Privacy Policy

Previous versions of this policy are available upon request.

1. Introduction

Welcome to Assemble Notes. We build specialized desktop and web-based note-taking tools designed for mathematics, allowing you to seamlessly create and organize notes using LaTeX formulas and interactive GeoGebra graphs. Because our free version stores notes locally on your device and our Pro version offers optional cloud synchronization, we have designed our privacy practices to be as lightweight and respectful as possible.

We believe that your notes are your private thoughts and intellectual property. This Privacy Policy explains in plain language how we collect, use, and protect your personal information when you use our website and application. It also outlines your rights under global privacy laws, including the GDPR, UK GDPR, PIPEDA, and US State Privacy Laws (such as the CCPA/CPRA).

If you have any questions about this policy or how we handle your data, please reach out to us at support@assemblenotes.com.

2. What We Collect & Why

We only collect information that we actually need to provide and improve Assemble Notes.

Information You Give Us Directly

We process this data primarily on the legal basis of fulfilling our contract with you.

• Account Information: We collect your email address and a password to create and secure your account.
• Payment Information: If you subscribe to Assemble Notes Pro, you provide billing details. This is processed directly by our payment provider (Stripe); we do not store your full credit card number.
• Communication Records: When you email our support team, we collect the contents of your message to help resolve your issue.
• Account Preferences: We save your app settings (like skin and font preferences) to ensure a consistent experience.

Information Collected Automatically

To keep our application secure and understand how it performs, we automatically collect certain technical data. We process this based on our legitimate interest in maintaining and improving our software.

• Device Information: We collect basic details about the device and browser you use to access Assemble Notes, such as your operating system, to optimize the LaTeX and GeoGebra rendering for your specific setup.
• Usage Analytics: We look at aggregated data on how features are used (e.g., how often cloud sync is triggered) so we know where to focus our development efforts.
• Technical Logs: We collect error logs and crash reports to identify and fix bugs.
• Local Storage: We use essential local storage to keep you logged in and remember your preferences. We do not use tracking cookies for advertising.

Crash and Error Reports (Desktop App)

To fix bugs quickly, the desktop app can send us anonymous crash and error reports. This is on by default and you can switch it off at any time in Settings → About → Anonymous crash reports.

• What is sent: the app version, your operating system and CPU architecture, the distribution channel, a random anonymous install ID, a short feature tag (e.g. "editor" or "export"), and a truncated error message and stack trace.
• What is never sent: your note content, block text, formulas, images, file names, folder names, or your email address. File paths and email addresses are automatically replaced with placeholders before a report leaves your device, and the report payload is limited to a fixed allow-list of fields.
• Account linkage: if you are signed in we store only an irreversible 8-byte hash of your account ID so that we can tell whether an issue affects paying users. We never store your account ID or email in logs.
• Storage: reports are stored in our own Cloudflare D1 database (Cloudflare is already listed as a sub-processor below). They are used only for debugging and reliability, are never sold, and are never used for advertising.
• Turning it off: disabling the toggle stops all uploads immediately and deletes any reports that were queued but not yet sent.

3. How We Use Your Information

Every piece of information we gather serves a specific purpose:

• Core Service Delivery: We use your email to authenticate your account and, if you are a Pro user, we use our infrastructure to securely synchronize, backup, and maintain version history of your notes across your devices. (Legal basis: Contract)
• Service Improvement: We analyze technical logs and usage data to make our block-based editor faster and more reliable. (Legal basis: Legitimate Interest)
• Communication: We use your email to send important account updates, security alerts, and billing receipts. (Legal basis: Contract)
• Marketing: If you opt in, we may send you newsletters about new features. You can opt out of these at any time. (Legal basis: Consent)
• Security and Fraud Prevention: We monitor account access patterns to detect unauthorized logins and protect your data. (Legal basis: Legitimate Interest)
• Legal Compliance: We maintain certain financial records to comply with tax and accounting laws. (Legal basis: Legal Obligation)

4. When We Share Your Information

We are highly selective about who we share your data with. We never sell your personal data.

Essential Service Providers

We share necessary data with trusted vendors who help us run Assemble Notes:

Other Circumstances

• Legal Requirements: We will disclose your information if we are legally required to do so by a valid subpoena, court order, or other legal process.
• Business Transitions: If Assemble Notes is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We will share your information in any other way only if you explicitly agree to it.

5. Your Privacy Rights

No matter where you live, we believe you should have full control over your personal data. You have the right to:

• Access Your Data: Request a copy of the personal data we hold about you. We will provide this within 30 days.
• Correct Inaccuracies: Update your email, password, and billing information directly in your account settings.
• Delete Your Data: Delete your account at any time. Doing so will permanently erase your personal data and cloud-synced notes from our active servers.
• Port Your Data: Export your notes from the application in standard formats at any time.
• Opt-Out of Marketing: Every marketing email we send contains a one-click unsubscribe link.
• Withdraw Consent: If you previously gave us consent to process your data, you can withdraw it at any time without affecting the legality of our past processing.
• Lodge a Complaint: If you feel we have mishandled your data, you have the right to complain to your relevant data protection authority.

