Privacy Policy

Effective date: October 2, 2026

ParkourNote is a cloud research workspace operated by ParkourLabs, Inc., a Delaware corporation (“ParkourLabs”, “we”, “us”). This policy describes what we collect when you use ParkourNote — the website at note.parkourlabs.io, the ParkourNote apps for Android, iPhone and iPad, and the browser extension (together, the “Service”) — how we use it, and the choices you have.

Questions or requests: privacy@parkourlabs.io.

What we collect

Account information. Your name, email address, and a hashed password (we never store your password in plain text). If you sign in with Google, we receive your Google account email, name, and profile image; if you sign in with Apple, we receive your Apple ID email (or the private relay address Apple gives us) and your name. Each signed-in session records an IP address and browser or app user-agent string for security purposes. When you sign up with an email address, a Cloudflare Turnstile check confirms you are a person; Cloudflare receives your IP address and browser or device signals for that check.

Your content. The documents and media you upload or import (e.g., PDFs, EPUBs, web pages, video and audio files), and everything you create in the workspace: annotations, notes, handwriting notebooks, documents, chat conversations, and images you attach to chats or notes. We also store content derived from your documents to make features work: extracted and OCR-processed text, translations, AI-generated outlines, and figure images extracted from your documents.

Voice input. If you use dictation, your audio is sent to a speech-recognition provider and the transcript is returned to your session. We do not store the audio; the transcript is held for up to 10 minutes so that a retried request is not transcribed and charged twice, and is then discarded. We record the duration for usage metering. In the mobile apps, dictation can also run on your device, in which case the audio never leaves it.

Audio notes. If you record audio in a note or upload a recording, we store the recording, its transcript and an AI-written summary of the recording as part of your content, for as long as the recording exists in your library. The complete recording is sent to our speech-recognition provider for transcription; the transcript text is sent to an AI model provider to write the summary. We do not build voice profiles and do not identify people by their voice.

Usage information. We record product events tied to your account — for example that you imported a paper, requested OCR, sent a chat message, or completed a translation. To understand usage time, reading time and feature use, we also record in-app clicks and input-activity signals, the current interface, file/workspace identifiers and page/view, tab visibility and focus, timestamps, and periodic presence observations. These activity records do not contain clicked text, typed keys, search queries, message drafts or document content. We record that searches occurred, but not your search query text. We also keep per-request usage and billing records (feature used, AI model, token counts, credits charged). The number of days and the amount of time you use the Service also decide who receives a thank-you gift (see below).

Mobile apps. The Android, iPhone and iPad apps send us the same kinds of information as the website: your content, the usage and activity records described above (which interface you are in, file and workspace identifiers, page, taps, scrolling and typing activity, and timestamps — never what you typed or the text you tapped), and a time zone so that reading statistics count your days correctly (the time zone is not stored). Each installation creates a random identifier and a label such as “Android” or “iPhone” so that your tabs are kept per device; this identifier is not an advertising identifier, and the apps do not use advertising identifiers. Some features run on your device without sending your content to us: basic text recognition, offline translation and handwriting recognition use Google’s ML Kit, and offline dictation uses the speech recognition built into your phone. Google may receive basic device information and diagnostics about ML Kit itself, and ML Kit downloads its language models from Google.

In-app purchases. If you buy a membership or credits through Google Play or the App Store, the store processes the payment; we never see your card. The store sends us the purchase record (product, order or transaction identifier and purchase token), which we keep with your account to grant and renew what you bought. To link a purchase to your account, the app gives the store a random account token, never your email.

Apps you connect. If you connect Claude, ChatGPT, Codex or another AI app to ParkourNote, that app can read and change your library within the permissions you approve, and what it reads is sent to that app’s provider under your agreement with them. You can see and revoke connected apps in Settings → External AI.

Public page visits. When you visit our public pages (the home page, blog, legal pages, and the sign-in and sign-up pages), we record which page you viewed and when, which sign-up or sign-in buttons you clicked, the referring website (its domain only), and any campaign parameters (utm_*) or sharing code in the address. Each record carries the random visitor identifier from the cookie described below, so we can count unique visitors and see how many visits lead to a sign-up and to using the Service. If you create an account, that identifier is copied onto your account’s sign-up record, which links your earlier visits on that browser to your account. We do not store your IP address with visit records. If your browser does not keep our cookie, the visit instead carries a code computed from your IP address and browser user-agent together with a secret; that code changes every day and cannot follow you from one day to the next. We also look up, on our own servers, the approximate location your IP address indicates. The country is kept with the visit record and, when you create an account (on the website or in an app), with your account’s sign-up record. For visits, we also count the approximate city: those counts are kept per month, contain no identifiers, and cities with fewer than five visitors in a country are merged into a single “other” entry. Your IP address itself is not stored.

