Privacy Policy
Effective 10 July 2026
EmbrNote is a reading companion that helps you capture and revisit passages, quotes and notes from the books you read. This policy explains what information we collect, why we collect it, and the choices you have. It applies to the EmbrNote app and website at embrnote.com.
EmbrNote is operated from Australia. For any question or request about your data, email us at [email protected].
The short version
- Your reading library is private to your account. We never sell your data, share it for advertising, or use it for anything other than running EmbrNote for you.
- AI features are powered by OpenAI. Content is sent to OpenAI only when you use one of those features, is never used to train OpenAI's models, and is not kept by OpenAI beyond a short abuse-monitoring window.
- Photos you scan and voice notes you dictate are processed and discarded. We keep only the resulting text.
- Analytics is optional. If you decline, we only see anonymous usage statistics, with no cookies and nothing tied to you.
- Quote emails are opt-in, and every one has a one-click unsubscribe.
- You can permanently delete your account and all of your data at any time from Settings.
Information we collect
Your account
When you create an account we collect your email address, and a password if you choose one (stored only as a secure hash by our authentication provider). You can also sign in with an emailed magic link or with Google. If you use Google sign-in, Google shares your basic profile details with our authentication provider; EmbrNote itself uses only your email address.
Your reading content
Everything you add to EmbrNote is stored in your account so it is there when you come back:
- Books you add (title, author and cover image)
- Passages you capture and margin notes you write
- Quotes you save and who said them
- Tags you create
- Conversations you have with the AI assistant
- Quote art you design and podcasts you generate
- Your preferences, such as quote email frequency
Photos and voice recordings
When you photograph a page to extract its text, the photo is sent to our AI provider for text recognition. When you dictate, the recording is sent for transcription. In both cases we keep only the resulting text. The photo or recording itself is not saved on our servers.
Usage information and technical data
With your consent, we collect analytics about how EmbrNote is used and error reports when something breaks (see the next section for exactly what this involves). Like any web service, the providers that host EmbrNote also receive your IP address and browser type as part of normal internet traffic and keep them in routine server logs.
Analytics and cookies
We use PostHog for product analytics and error monitoring. What it collects depends on the choice you make in the cookie banner, and you can change your mind at any time in Settings:
- Before you choose, and if you decline: analytics runs in an anonymous mode. It records events like "a quote was created" with no cookies, no identifiers stored on your device, and no link to your account. We can see aggregate patterns, not you.
- If you accept: analytics events are linked to your account (including your email address), and PostHog stores cookies and similar identifiers on your device so we can understand usage across sessions. This helps us debug problems you report and improve the features people actually use.
Analytics records actions, not content. Events may include things like a book identifier or the length of a note, but never the text of your passages, quotes or notes, and we do not use session recording.
Separately from analytics, EmbrNote uses storage on your device that is essential for the app to work: your sign-in session, unsaved drafts, small caches so pages load fast, and your recently viewed books (which stay on your device). These are not used to track you.
How we use your information
- To run EmbrNote: store your library, keep you signed in, and show you your content.
- To provide AI features when you ask for them.
- To send you service emails (sign-in links, email confirmation, password resets) and, only if you turn them on, quote emails.
- To understand usage and improve the app, based on your analytics choice.
- To keep the service secure and prevent abuse.
We do not sell personal information, and we do not show third-party advertising.
AI features
EmbrNote's AI features are powered by OpenAI. Content is sent to OpenAI only at the moment you use a feature:
- Ask AI about a passage or quote: your question, the passage or quote, the book's title and author, and the conversation so far.
- Text extraction: the photo you take of a page.
- Dictation: your voice recording, transcribed to text.
- Quizzes: the quote being quizzed.
- Podcasts: the book's title and author and your saved passages and quotes from it, used to write and narrate the episode.
- Generated book covers: the book's title and author.
OpenAI processes this content as our service provider. It does not use content sent through its API to train its models, and it does not keep the content: it retains it only briefly (up to 30 days) to monitor for abuse of its services and then deletes it, unless the law requires a longer hold. The AI conversations you revisit in EmbrNote are stored in your EmbrNote account, not by OpenAI, and you can delete them whenever you like.
Who we share information with
We share personal information only with the service providers that run parts of EmbrNote for us, and only for the purposes described here:
- Supabase hosts our database, authentication and file storage. Your library is stored in the United States (Northern California).
- OpenAI (US) provides the AI features described above.
- Resend (US) sends quote emails to the address on your account.
- PostHog (US) provides analytics and error monitoring, subject to your consent choice.
- Google (US) provides Google sign-in if you choose it, powers book search (your search terms are sent to the Google Books service), and serves the fonts on this site (your browser requests them from Google's servers, which see your IP address).
- Unsplash (US) receives your search terms when you look for background photos in the quote art editor.
- Netlify and Cloudflare (US) host and deliver the website itself and process IP addresses in routine server logs.
We may also disclose information if the law requires it, to protect the rights and safety of our users, or as part of a sale or restructure of the business (in which case this policy would continue to apply to your data).
Where your data lives
Your library is stored with Supabase in the United States (Northern California), and our other providers, listed above, also process data in the United States. If you are in Australia, the EU or the UK, that means your information is transferred outside your country. Wherever personal information travels, we rely on our providers' data protection commitments, including standard contractual clauses where they are required, to keep it protected to the standard described in this policy.
How long we keep your information
- We keep your account and library for as long as your account exists.
- Items you delete in the app are hidden from your library immediately and are permanently removed when your account is deleted. If you want specific items permanently erased sooner, email us and we will do it.
- Deleting your account (Settings, then "Delete my account") permanently and immediately erases your books, passages, quotes, margin notes, tags, AI conversations, quote art, podcasts, preferences, stored files and sign-in record. This cannot be undone.
- Our database provider keeps rolling backups for a limited period; deleted data drops out of those as they rotate.
- You can ask us to delete analytics data linked to your account at any time.
Your rights and choices
The quickest controls are in the app itself:
- Analytics: accept or decline in the banner, and change your choice any time in Settings.
- Quote emails: turn them on or off in Settings, or use the unsubscribe link in any quote email. Unsubscribing takes one click and no sign-in.
- Delete your account: Settings, then "Delete my account".
Depending on where you live, you may also have legal rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these, email [email protected] and we will respond as the law requires. We may ask you to verify that you own the account first. If you are unsatisfied with our response, you can complain to your local privacy regulator: in Australia that is the OAIC, and in the EU or UK it is your data protection authority.
Security
Your data is encrypted in transit, encrypted at rest by our hosting providers, and protected by access rules designed so that only your account can read your library. Administrative access is limited to what is needed to operate the service. No online service can promise perfect security, so please use a strong, unique password. If you believe you have found a security issue, email [email protected] and we will look at it promptly.
Children
EmbrNote is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we change this policy, we will post the new version here and update the effective date above. For significant changes we will tell you in the app or by email before they take effect.