Privacy Policy
Knotbook is a product of Spyxpo, operated by Spyxpo Technologies Private Limited (CIN U62011BR2025PTC079225), registered office C/O Krishna Murari Kumar, Begusarai, Bihar 851101, India. Effective 2026-09-25. Applies to the Knotbook desktop application and the knotbook.app website.
Knotbook is local-first. Your notes are markdown files in a folder you chose, on your own disk. We do not have them, cannot read them, and have no server that stores them.
This document is the same table the repository has always carried, published where the people using the app can read it. It lists every case where the app touches the network, including the ones it would be convenient to leave out.
What we collect
Nothing automatically. There is no telemetry, no analytics, no crash reporting, no usage measurement, and no account. The app does not phone home to tell us it started, what you opened, or how long you used it.
The only personal data Spyxpo holds is what you give us directly:
| If you… | We hold | Why | Kept |
|---|---|---|---|
| Buy a Pro licence | Email address, licence key, payment reference, device identifiers of activated devices | To issue the licence and enforce the 3-device limit | Until you ask us to delete it |
| Email support | Whatever is in your message | To answer you | 24 months |
Payments are taken by Razorpay, who handle card details. We never see or store them.
Every network connection the app makes
| Subsystem | Talks to | Default | Carries |
|---|---|---|---|
| Notes, search, index, backlinks, graph, PDF text, KnotAI memory | Nothing | Not applicable | Nothing |
| Diagnostic log | Nothing: a local file | Always written | Stays on your machine unless you attach it to something |
| Update check | knotbook.app only: the update endpoint, the public release list, and the update download (which knotbook.app redirects to Google Cloud Storage, firebasestorage.googleapis.com, when you install one) | On, after you choose it on first run | Operating system, processor type, Knotbook version and update channel. Nothing about you or your notes |
| Pro licensing | asia-south1-knotbook-spyxpo.cloudfunctions.net | Only if you buy Pro | Licence key, device identifier |
| KnotAI model download | huggingface.co, github.com | Off. Starts only when you press Download in KnotAI setup | Nothing about you |
| KnotAI inference | Loopback only: a local llama-server | Fully local | Nothing leaves the machine |
| KnotAI web results | html.duckduckgo.com | Off. You turn on Web for a single message, and it switches off again after that message | The words of that message |
| Live collaboration | Your network, and your router via UPnP if you allow it | Off; explicit action, with a prompt | Note content, encrypted, to the people you invited, plus the note's title and the session code, which the handshake sends unencrypted |
| Web clipper | 127.0.0.1:7470 (this machine only) | Requires a token you paste in | The page you clipped |
| RSS | The feeds you added | Only feeds you add | Requests for the feeds you added |
The IMAP and SMTP servers of the accounts you add (for example imap.gmail.com, outlook.office365.com, imap.mail.me.com), and Google's or Microsoft's sign-in servers for Gmail and Outlook | Off. Only accounts you add | Your sign-in or app password, and the mail you read, send, move or delete, directly between your computer and your provider | |
| Calendar sync | Google Calendar API (www.googleapis.com) or Microsoft Graph (graph.microsoft.com) | Off. Pro, and only for accounts you connect | Your calendar events, directly between your computer and Google or Microsoft |
Nothing in the app sends analytics. The website at knotbook.app can use Google Analytics for Firebase, but only after you allow it (see below); the app never does. Saying so is what makes the rest of this table worth believing.
The website, cookies and similar storage
The knotbook.app website stores a few things in your browser. Only the first group is needed for the site to work; everything else is off until you turn it on in the banner shown on your first visit, and you can change your mind at any time under Privacy choices.
