Privacy Policy

Last updated 30 October 2026

Utsushi is built so that we can't read your notes. This policy explains what we do see, and why. It's provided by A2.AI PTY LTD, Australia, and follows the Australian Privacy Principles.

What we can't see

Note content, note titles, folder names, machine names, images and attachments are encrypted on your device before they leave it (AES-256-GCM, with a key derived from your password). Your real password never reaches us.

What we collect

• Account: your email address, and the encrypted copies of your keys.
• Profile: the display name and avatar or photo you choose — shown to people you share notes with.
• Service data: ids, timestamps and sizes of notes and machines, bookmark flags, your plan, and which machine is online on which note id. We need these to sync, enforce plan limits and show who's online.
• Invitations: the email address of someone you invite before they have an account, until they join or you withdraw it.
• Organisations: if you're in a Team or Enterprise organisation, its name, its members' email addresses, roles and invite status, seats, and an audit log of metadata: invites, joins, removals, role changes, org folder changes, and settings and billing changes, with times and who made them. The audit log never contains note content. The organisation's admins can see its membership and audit log. They can also see when members sign in and when members create an AI connection that can read the organisation's notes (only the time, and whether it covers all notes or one folder).
• Payments: handled by Stripe. We receive your Stripe customer id, subscription status and renewal date — never your card number.
• Support: whatever you send us when you contact us.

Crash and update reports. Unless you turn off "Send crash and update reports" in Settings, the app sends us daily launches, update outcomes and error diagnostics. They're linked to your account and a random installation ID (the id made for each machine you sign in on). A report holds the app version, your platform and the kind of event. For an error it also holds the error's type and where in the app's own code it happened (file, line and column). It never holds the error's message, your notes or your keys. Only we can read reports. We use them only to decide whether an update is safe to send to more people, and we delete them after 90 days, or sooner if you delete your account.

We don't use advertising or third-party analytics, and we don't sell personal information.

AI connections (MCP)

The desktop app's AI connections run a local MCP server on your own computer (127.0.0.1). It only accepts requests from that computer, and nothing it serves passes through us: we don't receive what it reads, or its activity log, which stays on your device. Changes an AI app writes sync like any other edit, encrypted on your device first.

When an AI app reads your notes through a connection, it sends that text to its model provider, under that provider's terms and privacy policy, not ours. To keep everything on your machine, use a local model.

The AI import helper

When an export you're importing is in an unusual format, you can ask an optional AI helper to work out its structure. Before anything is sent, the app shows you exactly what will go. By default that's only the structure of the file, with the text replaced by tokens. Sample note text is included only if you tick the box to allow it. It goes to our server and then to an AI provider through OpenRouter, using routing that doesn't retain the data. We don't store it. If you don't use the helper, nothing from your import leaves your device unencrypted.

Approving a new device

If you've lost your password, you can approve a new device from one you're already signed in on. Only public keys and encrypted data pass through our server during approval, so we can't read your notes or keys.

Who processes it

• Supabase — database, sign-in and file storage (hosted in Sydney, Australia).
• Stripe — payments and invoices.
• Resend — account and invitation emails, sent from hello@utsushi.a2ai.com.au.
• OpenRouter and the AI provider it routes to — only if you use the optional AI import helper, with no-retention routing.
• Vercel — this website.

Some of these providers may process data outside Australia; we use them under their standard data-protection terms.

How long we keep it

For as long as your account exists. Deleted notes stay in the Bin for your plan's Bin period, then are removed. When you delete your account, your notes, machines and profile are removed from our database; backups age out within 30 days. Payment records are kept as tax law requires. An organisation's membership records and audit log are kept while the organisation exists, or for the retention period in an Enterprise contract.

Your choices

• Change your display name and avatar, export your notes, or delete your account in Settings.
• Turn link previews off in Settings if you don't want the app to fetch web pages you link to.
• Ask us for a copy or correction of the personal information we hold, or complain about how we handle it, at support@a2ai.com.au. If you're not satisfied with our reply you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We'll post updates here and tell you in the app before material changes take effect.