Privacy Policy

1. What we collect

• Account information: your email address and a bcrypt hash of your password — never the password itself.
• Your content: the notes and documents you upload or paste (.txt, .md, .pdf, .docx, or plain text), plus everything Taggard generates from them — visible tags, hidden tags, resolved entities, cross-references, and embeddings used for search.
• Session data: an authentication cookie that keeps you signed in (JSON Web Token–based, via Auth.js). It identifies your session, not your content.

We don't run analytics or ad-tracking scripts, and we don't collect anything beyond what's listed above.

2. How we use it

Solely to run the product: generating tags and hidden tags, resolving entities, detecting cross-references, powering semantic search and Ask, and keeping your account secure. We do not use your content for advertising, and we do not build a profile of you beyond what's needed to run these features on your own data.

3. Who else sees it

• OpenAI— every note passes through OpenAI's API to generate tags, entities, connections, and Ask's answers. This is the one external party your note content is sent to. OpenAI does not train on API data by default.
• Supabase— hosts the Postgres database your account and notes are stored in, encrypted in transit (TLS) and at rest.
• Vercel— hosts and serves the application itself.

We do not sell your data, do not train AI models on your documents, and do not share your content with marketers, advertisers, or data brokers.

4. How it's protected

Passwords are hashed with bcrypt and never stored in plain text. Reads are enforced with Row-Level Security at the database itself, using a restricted Postgres role — Postgres refuses to return another account's rows even if the application code had a bug. See the full security page for detail.

5. Your rights and controls

• Export— download every note, tag, entity, and connection as JSON or CSV at any time — the Export link is in the header on every page.
• Delete individual items— any note, folder, tag, or entity can be deleted permanently from the app itself, any time.
• Delete your whole account— self-serve account deletion isn't built yet; contact us to request it and we'll remove your account and its data.

6. Data retention

We keep your account and content until you delete it or request account deletion. Deleted items are removed from the database; we don't retain a separate backup copy of deleted content beyond routine, short-lived infrastructure backups.

7. Children

Taggard isn't directed at children under 13, and we don't knowingly collect data from them.

8. Changes to this policy

If this policy changes materially, we'll update this page and change the effective date above.

9. Contact

Questions about this policy: email contact@taggard.net or use the contact form.