Privacy
Privacy policy
Your notes are files on your Mac, or kept by your browser, and Graphite keeps no copy of them. This page says what Graphite does keep — what you send it, and visits counted without cookies — who handles it, and how to have it deleted.
Last updated
In short
- Your notes and your AI key are kept on your device, and Graphite keeps no copy of either. When you ask Graphite something, what it's about goes to the AI provider you chose.
- Visits are counted without cookies and without knowing who you are, and not at all if you say no, with the switch below or your browser's Global Privacy Control.
- What you send us, like a message or an address to write to, is kept only to answer you.
- Nothing about you is sold, or used for ads.
- To see or delete what we have about you, write to support@graphitenotebook.com.
Who we are
Graphite is the notebook at graphitenotebook.com, in a browser and as a Mac app. In this policy, “Graphite”, “we” and “us” mean the people who make it, who decide what's done with what's kept. For anything about your data, write to support@graphitenotebook.com.
Your notes
In the Mac app, your notes are markdown files in a folder on your Mac. In a browser, they're kept by that browser, on that device. Graphite has no copy of either.
Nothing of a note is sent until you ask, and filing your Inbox and reading receipts are off until you turn them on. When you ask Graphite something, what it's about goes to the AI provider whose key you added, with your key.
In the Mac app, your key is kept in your Mac's Keychain — or, if you turn that off in Settings, in Graphite's own file on your Mac, unencrypted — and a request goes from the app's own server, running on your Mac, straight to your provider.
In the browser, your key is kept in that browser and sent with each request, along with the notes it's about, through Graphite's server to your provider. The server passes them on and stores neither.
The provider's own terms and privacy policy say what it does with what it's sent: you chose it, and the key is yours. What each kind of request sends, and when, is set out in full on Your files, and what Graphite sends.
What we keep, and why
A message you send us
When you write to us, from Contact or Pricing or to support@graphitenotebook.com, we keep your email address, your name if you give it, and what you wrote — in Graphite's database and in our mailbox — so we can answer you. For a message sent from the site, we also keep a code made from the network address it came from, never the address itself, so no one can send more than a few an hour.
We keep a message while we may need it to help you, and delete it when you ask.
An address to hear when a plan opens
If you ask on Pricing to hear when Plus or Pro opens, we keep your email address and which plan, to write to you once, when it opens. Then we delete it, or sooner if you ask.
Visits to the site
The site and the notebook in a browser count visits with Vercel Web Analytics — the page, the site you came from, roughly where you are (the country, region and city), and your browser, system and kind of device — with no cookies, and never what you write. They also count what's pressed on the site — each Mac download, each opening of the notebook, each message sent, each plan asked about and each Graphite act tried on an article — and in the notebook each note made and each request Graphite answers: each by its kind, never by who, and never by a title or any words. A browser that sends Global Privacy Control or Do Not Track isn't counted, and nor is one where the privacy policy's switch is turned off. The Mac app counts nothing.
Vercel, which runs the site, makes the counts. It tells one visit from another by a code made from the request, which changes every day, so no one can be followed from one day to the next or from one site to another, and it keeps no counted visit with a network address.
Your visits are counted in this browser.
Requests to the site
Vercel, which hosts the site and Graphite's server, logs each request it serves — when, which page, the network address it came from and the browser — and keeps those logs for a short time, to keep the site running and safe. Graphite logs which action ran, how long it took and the kind of any error — never a note, a question or a key.
The Mac app
The Mac app sends us nothing about you or your notes, and counts nothing. Now and then it asks Graphite's server whether there's a newer version: a request that carries nothing about you or your notes, which Vercel logs like any other.
Who handles it for us
Graphite runs on these services, which handle what we keep for us:
- Vercel hosts the site and Graphite's server, and counts visits.
- Supabase keeps Graphite's database: messages and addresses left for a plan.
- Resend sends Graphite's email: messages from the site to our mailbox.
- Google Workspace keeps our mailbox, support@graphitenotebook.com.
Most of what they keep for us is in the United States: Graphite's database and its email are in Amazon Web Services' us-east-1 region, in Virginia. If you're in the EU or the UK, that means your data leaves for a country your law treats differently, and each of these services offers the safeguards that law asks for, such as the EU's standard contractual clauses.
Your AI provider isn't one of them. You chose it and hold its key, so what it does with what it's sent is between you and it, under its terms — and the same goes for OpenRouter, if you connect it.
Your rights, and deleting your data
Write to support@graphitenotebook.com and we'll do any of these, within 30 days, at no cost:
- Delete what we have about you — your messages and the address you left for a plan: everything kept under your email address. Write from that address, or name it, and we'll tell you when it's gone.
- Send you a copy of what we have about you, or correct it.
- Stop using it for anything you object to.
Your notes aren't ours to delete: they're on your device. Delete a note in Graphite, or all of them at once — in a browser, by clearing this site's data in the browser's settings; on a Mac, by deleting the notebook's folder, and the app's own files in ~/Library/Application Support/Graphite.
If you're in the EU or the UK, the GDPR gives you these rights, and the right to complain to your data protection authority. We rely on your consent, for an address to hear when a plan opens, which you can withdraw whenever you like; and our legitimate interest in answering you, in knowing how the site is used without knowing who you are, and in keeping it safe, for messages, counted visits and request logs.
If you're in California, we don't sell or share personal information, as the CCPA uses those words, and we honour Global Privacy Control. You can ask to know, delete or correct what we have, and asking won't change how you're treated.
Children
Graphite isn't meant for children under 13, and we don't knowingly keep anything about them. If you think a child has written to us, tell us and we'll delete it.
Changes
When this policy changes, the date at the top changes too, and a change to what we keep is said in the release notes.