What you write in your notebook belongs to you. Here is where it goes, who can technically see it, and what we commit to. Written to be read, not to cover anyone.
Your notebook is stored in a database hosted by Supabase. The app runs on Vercel, and PowerSync relays your notebook between the database and your devices. Access rules in the database make sure a user can never read someone else's notebook.
Everything travels encrypted between your browser and our servers, and the disks are encrypted. But this is not end-to-end encryption: the database can read what it holds. That is what lets you get back into your notebook with a simple email link, with no password you must never lose.
We would rather tell you than leave you guessing.
Through the database admin tool, the content of your notebook can be read: tasks, appointments, pages, brain dump. No one but the developer has this access.
Your email and, if you sign in with Google, your name and avatar. The profile photo you send in My account and its drawn portrait, if you send one. Sign-in dates and your IP address appear in the technical logs for a few days.
When you send feedback from the “Any feedback?” button, the developer reads the message, the view and the area. The screenshot is only sent if you check “Attach screenshot”. It is stored in a private space, never reachable from a public address.
Never opening your notebook, unless you ask for it yourself to fix a problem.
No server route reads your notebook. Carnet's code only talks to your notebook with your own permissions. A single admin key exists on the server side, for payments: it only reads and writes your subscription status.
No advertising tracker in your notebook, and no reselling of your data. The Meta and OpenAI pixels only live on the public pages (see “Advertising” below). We look at how Carnet is used, never at what you write (see “Usage analytics”).
Full deletion on request. Your account, your notebook and your feedback are erased. Automatic database backups are gone within 7 days.
If you connect your calendar, your appointments are read, never modified, and copied into your notebook. The Google access token lives in your session; it is not kept on the server.
Carnet only reads the names of your calendars and, for each appointment, its title, times and link. This data is used only to show your appointments in your notebook: it is not sold, not shared, and not used for advertising or to train AI models.
Carnet's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your Google Calendar data (calendar names; appointment titles, times and links) is protected as follows:
Subscriptions go through Stripe. Your card, billing address and invoices are held by Stripe; Carnet only keeps your customer ID and the status of your subscription. Stripe never sees your notebook.
Carnet's emails (your sign-in code, and in the first days a few emails to get started) are sent through Resend. When you create your account, Resend receives your email and your language; then where your subscription stands (trial, subscribed, canceled) and whether you've started writing in your Carnet (yes or no). Never what you write. Every email has a link to stop receiving them. No newsletter without your consent.
To learn what helps and what gets in the way, Carnet uses PostHog (servers in the European Union): actions like “Week view opened” or “task created”, the page visited, and session recordings. In these recordings, your whole notebook is masked: text is replaced with asterisks, and images and fields are not recorded. They show where you click, not what you write. Never the text of your tasks, pages or searches, never your email: there you are only a technical ID. A cookie lets us recognize you from one visit to the next; the IP address is not kept.
To know which channels bring in subscribers, a cookie (carnet_first_touch, 90 days) notes where you first came from: the referring site (its domain name only), the campaign named in the link and the first page you saw. When your account is created, this origin is kept on your account and on your subscription at Stripe. It stays with us: neither Meta nor OpenAI receives it.
To know whether our Instagram and Facebook ads bring people in, the public pages (home, sign-in, subscription) and the payment confirmation load the Meta pixel. Meta receives the page visited, your browser, your IP address and a cookie (_fbp, 90 days), along with these steps: sign-up requested, account created, checkout started, trial started, subscription purchased (with its price). The pixel does not receive your email, and it is never loaded in the notebook.
Our server also confirms the start of the trial and the first payment to Meta, even if the confirmation page never loads. Meta then receives a fingerprint of your email (a hash, not the address itself), the ad-click cookie if it is still there (_fbc), your IP address and your browser at the time of payment, and the price. Never the content of your notebook. Meta may link this data to your Facebook or Instagram account, under its own policy.
Same for our ads in ChatGPT: these pages also load the OpenAI pixel, which receives the page visited, your browser, your IP address, two cookies (__oppref, 30 days, the reference of the ad you clicked; __obref, 1 year, a browser ID), along with sign-up, account creation, checkout and the subscription (not the trial start). If you came from one of these ads, the subscription you buy is also confirmed to OpenAI by our server, with that reference and the price, nothing else. Never your email, never the content of your notebook.
When something breaks, a technical report goes to Sentry: the error message, the page and the browser. No cookie, no identity, none of your notebook's content.
When you paste a link into a page, the server fetches its title and image to display it. So the link's address passes through our servers, without being saved anywhere but in your notebook.
When you change your profile photo, Carnet offers a drawn version of it. To make it, the photo (cropped, without the place or device it was taken with) is sent to Google (Gemini API, paid tier): Google doesn't use it to train its models and only keeps it for a limited time, to detect abuse. When you keep it, Carnet saves the photo and its drawn portrait, so you can switch between them, in a private space, never reachable through a public address. “Remove”, in My account, deletes both. A photo you don't keep isn't saved anywhere.
Not for now. It would make your notebook unreadable even to us, but it would ask you for a secret passphrase that no one could give back to you if you lost it. We would rather be clear about what we do first. If it becomes an option, it will be yours to turn on.
A question, or want everything erased? Write to elyane@emotions.co.