Privacy Policy
This policy explains what information Outlain Inc. ("we", "us") collects when you use our apps for Mac and the web, our websites and our related services (together, "the Service"), how we use it, and the choices you have.
Who we are
Outlain Inc. is a California corporation and is responsible for the information described here. Contact us about privacy at support@outlain.com.
The short version
- Your notebooks are stored on your device. When they sync, they are encrypted on your device first. With Private protection, only you hold the key.
- We collect the account details needed to sign you in, and the technical information needed to run sync and keep the Service secure.
- When you ask the AI assistant for help, the content needed for that request is sent to our AI providers.
- We do not sell your personal information, show ads, or use advertising or analytics trackers.
Information we collect
Account information
When you sign in with Google, we receive your name, email address, profile picture and a Google account identifier. We use these to create and secure your account, show your name to collaborators you work with, and contact you about the Service.
Your notebook content
Notes, documents, files and other content you create are stored on your device. When content is synced to our cloud or shared with collaborators, it is encrypted on your device first, and our servers store only the encrypted data. Who can decrypt it depends on the protection you choose:
- Private (available for your personal workspace): only you hold the key. We cannot read the content, except what you choose to send to AI features or authorize a connected assistant to access (described below), and we cannot restore access if you lose all of your recovery methods.
- Standard (the default, and used for all team workspaces): we hold a recovery key in our systems so you can regain access on any device and teammates can be given access while you are offline. This means we are technically able to decrypt the content. We use this key only to restore and grant access, not to read your content.
To run sync and collaboration, we do process information that is not encrypted end to end: account and organization identifiers, notebook and document identifiers, the size and timing of changes and files, membership and sharing settings, and while you are online, which documents collaborators currently have open.
If you create a share link, anyone with the complete link can view the shared document. The key that decrypts it is part of the link itself and is not sent to our servers, so treat a share link like a key.
AI features
AI features run only when you ask. When you use them, the content needed to respond, such as your request, the relevant parts of your document and earlier messages in that chat, is sent to our AI providers to generate a response. Because the providers must read this content, it is not end-to-end encrypted while it is processed.
Chat history is kept on your device so you can continue a conversation. A chat is deleted when you delete it, and automatically 30 days after its last message. Our AI providers may also store a chat's conversation; when a chat is deleted, we delete it from the provider as well. Providers may separately keep request data under their own data-retention policies.
If you add your own API key for an AI provider, your AI requests go from your device directly to that provider under your own agreement with them. Limited request information may still pass through our service to provide the feature.
If you connect an outside AI assistant to your workspace through our connector, our service decrypts the content you authorize it to access and provides it to that assistant, and that assistant's provider processes it under its own terms. You can disconnect it at any time in Settings.
Purchases
If you buy a subscription, payment is handled by Apple (for App Store purchases) or by our payment processor. We receive your subscription status and the details needed to provide your plan, not your full card number.
Technical and security information
Our servers record limited technical information when you use the Service, such as IP address, device and app version, request times and errors. We use it to operate the Service, fix problems and prevent abuse, and we keep it only as long as needed for those purposes.
Cookies and local storage
This website, outlain.com, uses no cookies, analytics or tracking. Our web app uses cookies and browser storage only to keep you signed in, remember your settings and store your content on your device.
How we use information
We use information to provide, secure and improve the Service; to sync and share your content as you direct; to provide AI features you request; to respond to you; to send service messages such as invitations and account notices; and to meet legal obligations. We do not use your content to train AI models, and our AI providers' terms do not allow them to train their models on it. We do not sell or share personal information for advertising.
Service providers
We use carefully selected service providers to run the Service, in these categories: cloud hosting and storage, AI model providers, email delivery, and payment processing. They process information only on our behalf and under obligations to protect it at least as well as this policy does.
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition, in which case this policy continues to apply to it.
Retention and deletion
We keep your account and cloud data while your account is active. To delete your account, email support@outlain.com from the address you sign in with. We then delete your account and cloud data. Copies in our backups are removed as those backups expire. Content stored only on your own devices stays there until you remove it.
Your rights and choices
You can ask us to access, correct, export or delete your personal information by emailing support@outlain.com. We will verify the request comes from you and respond within the time the law requires. Depending on where you live, including California, you may have additional rights. We will not treat you differently for exercising them. We do not sell personal information or share it for cross-context behavioral advertising.
Security
We encrypt notebook content on your device before it is synced, use encryption in transit for all connections, and access controls on our systems. No system is perfectly secure, so please keep your devices and sign-in account secure as well.
Where information is processed
We and our providers process information in the United States. By using the Service, you understand your information will be processed there.
Children
The Service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We will post any changes on this page and update the effective date. If a change is significant, we will also notify you in the app or by email before it takes effect.
Contact
Outlain Inc. · support@outlain.com