| Name | Kind | Category | Purpose | Kept |
|---|---|---|---|---|
knotbook.consent | localStorage | Strictly necessary | Records your choice in the privacy banner | Until you withdraw it or clear site data |
knotbook-theme | localStorage | Strictly necessary | Remembers light, dark or system theme | Until you clear site data |
| Firebase Authentication (IndexedDB) | IndexedDB | Strictly necessary | Keeps you signed in to your account, only if you sign in | Until you sign out |
_ga, _ga_* | Cookies | Analytics (optional) | Google Analytics for Firebase: aggregated page views, so we know which pages are useful | Up to 2 years |
Google reCAPTCHA (_GRECAPTCHA) | Cookie and browser signals | Strictly necessary (security) | Loaded only on the sign-up, password reset and checkout pages to tell people from automated abuse. There is no puzzle; Google scores the request and we reject low scores. Google's Privacy Policy and Terms apply | Up to 6 months |
We do not use advertising cookies, do not sell data, and do not share it for cross-site tracking. Rejecting analytics does not change anything else on the site.
Email and calendar
Email and calendar work the same way as your notes: the data stays on your device, and Spyxpo never receives it.
- Stored on your device. Mail, drafts, calendar events and reminders are kept in a local database in Knotbook's data folder on your computer.
- Direct connections only. The app connects directly to Google, Microsoft or the IMAP and SMTP servers of your mail provider. There is no Spyxpo server in between, and nothing from your mailbox or calendar is sent to Spyxpo.
- Credentials. Passwords, app passwords and sign-in tokens are encrypted with a key held in your operating system's keychain (Keychain on macOS, Credential Manager on Windows, the Secret Service on Linux). If no keychain is available, as on some Linux systems without a desktop session, the key is kept in a file in Knotbook's data folder instead, and Settings says so.
- What Google and Microsoft see. Signing in with Google or Microsoft gives Knotbook access to your mail, and to your calendar if you connect it, from your computer only. The provider's own privacy policy covers what it does with that access on its side.
- Removing an account. Removing an account in Settings deletes the mail and calendar data stored for it on your computer, and deletes its credentials. Mail on your provider's server is not affected. You can also revoke Knotbook's access from your Google or Microsoft account settings at any time.
Google user data. Knotbook's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail and Google Calendar is used only to show, search, compose and sync your mail and calendar inside Knotbook, and for the KnotAI features you use on your own computer. It is not transferred to Spyxpo or anyone else, not used for advertising, not used to train AI models, and not read by anyone at Spyxpo.
KnotAI and memory
KnotAI runs on your computer. When it answers from your notes, emails or calendar, reads text from an image, or remembers something, the work is done by the local model and the results are stored on your computer. Its memory (facts you asked it to remember and summaries of past conversations and tasks) can be viewed, edited and deleted in Settings, under KnotAI memory. None of it is sent to Spyxpo. The only exception is web results, described in the table above, which you switch on per message.
The diagnostic log
The app writes a log file to help diagnose crashes. It stays on your machine,
rotates at 2 MB keeping four files, and paths inside it are shortened: a path
under your home directory is written as ~/…, so it does not carry your user
name off the machine even if you send it to us.
We never collect it. If you attach it to a support email, we read it to answer your question and nothing else.
Find it at Settings → Diagnostics → Show in folder.
Your notes
Your notes are not our business, in both senses. They are files on your disk. Deleting Knotbook does not delete them, and deleting your notes folder deletes them permanently. We have no copy to restore from.
Your rights
Email privacy@spyxpo.com to ask what we hold, correct it, or have it deleted. Deleting your licence record deactivates your Pro licence, so we will confirm before doing it. We answer within 30 days.
Children
Knotbook is not directed at children under 13, and we do not knowingly collect data from them.
Changes
Material changes are announced in the app before they take effect, and the effective date at the top of this document changes. Continuing to use Knotbook after that means accepting the revision.
Grievance Officer
Under the Information Technology Act 2000 and the rules made under it, and the Digital Personal Data Protection Act 2023, complaints about how your data is handled can be sent to our Grievance Officer:
- Name: Mantresh Khurana, Founder, MD & CEO
- Email: mantreshkhurana@spyxpo.com
- Acknowledgement: within 24 hours · Resolution: within 15 days
Contact
Spyxpo Technologies Private Limited privacy@spyxpo.com · https://knotbook.app
Spyxpo's group-wide policies are at spyxpo.com/policies.