Privacy Policy

Our Privacy Policy was last updated on October 10, 2026.

At Qenot, the privacy of the students who use it is one of our main priorities. This policy explains what we collect, why, what leaves our servers, and what you can do about it. If you have questions, email support@qenot.com.

It applies to qenot.com and the Qenot app, and to the information you share with us or that we collect there.

Consent

By using Qenot, you consent to this Privacy Policy. Analytics and ads measurement are the exception, and depend on where you are: in the United States they're on unless you turn them off in “Your privacy choices”; everywhere else they run only if you choose “Accept all” in the cookie banner.

Information we collect

Account: your email address, and your name and profile picture if you sign in with Google.
Welcome questions: if you answer them, how you found Qenot, what you study, what you want first and your school or university. Every question is optional, and you can skip them.
What you upload: notes, slides, PDFs, past exams, scanned pages, photos of handwritten answers, links you add, and the text extracted from them.
What you produce: generated notes, flashcards, quizzes, exam attempts, answers, grades, chats, research reports, recall cards and progress.
Usage: counts of operations, for enforcing plan limits.
Where you are, from your IP address: your country, looked up on our own server to show the plans offered where you are and to choose the cookie rules for you. When you sign up we also keep your country and your US state or UK nation, to see where students find us. Your address itself is not stored. The lookup uses IP Geolocation by DB-IP; your address is not sent to them.
How you found us: the campaign link or website that brought you here (its campaign tags, the referring site's name and the page you landed on), kept in a first-party cookie for 90 days and saved with your account when you sign up.
If you contact us: your email address, what you write and anything you attach.

We never see your password or your card details. Sign-in is handled by Supabase and payment by Dodo Payments.

How we use your information

To provide, run and maintain Qenot: storing your material and making study material from it.
To answer your questions, grade your answers and write research reports.
To understand which features help, and improve them, only if you allow analytics.
To email you about your account (sign-up, password reset, payments) and, if you turn it on, a daily recall reminder. Every reminder has a one-click unsubscribe.
To find and prevent fraud and abuse, and to keep the service secure.
To keep the records tax law requires, through our merchant of record.

We process your data to perform our contract with you, for our legitimate interest in keeping the service working and safe, to meet legal duties, and, for analytics, with your consent.

What leaves our servers (please read this part)

To generate study material, answer your questions, grade your answers and write research reports, Qenot sends extracts of your material to outside services. This is the core of how the product works, and you should know exactly who receives what:

Google (Vertex AI and the Gemini API): the text and images of your material, your questions and answers, to generate study material, answer, grade and write research reports.
Groq: voice recordings you dictate, to turn them into text.
Tavily: the search queries behind Search Web and Research.
Jina: web pages Qenot reads for you, and passages it ranks for relevance.
YouTube: the address of a video you add, to fetch its title and transcript.
Apify: the address of a YouTube video you add, to fetch its captions for Qenot.

These services process what we send to return a result. We send only what a given task needs, not your whole library, and Qenot itself never uses your material to train AI models.

If a document is confidential, do not upload it. That is the honest advice, and it applies to any AI study tool, not only this one.

Log files

Like most websites, our servers keep standard logs of requests: IP address, browser type, date and time, and the page asked for. We use them only to run the service, fix problems and protect it from abuse, never to build a profile of you or for advertising. Error reports (Sentry) carry technical diagnostics with personal data scrubbed, and are kept for 90 days.

Cookies

Necessary: sign-in cookies keep you signed in, and a first-party cookie (qn_attr, 90 days) remembers which campaign link or website brought you here. They carry no identity of yours and are always on.
Analytics and ads measurement: PostHog (product analytics) and the Meta Pixel (to measure our ads). In the United States they're on by default; turn them off any time in “Your privacy choices” in the footer, and a Global Privacy Control signal from your browser turns them off automatically. Everywhere else they run only if you choose “Accept all” in the cookie banner, and you can change that any time from “Cookie settings” in the footer.
Error reports are not gated: they carry no content and no identity beyond an account id, and we rely on them to keep the service working.

You can also block cookies in your browser, though you then can't stay signed in.

Third parties

These services process data for us, each under its own privacy policy:

Supabase: database and sign-in.
Google Cloud: the servers Qenot runs on.
Cloudflare: file storage (R2) for what you upload, and the network our site is served through.
Dodo Payments: payments. They are the merchant of record and receive your billing details. We never receive your card number.
Resend: account emails, and the recall reminder if you turn it on.
Sentry: error reporting, with personal data scrubbed.
PostHog: product analytics and session replay, only if you allow it. Everything you type (notes, answers, chat) is masked in replays.
Meta: to measure our ads, only under the cookie rules above. The Meta Pixel in your browser reports page views, sign-up and the start of a checkout. Our server reports a sign-up and a payment (its amount and currency) with your email address hashed (scrambled one way, as Meta requires), so the two can be matched. Nothing from your study material, chats or answers is ever sent.
YouTube: a video you add plays in YouTube's own player, in its privacy-enhanced mode, and YouTube's privacy policy applies to it.

We do not sell your personal information for money. The Meta measurement above is the only sharing for advertising, and you can turn it off. Some US state laws call that “sharing” for targeted advertising, so the next section covers your right to opt out.

How long we keep it

Your content: until you delete it, or 30 days after you delete your account.
Account records: while your account exists. When you delete your account it is closed straight away and erased 30 days later; in between, it can be restored only if you ask us to.
Payment records: invoices are held by Dodo Payments, as long as tax law requires. When an account is erased we keep, for our own tax records, a record of each payment event (its payment reference, type, amount, currency and date) with your account, name and email removed.
Error logs: 90 days.

US state privacy rights (California and other states)

If you live in California (CCPA/CPRA) or another US state with a consumer privacy law, you have the right to:

Know what personal data we collect, use and share, and get a copy of it.
Correct it, or have it deleted.
Opt out of sharing for targeted advertising (the Meta measurement): use “Your privacy choices” in the footer. We honor the Global Privacy Control signal as an opt-out too, without you doing anything.
Use these rights without being treated differently for it.

To ask for anything else on this list, email support@qenot.com. You can also export your data and delete your account yourself in Settings.

GDPR data protection rights

Every user is entitled to the following:

The right to access: a copy of your personal data, free of charge.
The right to rectification: to have inaccurate data corrected, or incomplete data completed.
The right to erasure: to have your personal data erased, under certain conditions.
The right to restrict processing: to have the processing of your data restricted, under certain conditions.
The right to object to processing: to object to our processing of your data, under certain conditions.
The right to data portability: to have your data transferred to you, or to another organization, under certain conditions.

We apply these rights to everyone, wherever you live. Download a copy of your data and delete your account yourself from settings, or email support@qenot.com. We reply within 2 business days, and complete any request within one month.

Children's information

Qenot is for people aged 16 and over and is not directed at anyone younger. We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has given us personal data, email us and we will delete it promptly.

Security

Traffic is encrypted in transit. Passwords are hashed by Supabase and never reach our servers. Your sign-in session is kept in cookies that only our site can use. Access to production data is limited to the operator.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay.

International transfers

Your account and study data are stored in a database in Singapore (Supabase, ap-southeast-1) and your files with Cloudflare R2, which stores them in its global network. AI processing runs on Google Vertex AI's global endpoint, and the other providers listed above process data in other countries including the United States and the European Union. Using the service means your data is transferred to those countries.

Changes to this policy

We will announce material changes in the app or by email before they take effect, and the date at the top of this page shows when it last changed.

Questions? Email support@qenot.com.