Error reports. When something breaks, we collect an error report that may include your account ID, the page you were on, a technical stack trace, your browser’s user-agent string, and recent in-app navigation steps. Error reports never contain the contents or titles of your documents, notes or chats: a navigation step records which kind of control you used, not the text on it, and before a report is stored we remove the values a failed request quoted, the query part of addresses, and any address outside ParkourNote beyond its site name. Error reports are stored and triaged on our own infrastructure — we do not use any third-party error-tracking or analytics service. To sort an error into the part of the Service it came from, we send its type, its message (with email addresses, long numbers and key-like strings removed) and the names of our own code involved to the classification model listed under Subprocessors; we never send your account ID, the page address, your user-agent or your navigation steps. Reports are typically deleted within about 30 days of an issue going quiet, after which only de-identified aggregate records are kept.

Feedback. When you send feedback from inside the Service, we store what you write, the numbered markers and notes you add, and — unless you turn it off before sending — a screenshot of the ParkourNote window as it was when you opened feedback, including any documents, notes or chats visible on screen. Parts you cover with the blur tool are pixelated in the stored image; the original pixels are never uploaded. We also store the diagnostic details listed under “What’s included” in the feedback form: the page label and path, app release, browser user-agent, window size, theme, language and recent request identifiers. Feedback is visible only to you and to the ParkourNote team, and we may email you when we reply.

Server logs. Our servers keep short-lived technical logs, automatically rotated and kept only briefly, that may include fragments of request data.

Cookies and local storage. We use only first-party cookies: session and security cookies for signing you in, and a 30-day visitor cookie set when you first open one of our pages. The visitor cookie holds a random visitor identifier (used for the visit records described above) and, if you arrived through a sharing link, a campaign address or another website, that sharing code, the campaign parameters (utm_*) and the referring site, so that the account you create can be credited to it. The identifier is generated in your browser and contains nothing about you. You can block or delete this cookie in your browser settings; the pages and the Service keep working without it. We use your browser’s local storage for interface preferences (theme, layout, and similar). We temporarily queue account-scoped activity records in browser storage for retry when a connection is unavailable. Acknowledged records are removed; pending records expire after seven days when the queue is next processed, and the queue is limited in size. We use no advertising cookies, no third-party analytics, and no tracking pixels.

How we use your information

• To provide the Service: storing and rendering your documents, syncing your notes, and powering search.
• To provide AI features you invoke: OCR, translation, chat, outlines, formula recognition, dictation, and web/paper search. See “AI providers” below.
• To send transactional email: account verification, password resets, and important service notices.
• To send occasional product emails, such as a thank-you gift for people who use ParkourNote regularly. Every such email has an unsubscribe link, and you can turn them off at any time under Settings → Account. Account, security and payment emails are not affected.
• To meter usage and administer credits and (when offered) paid plans.
• To secure the Service, prevent abuse, and debug problems.
• To understand product usage through our own first-party analytics.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Who can see your content

Our team does not look at the contents of your documents, notes or chats unless you explicitly share them with us — for example in feedback you send (including the screenshot and page name, if you leave them attached), in an email to support, or through a public link you create. Beyond that, we access content only when it is needed to investigate abuse or a security incident, or when the law requires it. Error reports and usage records, such as how many days and how long you used ParkourNote, contain no content.

AI providers and your content

AI features are powered by third-party AI providers. When you invoke an AI feature, the relevant content is sent to a provider to generate the result:

• OCR: your complete document file is transmitted to our OCR provider, even when you request OCR for only part of it.
• Chat and other language features: your messages, the conversation history, relevant document text (such as the pages you are viewing), and any images you attach are sent to the AI model provider you have selected or that we route to.
• Formula recognition: the region of the page you select is sent as an image.
• Web and paper search: your search query is sent to the search provider.
• Dictation: your audio is sent to the speech provider.
• Audio notes: your complete recording is sent to the speech provider; the transcript is sent to the AI model that writes the summary.

