Privacy policy

Last updated October 17, 2026

This page explains what Obscribe collects, why we collect it, and what you can ask us to do with it. It covers this website (obscribe.com) and the Obscribe app (app.obscribe.com). If something here is unclear, write to us at the address at the bottom of the page.

Requesting early access

When you submit the early-access form we store:

• your email address,
• the optional message about what you would like to organize,
• the date of your request and which version of the form wording you agreed to.

We use this only to review your request and to email you about it, including an invitation if we send one. Requesting access does not create an account. We do not sell this information and we do not use it for advertising. The form also has a hidden field that catches automated submissions; anything submitted through it is discarded.

Using an Obscribe workspace

If you have an account, we store:

• your name and email address,
• your password in hashed form (we cannot read it), and, if you turn on two-step sign-in, an encrypted authenticator secret and hashed recovery codes,
• the content you and your teammates create in a workspace: notes, note history, projects, tasks, comments and similar items,
• a short record of security-relevant events such as sign-ins and password changes, and error records we need to keep the service running.

Workspace content is visible to the members of that workspace according to their roles. We do not read it except where needed to keep the service working, to investigate abuse or a security problem, or where the law requires.

Cookies and tracking

The website sets no cookies and runs no analytics, advertising or third-party scripts; its fonts and images are served from our own domain. The app sets one cookie, obscribe_session, to keep you signed in. It is HTTP-only, sent only over HTTPS, and expires after seven days. We do not use it for tracking.

Technical data

To limit abuse, the app counts requests per network address. That count is stored under a hashed key and removed after it expires. Our hosting provider also keeps ordinary server and request logs, which can include IP addresses, for operating and securing the service.

Who handles your data

We rely on these service providers:

• Railway hosts the website, the app and the database. Data is processed on its infrastructure.
• Proton Mail delivers the emails we send you, such as replies to early-access requests, invitations and password-reset links.
• The AI service you pick processes text for the optional AI tools, only if a workspace owner has turned them on and you have added your own API key. You can use Anthropic, OpenAI or Google (Gemini), or another service that works the way OpenAI's does, at an address you enter. When you use an AI tool, the text you selected, or what you type into the assistant chat, is sent to that service with your key. When you ask it to find decisions, questions and tasks in a note, the note's saved title and text, the names of the people in the workspace and the decisions, questions and tasks already on that note are sent. When you ask it to scan a workspace for improvements, it gets an outline only: the names of projects and folders, note titles, and each task's title, status, due date and whether it has an owner. It never gets the text inside a note, and you see the outline before it is sent. We do not store that text or the reply, and nothing is sent unless you choose to use the tool. We store which service you chose and, for other services, the address you entered. Your key is stored encrypted and you can remove it at any time in Settings. When you ask it to draft a recap for a follow-up meeting, the note's saved title and text and its decisions, questions and tasks, with the names of the people they are assigned to, are sent; the recap is only saved if you create the follow-up note with it.
• What an AI service does with the text you send is set by its own terms and your agreement with it, not by us, so read them before you add a key. For example, Google's Gemini API terms say that content sent through unpaid use may be used to improve its products and read by human reviewers, and that paid use is not used that way.
• When you ask the assistant to add projects, notes or tasks to the workspace you are in, it gets what you type in the chat and an outline of that workspace: the names of projects and folders, note titles, and each task's title, status, due date and whether it has an owner. It never gets the text inside a note, you can see the outline before you send anything, and nothing is added until you tick it.
• A workspace owner can also let the assistant answer questions from the notes in a workspace. This is off unless an owner turns it on. When it is on and you ask a question, Obscribe picks the few notes whose words best match it and sends excerpts of those notes, with their decisions and questions, to your AI service with your key. If no note matches, nothing is sent. The answer lists which notes were sent.

We share data with others only if the law requires it or you ask us to.

How long we keep it

Early-access requests are kept until you ask us to delete them. Account and workspace data is kept while the account exists. Sign-in sessions expire after seven days. Notes and other items you delete in the app are first moved to the trash; items in the trash are removed permanently after 30 days.

Your choices

You can delete your account yourself from Settings, under Security. That removes your account, your sign-in sessions, your settings and AI key, your comments and feedback, your early-access request, any workspace where you are the only member, and invitations you sent that have not been used yet. Notes and tasks you added to a shared workspace stay with that workspace and are no longer linked to you, though your name can still appear in their text, history or activity. We keep the security log entries for the account, such as sign-ins and its deletion, under an internal number without your name or email. Copies in our backups are removed as those backups expire.

You can also ask us to show you what we hold about you, correct it, or delete it, including an early-access request. Email us from the address you used and we will respond within 30 days. Once your data has been deleted we cannot restore it.

Security

Connections to the website and the app use HTTPS. Passwords are hashed, sessions are stored as hashes, and database access is restricted by workspace. No system is perfectly secure, and if we learn of a breach affecting your data we will tell you as the law requires.

Children

Obscribe is meant for adults and businesses. It is not directed at children under 16, and we do not knowingly collect their information.

Changes

When we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will tell you by email.

Contact

Questions or requests: accounts@obscribe.com.