Privacy policy for Notes

Last updated: 11 October 2026

In short. Your notes are files in your own Google Drive, and Notes can reach only the files it created there. This site keeps no copy of your notes, sells nothing, shows no ads and does not use your notes to train AI models. It counts visits to its pages for statistics, without the contents of any note. You can disconnect it at any time, and your notes stay yours.

1. Who is responsible

Notes (notes.lovegrover.com) is a personal project run by Love Grover, who is responsible for the processing described here (the “controller”). Write to contact@lovegrover.com with any question or request about your data. This policy covers the Notes app, its MCP server for AI agents (notes.lovegrover.com/mcp), its shared pages and its setup app. The rest of lovegrover.com is covered by the site privacy policy.

2. What Notes receives from Google

When you choose Continue with Google, Notes asks for these permissions, and no others:

Your basic profile (openid, email, profile): your name and email address, to know which notebook is yours, to show you which account you are in, and to sign the notes you write.
Files this app creates or opens in your Drive (drive.file): Notes keeps a folder called Notes in your Drive. It cannot see, read or change any other file in your Drive.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, your Google data is used only to provide and improve the features of Notes that you use; it is not sold, not used for advertising, not used to train AI or machine-learning models, and not read by people, except with your explicit permission (for example when you ask for help with a specific note), where it is needed for security or to comply with the law.

3. What is stored, where, and for how long

Your notes, papers, boards and files are saved as files in the Notes folder of your Google Drive, together with a list of the agents and links you have allowed. Your browser reads and writes them directly with Google; this site keeps no copy. They stay in your Drive until you delete them, and Google keeps their earlier versions as it does for any Drive file.
Your sign-in is kept in a cookie in your browser, encrypted with a key only this site has, so that you stay signed in for up to 180 days or until you sign out. It holds the sign-in token Google issued to Notes and the email address of each account you added.
On your device, your browser keeps a copy of your notes so the app opens quickly, and your display settings (text size, page width, map positions, depth). Signing out removes the copy of the notes.
Agent keys and shared links are encrypted tokens. Each one carries the Google sign-in token it needs, encrypted, so the server stores nothing for them; your Notes folder lists them so you can see and revoke them. Agent keys expire after 180 days.
Visit statistics (see section 6) are kept in the site's database for 90 days, then moved to an archive file in the site owner's own storage for statistics over time.

4. AI agents and MCP

When you connect an AI agent (for example Claude Code, Codex, Gemini, Grok, OpenCode, claude.ai or ChatGPT), you give it a key, or approve it on this site, so it can read, and if you allow it write, the notes in your Notes folder. Notes passes each request between the agent and your Drive and does not store the content.

What an agent reads is processed by that agent and its provider under their terms and privacy policy, which you accepted when you started using it. Connect only agents you trust with your notes.
Every note an agent writes carries the agent's name, and every change is kept in the note's History.
You can disconnect any agent at any time under Agents. Its key stops working at once.

5. Shared notes and spaces

When you share a note or a space, anyone with the link can read it (or edit it, if you chose so) on this site, without an account, and sees nothing else in your notebook. You can stop sharing at any time, after which the link no longer works.

6. Visit statistics

Like every page of lovegrover.com, Notes counts its visits with the site's own first-party statistics, shown in aggregate on the public Pulse page. For each visit it records: the page address without anything after ? or # (and with the secret part of a shared link removed), the referring address on the same terms, the time spent on the page, a random identifier for the browser tab, your IP address, your browser and operating system, and an approximate location (city, region, country) derived from your connection by the hosting provider. It does not record the contents of any note, and on Notes it does not record the links you click. IP addresses are never shown publicly; visitors appear on Pulse as anonymous short codes. These statistics are used to understand how the site is used, to keep it secure and to prevent abuse.

7. Who processes data for Notes

Google: sign-in and Drive, where your notes are stored.
Vercel: hosting of the site and the MCP server, including standard request logs and the approximate location of a connection.
Supabase: the database of visit statistics.

These providers act on behalf of Notes and may process data in countries other than yours, under their own safeguards for international transfers. No other party receives your data, except the AI agents you connect yourself (section 4) and anyone you share a link with (section 5). Data may be disclosed if the law requires it.

8. Security

All traffic uses HTTPS. Sign-in tokens, agent keys and shared links are encrypted (AES-256-GCM) with a key held only by the server, and session cookies cannot be read by scripts on the page. Notes asks Google for the narrowest Drive permission that lets it work. No method of storage or transmission is perfectly secure, but these measures are designed to keep your notes reachable only by you and by those you allow.

9. Your choices and rights

Sign out at any time; this removes the sign-in cookie and the copy of your notes on that device.
Remove Notes' access in your Google Account under Security, then Third-party apps & services. Your notes stay in your Drive.
Delete your notes by deleting the Notes folder in your Drive. Nothing of them remains on this site.
Take your notes anywhere: they are plain Markdown files in your Drive, which you can download or move at any time.
Ask for a copy, a correction or the deletion of any visit statistics about you, or object to their collection, by writing to contact@lovegrover.com. Requests are answered within one month.

If you are in the European Economic Area, the United Kingdom or a place with similar laws, you have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your data-protection authority. Notes processes your account data to provide the service you sign in to (performance of a contract), uses connected agents and shared links on your instruction (consent, which you can withdraw by disconnecting or unsharing), and keeps visit statistics for security and to understand how the site is used (legitimate interests). Nothing is sold or shared for advertising, as those terms are used in California law.

10. Children

Notes is not directed to children under 13 (or under 16 where the law requires parental consent), and does not knowingly collect their data.

11. Changes

When this policy changes, the date at the top changes with it. A change in what Notes receives from Google or stores about you will also be pointed out in the app.

12. Contact

Love Grover · contact@lovegrover.com