext repositories of your thoughts, TreeNote operates on a local-first architecture.

Your thoughts and outlines remain on your device in your browser or local IndexedDB database. Optional multi-device synchronization occurs either via client-side Conflict-Free Replicated Data Types (CRDTs) to your own personal storage (such as Google Drive or Dropbox) or through our encrypted zero-knowledge infrastructure.

2. Zero-Model-Training Guarantee

We make a strict, legally binding commitment:

  • No Foundation Model Training: We will never use your private outlines, notes, metadata, document titles, or AI query prompts to train, evaluate, or fine-tune our own internal algorithms or any public or proprietary AI foundation models.
  • Bring Your Own Key (BYOK) AI Architecture: When you connect an AI provider (e.g., Anthropic, OpenAI, Google Gemini, or AWS Bedrock), inference requests are transmitted directly from your client application to the AI provider endpoint via your personal encrypted API credentials. TreeNote servers do not inspect or retain your prompts or generations.
  • Zero Data Selling: We do not sell, rent, monetize, or broker personal data or user content under any circumstances.

3. Encryption & Security Standards

We implement enterprise security controls designed in alignment with SOC-2 Type II standards and ISO/IEC 27001 principles:

In-Transit Encryption

Enforced TLS 1.3 encryption across all communication endpoints with Perfect Forward Secrecy (PFS) and HTTP Strict Transport Security (HSTS).

At-Rest & Client Encryption

Industry-standard AES-256 GCM client-side encryption. Protected documents can only be decrypted locally with your master passphrase or hardware FIDO2/WebAuthn passkeys.

4. Data We Collect

Because TreeNote is local-first, the data we collect is minimal and strictly limited to account provisioning and billing:

  • Account Identification: Email address provided during registration or OAuth sign-in.
  • Subscription & Licensing: Plan tier (Starter ₹499/mo or Pro ₹999/mo), billing cycle, trial start/end date, and referral tokens.
  • Telemetry & Crash Analytics: Aggregated, anonymized performance metrics (e.g. app load speed, crash traces). We do not record keystrokes, node content, or outline hierarchies.

5. GDPR & UK Data Protection Rights

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, you possess the following statutory rights under the General Data Protection Regulation (GDPR):

  • Right of Access (Art. 15): You have the right to obtain confirmation and copy of all personal data we process concerning you.
  • Right to Rectification (Art. 16): You may update or correct incomplete or inaccurate personal data at any time.
  • Right to Erasure / “Right to be Forgotten” (Art. 17): You may request complete and permanent deletion of your account and related records.
  • Right to Data Portability (Art. 20): You may export all your outlines at any time in universal, open formats (OPML, JSON, and Markdown).
  • Right to Restriction of Processing (Art. 18) & Object (Art. 21): You may object to data processing based on legitimate interests or revoke analytics consent.

To exercise your GDPR rights, submit a request to our Data Protection team at support@treenote.in. Requests are fulfilled within 30 calendar days at zero cost.

6. CCPA & California Privacy Rights (CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), California consumers are entitled to:

  • Right to Know what personal information is collected, disclosed, or sold.
  • Right to Delete personal information collected from you.
  • Right to Opt-Out of the sale or sharing of personal information (TreeNote does not sell or share consumer data).
  • Right to Non-Discrimination for exercising CCPA privacy rights.

7. Authorized Subprocessors

We partner with trusted enterprise cloud vendors who adhere to strict data protection standards:

VendorPurposeLocation
Amazon Web Services (AWS)Cloud hosting, private VPC, serverless sync compute, encrypted backup storage (S3)United States / Global
Vercel Inc.Edge delivery network (CDN), serverless frontend routingGlobal Edge
Stripe / RazorpayPCI-DSS Level 1 payment processing and subscription billingUnited States / India

8. Data Retention & Permanent Deletion

Your local files can be cleared at any time from your browser or device storage. If you cancel your subscription and request account deletion, we immediately initiate an automated purge of your user account, license records, and telemetry associations from our active and backup databases within 14 business days.

Questions or Data Inquiries?

Contact our Data Protection Officer and Compliance team anytime.

support@treenote.in