Privacy Policy

1. Data controller

The controller of your personal data is Luděk Kremser, a sole trader (fyzická osoba podnikající) in the Czech Republic, company ID (IČO) 67719228, registered for VAT, business address Čajkovského 1481/11, 746 01 Opava, Czech Republic. For anything about your data, write to us at support@insightdown.com.

2. Where your notes are

Cloud vaults live in your own OneDrive or Google Drive, to which you grant us access by signing in with your Microsoft or Google account. Local-folder vaults live only on your disk. We do not run a sync service of our own; syncing is done by OneDrive or Google Drive.

We do not store the text of notes from cloud vaults on our server. When it is needed, for example when someone opens a share link or an agent reads a note through remote MCP, our server reads the text from your storage at that moment and passes it on, but does not store it.

On the server we keep only: the vault index (note titles, paths and metadata) needed for search and sharing, attachments uploaded through the web or the app, comments and share links, for encrypted notes only their encrypted content, and the remote MCP index if you turn it on (section 6).

3. What data we process

Account: e-mail, name (if you provide it) and sign-in data. Sign-in is handled by Supabase Auth (e-mail and password, with optional two-factor authentication for administrators).

Billing: your Stripe customer ID, country, VAT ID (if you provide it), invoices and payment status. Card details are held only by Stripe; we do not have them.

AI: a record of each call to our models with its token counts and price.

Vaults and collaboration: the vault index and metadata, attachments, comments and share links including the names guests enter, the encrypted content of encrypted notes, remote MCP index vectors (only when turned on) and MCP tokens.

Support and discounts: support tickets and the messages in them, and the data used to verify eligibility for the education discount.

Operations: technical logs, the time of your last activity and your client platform (desktop, web or mobile, and the app version). Administrator actions on accounts are recorded in an audit log.

4. Why we process data and on what legal basis

Performance of a contract: running your account, providing the service, sharing and comments, the Pro subscription, metering and billing AI usage, and handling support.

Legal obligation: keeping accounting and tax records, such as invoices.

Legitimate interest: securing the service, preventing fraud and abuse, operating the service (technical logs, last activity and client platform) and the audit log of administrator actions.

Consent: where we ask for it, for example for the remote MCP index. You can withdraw consent at any time; for the index, by turning it off.

We use the contact form and support requests only to handle your request, not to send newsletters or marketing messages.

5. AI

AI runs only in the desktop app; the web app has no AI.

With your own API key (OpenAI, Anthropic, Google Gemini or a local Ollama), the request goes directly from your device to that provider under your own contract with them. We do not see it.

With our models (Pro), the request, including any text you give it as context, goes through our server to our model provider, OpenAI (USA). For billing, we record each call with its token counts and price.

6. MCP and the remote MCP index

With Pro, you can give external AI agents (for example Claude) access to a vault via MCP. The local MCP server runs in the desktop app on your computer. Remote MCP runs on our server, and the agent signs in to it with your personal token, which you can revoke at any time. Data an agent obtains through MCP is processed by its provider under its own terms.

Remote MCP index (Pro, turned on separately for each vault): so that remote MCP can search by meaning, the desktop app computes vectors (embeddings) from the text of your notes locally on your device and uploads only the vectors to our server, not the text. The server itself, without any third party, computes a vector only from the search query.

Vectors can partially reveal the content of notes, which is why the index is turned on only by your choice. Encrypted notes never go into the index. Turning the index off deletes the vectors. If your Pro ends, they are deleted automatically (the cleanup runs every hour).

7. Sharing and comments

With Pro, you can create a share link. Anyone with the link can view and comment on the shared content without an account: they enter a name, which we store together with the comment. The owner can revoke the link at any time.

8. Payments

Payments, subscriptions, invoices and tax calculation are handled by Stripe. You enter your card details directly with Stripe; we neither see nor store them. We keep your Stripe customer ID, country, VAT ID (if you provide it), invoices and payment status.

9. Support and the education discount

You can send a support request through "Report a problem" in the app's help window, through the contact form on the website, or by e-mail. "Report a problem" attaches your account e-mail and information about your client and platform to the message. Each request creates a support ticket, which we keep in order to handle it. We reply by e-mail.

If you apply for the education discount, we process your account's verified e-mail and the details you provide with the request (your school, student or teacher card number, or a document), solely to assess your eligibility.

10. Who receives data

We do not sell personal data. To run the service, we use these processors and recipients:

Supabase: authentication and database; EU (Frankfurt).

Railway: application hosting and storage of attachments; EU (Netherlands).

Stripe: payments, subscriptions, invoices and tax calculation; USA and EU (Stripe Payments Europe).

Resend: sending e-mails and receiving support e-mails; USA.

OpenAI: our AI models, only when you use them; USA.

Microsoft (OneDrive) and Google (Google Drive): only at your direction, so that we can access your own storage.

Cloudflare (Turnstile): protecting the contact form against bots; USA.

AI providers you send requests to with your own API key, and AI agents you connect through MCP, are not our processors: you pass data to them yourself under your own contract with them.

11. Transfers outside the EU

Some recipients (Stripe, Resend, OpenAI and Cloudflare) process data in the USA. These transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses.

12. How long we keep data

We keep account data until you delete your account.

We keep accounting and tax records, such as invoices, for the period required by Czech law (up to 10 years).

We keep support tickets for as long as we need them to handle the request, and then for a reasonable period.

We keep remote MCP index vectors until you turn the index off or your Pro ends.

After your account is deleted, we delete your data, except what the law requires us to keep and the record of the deletion in the audit log.

13. Security

We use appropriate technical and organizational measures: access to data protected by sign-in, separation of data between accounts, password encryption of notes (we keep only the encrypted content and never store the password), an audit log of administrator actions, and protection of the contact form against abuse.

No system is completely secure. Use a strong password, keep your MCP tokens safe, and consider what content you send to AI providers and external agents.

14. Your rights

Under the GDPR, you have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability, the right to object, and the right to withdraw consent at any time. Send requests, including a request to delete your account, to support@insightdown.com. We will reply without undue delay and at the latest within one month.

If you believe we process your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, www.uoou.cz).

15. Changes to this policy

We may update this policy when the service or the law changes. We will tell you about material changes in advance by e-mail or in the app.

16. Contact

If you have questions about privacy or want to exercise your rights, write to us at support@insightdown.com or use the contact form on the website.