Privacy statement

This statement explains what personal data Narafy Limited ("Narafy", "we", "us") collects, why, and the choices you have. It covers this website and the Narafy app.

The short version

• Your notes stay on your device. We never receive them.
• If you ask us to notify you, we keep your email address so we can tell you when Narafy launches.
• If you use the feedback board, what you post is public. If you sign in, we keep your email address and name so you can follow ideas.
• We don't use advertising or tracking cookies, and we never sell your data.

Who we are

Narafy Limited is the data controller for personal data collected through this website. You can contact us about privacy at privacy@narafy.com.

The Narafy app

Narafy stores your notes, tags, stacks and settings in a database on your own device. We don't operate servers that receive or store your notes, and you don't need an account to use the app.

If you turn on AI features, the app sends the text needed for each request directly from your device to the AI provider you choose (for example Anthropic, OpenAI or Google), using your own API key. That provider's own terms and privacy policy apply to those requests. If you use a local model, nothing leaves your device. API keys are kept in your operating system's secure storage.

If you turn on the app's MCP server, AI assistants on your computer that you connect to it can read your notes, and change them if you allow it. You control which notes and what level of access they have.

This website

"Notify me" emails

When you ask us to notify you about Narafy's launch, we collect your email address, the date you signed up, and which form you used. We use this only to email you about Narafy's launch. Our lawful basis is your consent, which you can withdraw at any time by unsubscribing from any email or by contacting us.

The feedback board

On our feedback board (narafy.com/feedback) you can share ideas, vote and comment, with or without an account.

• What's public: the ideas and comments you post, the display name you choose, and when you posted. Please don't include anything private, such as the contents of your notes.
• Without an account: your browser gets a random identifier in a cookie, so we can recognise your votes and posts and let you edit them. We don't link it to anything else about you.
• With an account: you sign in with your email address and a one-time code. We keep your email address (never shown publicly), your display name, your votes, the ideas you follow, and your email preferences. A cookie keeps you signed in.
• Emails: if you follow an idea, we email you when its status changes or the team posts an update. If you ask for release emails, we email you when we publish release notes. Every email has a one-click unsubscribe.
• Abuse prevention: we keep a one-way, salted hash of your IP address with votes, posts and comments, to apply rate limits and spot vote stuffing. We can't turn it back into your IP address.

Our lawful basis is our legitimate interest in collecting product feedback and telling people what happened to their ideas, and your consent for release emails. You can delete your account at any time from your account page. That removes your email address, name, votes and follows; posts and comments stay on the board as "Deleted account" unless you ask us to remove them too.

The help centre

When you answer "Was this helpful?" on a help article, we keep your answer, the article, anything you write about what was missing, and a one-way hash of your IP address to stop abuse. We use these only to improve the help pages. The "Ask ChatGPT" and "Ask Claude" buttons open those services; nothing is sent to them until you select one, and their own terms apply.

Analytics

We use privacy-friendly analytics that count page views without cookies and without identifying you. We can't use them to follow you across other websites.

Bot protection

Our forms use Cloudflare Turnstile to block spam. Turnstile checks signals from your browser to tell people from bots; it doesn't use them for advertising. Our lawful basis is our legitimate interest in keeping our sign-up list free of abuse.

Server logs

Like most websites, our hosting provider records technical data such as IP addresses and browser types for a short time to keep the site secure and working.

Who processes data for us

We use a small number of providers, each bound by a data processing agreement:

• Vercel: website hosting and analytics
• Supabase: database for "Notify me" sign-ups and the feedback board, and email sign-in
• Cloudflare: bot protection and network services
• Resend: sending email

Some of these providers process data outside the UK, including in the United States. Where they do, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK-US data bridge.

How long we keep it

We keep your "Notify me" email address until you unsubscribe or ask us to delete it. We keep a feedback board account until you delete it. Ideas and comments stay public while they're useful to the discussion. Records used for rate limits are deleted after a day, and server logs are kept for no more than 30 days.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, ask to move it elsewhere, and withdraw your consent at any time. Email privacy@narafy.com and we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Changes

We'll update this statement when we add features such as app accounts or paid plans, and change the date at the top. If a change affects how we use data you've already given us, we'll tell you by email first.