Privacy Policy
1. Information we collect
- Account: the email address (required), name and profile image provided when you sign in with Google. Used only for sign-in and credit management.
- Usage data: collected transcripts and capture metadata are stored locally in your browser by default. Video frames (screenshot PNGs) are never sent to our servers and stay on your computer.
- AI notes sync (optional): only if you turn sync on, we store the study notes generated by AI (note text plus metadata such as course name, lecture title, style and model) on the Lectunote server (PocketBase). Lecture transcript text, capture metadata and screenshots are never synced or stored on the server. Data is retained for 180 days after last access and then deleted automatically. It is destroyed immediately when you delete your account or your server data, and you can delete it at any time with the "Delete server data" button in the popup. Turning sync off only stops further uploads; deleting data that is already stored requires a separate confirmation.
- AI credit usage records (credit_transactions): when you run an AI conversion we record the model used, token and image usage, credits deducted and the time. Used for credit accounting and support; kept until your account is deleted (payment records are kept for 5 years as required by law).
- Payment information: handled by our payment provider Paddle (Merchant of Record). Lectunote servers never store card details; we only receive the order ID, plan and number of credits purchased from Paddle.
- Diagnostic logs (client_logs): sent only when the extension hits a warning or error — the error message and context, extension version, user ID and time. Activity information such as course names, lecture titles and viewing URLs is not sent. Used only for troubleshooting, never sold or used for advertising.
- Access logs: the API server (PocketBase) access log records the request IP address and is deleted after 7 days.
2. How we use information
- Providing the service (sign-in, account and credit management)
- Payment processing and refunds
- Troubleshooting and improving the service
3. Third parties
The following external services process data:
- Google: OAuth authentication
- Cloudflare: CDN, DDoS protection, DNS
- LLM providers (processors): when you request an AI note conversion with a Lectunote server model, the transcript text of the selected lectures is sent through api.lectunote.com to the model provider. Currently registered provider: Qwen-family models served through the Genon AI API (api.genon.ai). The registered provider may change depending on operations; we will update this page when it does. Video frames are not sent.
- AI provider you choose yourself (BYO): if you enter your own API key and use OpenAI, Anthropic, Google or xAI, the extension sends transcripts directly to the provider you have a contract with. This path does not go through Lectunote servers, and your API key is stored only in this browser and is never sent to Lectunote. The provider's data handling is governed by its own policy.
- Claude / ChatGPT connector (MCP): only when you connect the Lectunote connector to Claude or ChatGPT and make a request do we provide your synced AI notes to that service. You can disconnect it at any time in the connector settings of that service, after which no data is provided.
- Paddle.com: payment processing, taxes, receipts and refunds (Merchant of Record, after launch). Paddle's handling of personal data is governed by the Paddle Privacy Policy.
4. Overseas processing (cross-border transfer) of personal data
Lectunote's servers are located outside Korea. To provide the Service (performance of the user agreement), we entrust storage and processing of personal data to the overseas processors below, as disclosed under Article 28-8 of the Korean Personal Information Protection Act. When you use the Service, the listed data is transmitted over encrypted connections (TLS) and stored on an ongoing basis.
| Recipient (processor) | Country / location | Entrusted work | Data transferred | Retention |
|---|---|---|---|---|
| netcup GmbH Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany Privacy contact: netcup.com/en/contact/data-privacy · DPO: [email protected] | Germany (EU) — Nuremberg data center | Server hosting, database and backup storage (infrastructure for servers operated by Lectunote) | Account data (email, name, profile image); synced AI notes if you enabled sync; credit and AI usage records; diagnostic logs; access logs (IP) | Same as Section 5 — until account deletion or termination of the hosting agreement (backups 14 days, access logs 7 days, diagnostic logs 90 days, payment records 5 years) |
| Cloudflare, Inc. 101 Townsend St, San Francisco, CA 94107, USA Privacy Policy | USA headquarters; global edge network (processed at the location nearest to you) | CDN, DNS, DDoS protection, TLS termination (traffic relay) | Client IP and request metadata (URL, headers). Content is relayed, not stored | Processed at relay time; Cloudflare security-log retention per Cloudflare's policy |
| Paddle.com Market Limited Judd House, 18-29 Mora Street, London EC1V 8BT, UK Privacy Policy | United Kingdom | Payment processing, taxes, receipts and refunds (Merchant of Record — Paddle collects and processes payment data directly as an independent seller) | Email, payment method and billing country you enter directly with Paddle at checkout. Lectunote servers receive only the order ID, plan and credit quantity | Per Paddle's policy and tax-law retention periods |
| Google LLC 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA Privacy Policy | USA | Google account sign-in (OAuth) — the sign-in method you chose | Email, name and profile image that Google passes to Lectunote at sign-in | At sign-in time |
If you do not wish your data to be processed overseas, you may stop using the Service and request account deletion at [email protected]. Because our servers are located overseas, refusing overseas storage means the Service cannot be used at all. The LLM providers used for AI note conversion (Section 3) process the transcript text of the selected lectures only when you request a conversion; we will update this table if the provider changes.
5. Retention
When you request account deletion, we destroy your account information and usage data immediately. Diagnostic logs are cleaned up automatically every day and kept for at most 90 days; when you request account deletion, the logs for your user ID are deleted as well. Server backups rotate on a 14-day cycle and then disappear. Payment records are kept for 5 years as required by law.
6. Your rights and deletion requests
You may request access to, correction of or deletion of your information; we process requests without delay after receiving your email. We do not sell the information we collect and do not use it for purposes other than those above. [email protected]