Privacy Policy

Last updated 20 October 2026

ClippyNote is a workspace for notes, documents, databases and calendars. It is an Inspo product, operated from the Kingdom of Bahrain ("ClippyNote", "we"). This policy explains what personal data we handle, why, and the choices you have. Questions: admin@clippynote.com.

What we collect

• Account data: your name, email address, a hash of your password (never the password itself), and your language and time-zone settings.
• Workspace content: the pages, databases, files and comments you and your workspace create.
• Calendar data, only if you connect a calendar (see below).
• Technical data: IP address, browser and device details, and logs we need to run, secure and fix the service.
• Waitlist: if you ask for access on this site, the email address and note you send.

How we use it

To provide the service you use; to keep it secure (preventing abuse and investigating incidents); to contact you about your account; and to meet legal obligations. We do not sell personal data, and we do not use your content or calendar data for advertising.

Google Calendar and Apple iCloud Calendar

Connecting a calendar is optional and always your choice.

What we access. When you connect Google Calendar, we ask Google for permission to see the list of your calendars and to read their events. Only if you turn on Allow editing do we ask for permission to create, change and delete events on Google calendars you own. You can stay connected read-only and never grant editing. For Apple iCloud, you give us an app-specific password that you create at account.apple.com; we use it only to read your calendars and to save the changes you make in ClippyNote.

What we store. The calendars you connected (their names and colours), a copy of their events from one year back to two years ahead (titles, times, time zones and repeat rules), and the connection credential (Google's refresh token or the Apple app-specific password), encrypted with AES-256-GCM using a key kept outside our database.

How we use it. Only to show your calendars inside ClippyNote and to carry out the changes you make there. A change you make to an event is written only to the calendar that event belongs to, never to any other calendar, and never between Google and Apple. ClippyNote does not invite or email anyone on your behalf.

Who can see it. Your connected calendars are private to you. Other members of your workspace, including its owners and administrators, cannot see them unless you choose to share a specific calendar with your workspace, and you can stop sharing at any time. Your private ClippyNote calendar follows the same rule. Our support tools cannot read calendar event contents.

Google API Services User Data Policy. ClippyNote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the calendar features described here. It is not sold, not used for advertising, not used to train artificial-intelligence models, not used to determine creditworthiness, and not transferred to anyone except as needed to provide these features, to comply with the law, or as part of a merger or acquisition with notice to you. People at ClippyNote do not read it, except with your permission for a specific support request, to investigate security or abuse, or where the law requires.

Disconnecting. Disconnecting a calendar account removes the connection, its stored credential and our copy of its events; for Google, we also revoke our access at Google. If you made changes in ClippyNote that have not yet been saved to your calendar, ClippyNote tells you first, so you can save them or choose to discard them. Disconnecting never deletes anything in your Google or Apple calendar. You can also revoke ClippyNote's access at any time in your Google Account (Security → Third-party access) or by deleting the app-specific password at account.apple.com.

Sharing and service providers

Inside a workspace, your content is visible to the people your workspace gives access to; your connected calendars are not (see above). We use service providers to run ClippyNote, under contract and only as needed: Amazon Web Services (application hosting, Mumbai region), Supabase (database, Mumbai region), Cloudflare (network, security and file storage), and Postmark (email delivery). Payments, when paid plans are offered, are processed by Tap Payments; we do not store card numbers. Calendar data is sent only to the calendar provider it came from. We disclose data to authorities only where the law requires.

How long we keep it

• Account data: while your account exists; when you delete your account, it is erased after a 30-day grace period.
• Workspace content: while the workspace exists.
• Calendar data: until you disconnect the calendar or leave the workspace. Events removed from your calendar are kept up to 30 days so a mistaken removal can be recovered, then deleted.
• Backups: encrypted database backups are kept for up to 35 days, so deleted data can remain in a backup until it expires.
• Logs: kept for a limited period for security and troubleshooting.

Security

Data is encrypted in transit (HTTPS) and at rest; calendar credentials are additionally encrypted by ClippyNote. Workspaces are isolated from each other in the database, production access is limited to authorised people, and our support tools cannot read calendar contents. If a personal-data breach affects you, we will tell you and the authorities as the law requires.

Your rights

You can access, correct, export or delete your personal data, object to or restrict some uses, and withdraw consent (for calendars, by disconnecting). Write to admin@clippynote.com. You can also complain to Bahrain's Personal Data Protection Authority or to the data-protection authority where you live.

Children

ClippyNote is not intended for children under 16.

Changes

We will post changes on this page. For important changes, including any new use of Google user data, we will tell you in the app and ask for your consent where required before the change applies.