Privacy policy

NoteSurge (“we”, “us”) is a content-planning and publishing tool operated at notesurge.com. Questions about this policy: use the in-app support chat (Settings → AI tab) or contact the account owner through the app.

The extension’s single purpose is to connect your own accounts to your own NoteSurge library, and to save content you choose to save while browsing:

• Substack session cookie (substack.sid): read once, when you click “Connect my Substack”, and sent only to your NoteSurge account over HTTPS so it can verify and link your publication. It is httpOnly — page scripts can’t read it; only the extension’s cookies API can.
• NoteSurge session cookie: used to authenticate the extension to your account, the same as signing in through the browser.
• Content you capture: posts, bookmarks, and saved items you explicitly save (or scroll past on a capture page) on X/Twitter, LinkedIn, Mastodon, Bluesky, Substack, Ghost, Hashnode, Tumblr, Reddit, Dev.to, VK, Warpcast, Lens, Minds, Facebook, Pinterest, Instagram, TikTok, YouTube Shorts, Kick, Twitch, WordPress, Blogger, Whop, and Dribbble are stored in your NoteSurge library for repurposing.
• Niche corpus: other people’s posts you bookmark or save with the extension, look up in Research, or add by pasting a post link are also kept in your workspace’s niche corpus, so you can search what is working in your niche. Each one keeps its text, its author, the engagement numbers seen when you captured it, and a link to the original post. We skip posts we can tell are protected, private or yours, but platforms do not always tell us, so a post that should have been skipped can get in: you can remove any single post, delete everything from one author, or empty the corpus at any time in Settings. A protected post you save to your library is kept there but not copied into the corpus; posts you saved to your library before this update carry no such mark, so they count as unchecked. A post that becomes protected after you saved it from a link is not noticed (only bookmarks and LinkedIn saves are re-checked when they are sent again), so remove any you do not want. Posts whose visibility we could not check (LinkedIn does not say who may see a saved post; posts saved to your library before this update were never checked; early test entries) are kept only if you turn that on. Nothing is collected just from scrolling or viewing a page, and no cookie or sign-in token is stored with a post. The corpus belongs to your workspace alone: it is never shown to, or searched by, any other workspace.
• Ad research: ads you save from an official ad library (Meta’s Ad Library or TikTok’s Commercial Content Library, when NoteSurge has been connected to them) or from a file you upload are kept in your workspace with the advertiser, the ad text the library returned and a link to the ad. They are public library records. No ad library page is scraped, no access token is stored with an ad, and you can delete every saved ad from Discover at any time.
• Media downloads: when you click download on a tweet’s image or video, it is saved straight to your computer — it does not pass through our servers.

Your account data, connected-account references, drafted/scheduled notes, and captured library pieces live in NoteSurge’s hosted database, encrypted in transit (TLS) and at rest by our infrastructure providers. Extension-side storage holds only small preferences and connection state locally on your device (the connected publication, the opt-in declutter toggle).

When you connect LinkedIn, NoteSurge receives your LinkedIn member id and name, and an access token that lets it post for you. The token is stored encrypted and is used only to publish what you schedule and to read the numbers described below.

If you use LinkedIn company pages, NoteSurge also receives the list of pages you administer (name, logo link and your role on each) and shows it only to you and your workspace. For the pages you turn on, it reads each page’s follower count and LinkedIn’s organic post statistics once a day, and the counts for the posts it published as that page. It does not read, store or show other LinkedIn members’ profile information, comments, reactions or messages, and never uses LinkedIn data for advertising, sale or profiling.

A page’s name and logo link are refreshed every two weeks and cleared if they could not be refreshed within eight weeks. Follower and statistics history is deleted after one year. Disconnecting LinkedIn in Settings deletes the stored page list and statistics straight away, and you can also remove NoteSurge’s access from your LinkedIn account settings. To ask us to delete anything else we hold from LinkedIn, use the support channel above.

• We do not sell your data.
• We do not use your data for advertising or retargeting.
• We do not use your data for creditworthiness or lending.
• We do not transfer your data for any purpose unrelated to the feature you invoked.

Limited Use disclosure: NoteSurge’s use of information received from the browser extension adheres to the Chrome Web Store User Data Policy Limited Use requirements: data is used only to provide the feature you asked for, is not sold, is not used for advertising, and is not transferred to third parties except to operate those features.

When you use Notey (the built-in agent), rewrite tools, or fan-out, the content you submit is processed by the AI provider configured for your account — your own API key where you bring one, or the built-in free provider otherwise — solely to produce the answer or draft you requested. The extension itself never calls AI providers; AI traffic goes app → provider only.

NoteSurge can search your Library and saved memories by meaning as well as by keyword. To do that it splits your text into short passages and stores each passage in your workspace, with a list of numbers (a vector) that stands for what the passage means. Keyword search over those passages needs no outside service at all.

What is sent, and where. Only when an embedding provider is set up for your workspace, the text of your passages is sent to that provider to be turned into vectors, and so is each search you run in this mode. The provider is, in this order: your own OpenAI key, your own OpenRouter key, a shared OpenRouter key if the operator turned that on, or an embedding server the operator runs. Your key is only ever sent to its own provider. We keep the vectors the provider returns and use only open-licensed models on the shared and self-hosted routes.

What is never sent. Nothing is sent unless a provider is set up. Archived pieces, pieces you tag private (or mark as excluded from search), and memories that are not active are never indexed and never sent to a provider. They are also kept out of everything an AI model reads from your Library through search: the proven-post chat and an agent's search never see them. The passages and vectors are scoped to your workspace, are not shared with other workspaces and are deleted with the piece, the memory or the workspace.

NoteSurge can record product-usage events so we can see, in the aggregate, which features get used and where things stall. This is off by default. No event is stored for an account unless someone opted in, and the server refuses to store one otherwise.

What an event holds is metadata about what happened, not what you wrote. Examples of what we record:

• That a note was scheduled, published or failed, with the platforms it went to, its content type, and the platform’s error message when a publish fails.
• That a draft was created, reviewed or discarded, and which repurpose or rewrite tool was used.
• That the agent showed a digest, or a proposal was approved or dismissed.
• For each agent run, a timeline of what ran and how long it took: which tools were called, how many model calls it made, token counts, and how a failure was classed. Never the prompt, the tool inputs, the results or the reply. Timelines older than 14 days are cleaned up automatically, and turning the switch off deletes your stored timelines straight away. If we switch on a monitoring service for the agent, each new timeline is also sent there with the same details and without your account or workspace ID; copies already sent there follow that service’s own retention.

We do not put your note text, hooks or voice in these events. Each event is tied to your account and workspace, so it is not anonymous inside our own database.

To turn it on or off, go to Settings, then Account & appearance, then Privacy & data, and use the “Share product usage data (no note content)” switch. Turning it off stops new events from being stored right away. The usage terms for the service are on the terms page.

Your content is retained while your account is active. Deleting a piece removes it from the library; deleting captured captures follows the same rule. Account deletion removes your account and associated content — request it from Settings or via the support channel above.

Niche corpus posts follow the same rule and can be removed sooner: from Settings, Niche corpus, you can delete everything captured from one author, empty the whole corpus, pause capture, or choose to have posts you have not seen again removed after 30, 90, 180 or 365 days.

Material changes will be reflected here with an updated date above.