Notchr Sign in
Terms Privacy AI Data Protection

Machines and your notes

AI Policy

Notchr has exactly one AI feature, it is switched off on the hosted service, and nothing you write is ever used to train a model. Here is the whole of it.

In effect 20 September 2026 Revision 1.1 Applies to the hosted service at notchr.app

1.What this document covers#

This policy covers every use of artificial intelligence, machine learning or automated decision-making in Notchr. It sits alongside the Privacy Policy and the Terms, and it exists because “we take your privacy seriously” is worth nothing next to a specific list.

Notchr comes in two shapes: the hosted service at notchr.app, where everything personal is end-to-end encrypted, and the same software run by an individual on their own machine, where their data sits in their own database in plain text. The distinction decides everything below.

2.On the hosted service, no AI touches your data#

The state of things today

There is no AI in the hosted app. Not for search, not for suggestions, not for tagging, not for moderation, not for support, not in the background. The encryption makes it structurally impossible rather than merely promised: the server holds ciphertext and no key, so there is nothing legible to send anywhere.

This is enforced in code, not policy. The backfill endpoint checks whether the notes it has been asked to parse are readable, and where they are not it refuses the request with:

Backfill from notes is not available with end-to-end encryption.

Which means the feature is permanently unavailable on notchr.app for as long as your data is encrypted — which is always.

3.The one AI feature, and exactly what it does#

Backfill from notes is for someone who already has years of notes in a text file and does not want to retype them. It runs only on an unencrypted, self-hosted deployment, only when a person presses the button on a partner's profile, and never on a schedule or in the background.

What is sent
The free-text notes on that one partner, and nothing else. No photos, no other partner, no ratings, no identifiers, no account details, no IP-linked profile. One request, one block of text.
Where it is sent
Anthropic's API (api.anthropic.com), to the Claude Sonnet 4 model (claude-sonnet-4-20250514), with a fixed instruction to act as a structured-data extractor. The instruction is in the source code and does not change per request.
What comes back
A list of candidate date records — a timestamp, an optional end date, a city, a country, a venue and a short factual summary drawn from the text.
What happens next
Nothing, until the person says so. The candidates are matched against existing entries within a 24-hour window, shown as a preview marked as new or as an update, and written only on confirmation. The model never writes to the database directly.
Who can turn it on
Nobody but the operator of that deployment, by supplying their own API key. Without a key the feature returns an error and does nothing.

4.Nothing you write trains a model#

We do not train, fine-tune, evaluate or improve any model using your ledger, your notes, your photos, your statistics or your usage. We do not sell or licence anything for that purpose. On the hosted service we could not, and on a self-hosted one we do not.

Where the backfill feature is used on a self-hosted deployment, the request goes to Anthropic's commercial API, whose terms state that inputs and outputs submitted through it are not used to train their models. Anthropic may retain API traffic for a limited period for safety and abuse-prevention purposes under its own published policies. Anthropic is the relevant party for that processing, and its terms and privacy policy govern it — so if you run your own deployment and that matters to you, read them before you supply a key.

5.No profiling, no scoring, no automated decisions#

Notchr makes no automated decision about you with legal or similarly significant effect, within the meaning of Article 22 of the UK and EU GDPR. There is no model of you, no risk score, no recommendation engine, no ranking of people, and no inference we draw and keep.

The statistics, badges, streaks, the year in review and the map look clever but are not. They are deterministic arithmetic — counting, sorting, averaging, grouping — run in your own browser over rows you typed. A badge for a country is a country you entered. A milestone at 50 dates is the number 50. In the hosted app these are computed after decryption on your device and never leave it.

6.If we ever bring AI to the hosted app#

We may want to one day — a better importer, a smarter search over your own ledger. Any such feature would have to satisfy all of the following before it shipped, and this page would be updated first:

  • Opt-in, per action. Off by default, turned on deliberately, never a background process and never a default that appears in an update.
  • Explicit about what leaves your device. The exact text or image, named, before it is sent, and never more than the feature needs.
  • Preview before write. Anything a model produces is shown as a proposal and is saved only when you accept it.
  • No training, ever. A contractual prohibition on the provider training on Notchr traffic, and no retention beyond what the request needs.
  • Encryption preserved by default. On-device inference or client-side processing preferred; if a feature genuinely required plaintext to leave your device, it would be described here in the same detail as clause 3 and would still require your explicit action each time.
  • No silent moderation. We will not introduce client-side scanning of your content, for any purpose, presented as an AI feature or otherwise.

We would rather have no AI feature than a quiet one. If this section ever reads differently, the revision date at the top will have changed and the app will have told you.

7.Transparency under the EU AI Act#

For the hosted service Notchr is not a provider or deployer of an AI system, because it operates none. Where the backfill feature runs on a self-hosted deployment, it is a limited-risk use of a general-purpose model: its output is presented to the person who asked for it as a set of extractions to check and confirm rather than as a finished record, nothing is written without that confirmation, and no decision follows from it automatically. Notchr operates no biometric identification, no emotion recognition, no social scoring and no prohibited practice of any kind, and nothing here is a high-risk use under Annex III.

Nothing in Notchr generates synthetic text, images, audio or video, so there is no synthetic content for us to mark as such.

8.AI in the building of Notchr#

For completeness, since an AI policy that discusses only the product is half a policy: parts of Notchr's source code are written with the help of AI coding tools, and reviewed before release. That is code, not your data — the tools operate on the repository, never on the production database, which they could not read in any case.

9.Your controls#

  • On the hosted service there is nothing to switch off. The feature is refused by the server and cannot be enabled for an encrypted account.
  • On a self-hosted deployment, leave ANTHROPIC_API_KEY unset and no request can be made; or simply never press the button.
  • Either way, if you would prefer no machine ever reads a line of your notes, do not use backfill — type the entries yourself and nothing goes anywhere.

10.Questions and changes#

Questions about anything on this page, or about a feature you suspect involves AI and is not listed here: [email protected]. If something is missing from this document, that is a bug and we would like to hear about it.

Changes to this policy follow the same rule as the others: the revision and date at the top of the page move, and a material change is announced in the app and here at least 30 days before it takes effect.