To exercise any of these rights, please email support@assemblenotes.com.

6. Data Security

We take the security of your mathematical work seriously. We implement industry-standard encryption for data in transit and at rest. Access to our production servers is strictly limited and protected by multi-factor authentication.

However, we want to be honest: no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

In the unlikely event of a data breach that compromises your personal information, we commit to notifying you and the relevant authorities within 72 hours of becoming aware of the incident.

7. Data Retention

We keep your data only as long as necessary to provide our services.

• Active Account Data: We retain your account information and Pro cloud-synced notes until you delete your account. Once you trigger an account deletion, your data is removed from our active systems immediately.
• Financial Records: We are legally required to retain basic transaction history (which does not include full credit card numbers) for up to 7 years for tax and accounting purposes.
• Technical Logs: System and error logs are routinely purged and are kept for no longer than 12 months.
• Crash Reports: anonymous crash and error reports are deleted automatically after 90 days.
• Marketing Preferences: We retain your marketing opt-in status until you withdraw it.

8. Local Storage

We use essential local storage (not tracking cookies) to make our application work effectively:

• Essential Storage: Required for the platform to function, such as keeping you logged in and remembering your security settings. You cannot opt out of these.
• Analytics Storage: If we introduce analytics in the future, we will ask for your consent first.

You can clear local storage at any time through your browser or app settings.

9. Children's Privacy

Assemble Notes is designed for general audiences, such as high school and university students, educators, and professionals. We do not knowingly collect personal information from children under the age of 13 (or 16 in certain European jurisdictions). If we become aware that a child has provided us with personal data without verifiable parental consent, we will take immediate steps to delete that information.

Parents who believe their child has submitted data to us can contact us at support@assemblenotes.com.

10. International Transfers

Assemble Notes operates globally. To provide our services, your personal information may be transferred to, and processed in, countries other than the country in which you reside — primarily to Cloudflare's global network and Supabase's servers.

When we transfer data originating from the European Economic Area (EEA), the UK, or Canada to other countries, we ensure it is protected by appropriate legal safeguards. Specifically, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by sending an email to the address associated with your account and by posting a prominent notice on our website before the changes take effect.

Your continued use of Assemble Notes after the effective date constitutes your acceptance of the updated policy.

12. Contact Us

We want to hear from you if you have questions or concerns about your privacy.

Email: support@assemblenotes.com

Expected Response Time: We aim to respond to all privacy-related inquiries within 3-5 business days.

13. Categories Table (CCPA/CPRA)

For residents of California and other applicable US states:

Sensitive Personal Information: Assemble Notes does not collect or process sensitive personal information. Therefore, the right to limit the use and disclosure of sensitive personal information does not apply.

14. Automated Decision-Making

We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects concerning you (as defined under GDPR Article 22).

15. Privacy Signals

We respect your right to privacy and actively honor the Global Privacy Control (GPC) signal. If you have enabled GPC in your browser, our website will automatically recognize this signal and opt you out of any non-essential tracking or analytics.

16. Sub-Processors

To provide Assemble Notes, we engage the following third-party sub-processors:

• Cloudflare — Cloud hosting, database, and file storage
• Supabase — Authentication
• Resend — Transactional emails
• Stripe — Payment processing

We maintain a current list of our sub-processors on our website. Customers can subscribe to receive email notifications at least 30 days before we add or change any sub-processor by contacting support@assemblenotes.com.

17. EU/UK Representative

EU/UK Representative: None currently appointed. As a global platform with minimal data collection, we manage all privacy inquiries directly through our dedicated team at support@assemblenotes.com.

18. Supervisory Authority

If you are located in the European Economic Area or the United Kingdom and believe we have not adequately resolved your privacy concerns, you have the right to lodge a complaint with your relevant supervisory authority.

• For users in the UK: Information Commissioner's Office (ICO)
• For users in the EU: Your local data protection authority

19. Controller and Processor Roles

Privacy laws distinguish between the "Controller" (the entity that decides why and how data is processed) and the "Processor" (the entity that processes data on behalf of the Controller).

When you use Assemble Notes:

• We act as a Data Processor for the actual content of the notes, LaTeX formulas, and GeoGebra graphs you create. You own this data.
• We act as a Data Controller for the account information, billing details, and usage analytics we collect to manage your subscription and operate our business.

For business and enterprise customers, these roles and our specific obligations are further detailed in our Data Processing Agreement (DPA), which is available upon request.

This document is provided for informational purposes and does not constitute legal advice. If you require legal assistance, please consult a qualified lawyer.