We do not use your content to train AI models. AI providers process your content under their own terms; some may retain inputs or use them to improve their services. Our Subprocessor List states what each provider has published about this.

The current list of providers, and what each receives, is maintained on our Subprocessor List.

Where your data lives

Your data is stored on Amazon Web Services infrastructure in Tokyo, Japan (application servers, database, and file storage). Pages, files and requests pass through Amazon CloudFront, a content delivery network with locations worldwide, on their way between your device and our servers. Our AI and email providers are located primarily in the United States and Europe; the speech-recognition provider for audio notes and dictation is StepFun’s international platform, whose processing location is not published. By using the Service you understand that your information is transferred to and processed in these locations.

Retention

• Your content is kept until you delete it or your account.
• When you delete a file, your annotations, notes, and file-scoped chats for it are deleted; the underlying document file is removed from storage when no account still references it. A removed or replaced file remains recoverable in storage for up to 30 days before it is purged.
• Database backups are kept for up to 14 days, so deleted data may persist in backups for that period before it is gone permanently.
• Usage, billing, and analytics records are retained while your account exists, for billing integrity and product operation.
• Public page visit records are retained for product analytics; they contain no name, email address, or IP address. When you delete your account, its sign-up record and the link to your visits are deleted with it. Monthly city counts contain no identifiers and are kept for product analytics. The country on your sign-up record is deleted with your account.
• Feedback (including screenshots) is kept until you delete your account, so we can follow up on the issue.
• Error reports: see above (about 30 days, then de-identified aggregates). Server logs: rotated automatically and kept only briefly.

Your rights

You can access, correct, export, or delete your data. In the Service you can edit your profile; delete files, notes, chats, recordings, workspaces, and tags at any time (deleted items stay in Trash for 30 days, then are deleted permanently); and delete your whole account from Settings → Account → Delete account, on the web or in the apps. How to delete your account explains what is deleted and what is kept. For anything the Service doesn’t yet cover — such as a complete export of your data — email privacy@parkourlabs.io from your account email and we will fulfil the request within 30 days, regardless of where you live.

Browser extension

The optional “ParkourNote” browser extension detects scholarly papers on pages you visit. Only when you click to import does it send the selected paper URL or PDF to ParkourNote. For local files or publisher PDFs, the extension reads the file in your browser, using your existing publisher access where available, then passes PDF chunks to the ParkourNote web app for upload to your account. It does not collect your browsing history or read or store your passwords or publisher cookies. It stores its settings and temporary transfer records (source URL, file label, and creation time) in your browser. Completed transfers are removed immediately; other records expire after 24 hours and are removed the next time the extension starts or you initiate a transfer. Uninstalling the extension removes its local records.

Extension diagnostics. So that we can see when the extension breaks, it sends error reports and usage counts to the ParkourNote installation you configured, and nowhere else. An error report carries the error message with any web addresses removed, a stack trace of the extension’s own code, which part of the extension failed and at which step, the extension version, and your browser engine and version; when the extension is signed in, the report is attributed to your account. A usage count records what kind of page the panel was used on (a video, a paper, or a web page), which action you took (clip, import, ask, note, message), whether it succeeded, and how long a save took. When the extension is signed in, its side panel also records the same kind of content-free activity signals as the Service — that the panel is open, visible or focused, and that you clicked, scrolled or typed in it, with timestamps — attributed to your account, so we can measure how long the extension is used. Diagnostics never include the address or title of the page you are on, the text you selected, or what you typed; they are not browsing history. They are processed entirely on our own infrastructure and deleted on the same schedule as other error reports (about 30 days after an issue goes quiet). A report that could not be sent waits in your browser’s extension storage for up to seven days. You can turn diagnostics off on the extension’s options page (“Send diagnostics to ParkourNote”).

Children

The Service is not directed to children under 13, and you may not use it if you are under 13. If we learn we have collected personal information from a child under 13, we will delete it.

Changes

We will post any changes to this policy on this page and update the effective date. For material changes we will notify you in the app or by email before they take effect.

Contact

ParkourLabs, Inc. privacy@parkourlabs.io (privacy requests) · support@parkourlabs.io (general support)