Privacy policy

Who runs Mazkir

Mazkir is built and run by an independent developer. In this policy, “we” means the person who runs Mazkir.

For privacy questions or requests, email support@mazkir.io or send a request from the Support page with the “Privacy request” topic. You don't need to be signed in.

What we collect

• Your account: an account ID and your email address. If you sign in with Google, we get your email from Google and keep it only if Google has verified it. If you create an account with an email and password, we keep that email. If you sign in with Google and with a password using the same verified email, both open the same account.
• Your password, if you use one. Google's Firebase Authentication stores it. It passes through Mazkir's server on its way there, and Mazkir never stores it.
• Your notes: their titles, content, folders, and tags, the project each is in, and when each was created and last changed.
• Images you add to notes. Each one is converted to a new picture file as it's uploaded, which removes everything but the picture: camera and phone details, the date it was taken, and any location it carried. We keep its size and which project it belongs to.
• Sharing a project: who is in each project you share or join, and what each may do. You invite people by username. When you do, we keep the username you invite, the role you give, and who sent it, until they accept or decline, you withdraw it, or 30 days pass. Finding someone to invite searches usernames only: if you type an email address, only the part before the “@” is matched against usernames, and the address itself is never looked up. Everyone in a shared project sees the usernames and roles of the others in it, never their email addresses, and the notes, folders, and images in it.
• Public projects: the username you choose when you first sign in, and for each project you publish, its description and when you published it. A public project's name, description, publisher's username, notes, folders, and images are shown to anyone, with or without an account, and search engines and AI services may index them; its members are not shown.
• Your public profile: your username, and the picture you add, which is converted like any image, so it carries none of the photo's details. Anyone can see both, with the number of people who follow you and your public projects.
• Following, stars, and blocks: which people and public projects you follow, which projects you star, and whom you block. Others see only counts of followers and stars, never who follows or starred. The person you block isn't told.
• Your feed: for each public project that changes and that you follow, or whose publisher you follow, a copy of its card: its name, description, publisher's username and picture, and number of stars.
• Notifications: what the bell shows you, such as someone starring or following your project, following you, inviting you to a project, joining one of yours, or changing notes in a project you share. For each, we keep what happened, the project's name, the username of who did it, how many times, when, and whether you've seen it.
• Reports: when you report a project or a person, its reason, the details you write, and your account, which we don't show the one you reported. Mazkir's moderators see the reports, without your identity.
• Who wrote a note: in a project shared with others, which member created each note and who changed it last. Other members see this; the public doesn't.
• The trash: a deleted note, whole, with when it was deleted and who deleted it, for 30 days.
• Your settings, such as whether you share how AI agents use Mazkir.
• Support requests: the topic, subject, and message, and the account that sent it. If you aren't signed in, the email address you give us so we can reply.
• Sign-in records: your sign-in sessions, and the apps you've connected with the access you gave them. They expire on their own.
• Technical logs: Google Cloud records every request to Mazkir's website and server, including your IP address, your browser and device type (user agent), the address requested, the page you came from (referrer), and when it happened and how long it took. We use them to keep Mazkir working and secure, and to count visits without cookies. Our server also logs errors and sign-in outcomes, but never note content, passwords, or tokens.
• Usage statistics, described under “Analytics and cookies” below.

How we use it, and why

Data protection laws such as the GDPR require a legal basis for each use. Ours are:

• To provide Mazkir: creating your account, signing you in, storing, searching, and exporting your notes, sharing and publishing projects, showing your feed and notifications, connecting the AI agents you choose, and answering your support requests. This is needed to provide the service you asked for, under our terms.
• To keep Mazkir secure and working: technical logs, limits on how many requests can be sent, the bot check (Cloudflare Turnstile) when you create an account, reset a password, ask for the verification email again, or use the Support form without signing in, and preventing abuse. This is our legitimate interest in running a safe, reliable service.
• Website analytics: only with your consent, which you can withdraw at any time.
• AI agent usage statistics: our legitimate interest in knowing which features work and get used. They never include what an agent sent or got back. You can turn them off at any time: in Settings, under “AI agent usage”, clear “Share how AI agents use Mazkir”.

• We don't sell your content.
• We don't use your notes for advertising.
• We don't train AI models on your notes.
• Your notes are processed only to provide and secure Mazkir.

Analytics and cookies

We use Google Analytics to understand how Mazkir is used, so we can improve it and see whether people keep finding it useful. It never receives your notes, their titles, folders, or tags, what you search for, or your email address.

• On the website, Google Analytics runs only if you choose “Accept” in the cookie notice. It then sets its own cookies and records which pages you open, and actions such as creating an account, signing in, creating, saving, or deleting a note, exporting your notes, and deleting your account. We ask again after 12 months. You can turn it off at any time with “Turn off analytics” at the bottom of every page, which also removes its cookies.
• From AI agents, Mazkir's server records each action an agent takes in your account, such as searching or saving a note: which action it was, whether it worked, and how long it took. What the agent sent or got back is never recorded. This sets no cookies: the records go from Mazkir's server straight to Google Analytics.
• Both are linked to an anonymous ID we assign your account, never to your name or email, so we can see how usage continues over time. It's made with a key only we hold, so Google can't link it back to your account. Google Signals and advertising features are turned off.

Mazkir also keeps a few things in your browser that it needs to work:

• Your sign-in tokens, in your browser's local storage, so you stay signed in, and a key that ties them to this browser, in its IndexedDB. Signing out removes both.
• Your analytics choice, in local storage.
• Whether you chose to create an account, in session storage, until the sign-in page opens.
• Cookies that Mazkir's sign-in service sets while you sign in, and for your sign-in session.

AI agents you connect

When you connect an AI agent, such as ChatGPT or Claude, it can search, read, create, update, and delete notes and folders in your projects, as your role in each allows, restore notes from the trash, create projects, and search and read public projects, within the permissions you grant. What it gets from Mazkir is also processed by that agent's provider, under its own terms and privacy policy.

The sign-in page names the app asking to connect, so you know who you're giving access to. When you connect ChatGPT, or another app that asks for it, the app receives your email address in the sign-in token Mazkir gives it. It never receives your Mazkir account ID. Instead, each app gets its own anonymous ID for you, so two apps can't match you with each other through Mazkir.

Service providers

• Google: sign-in with Google; Google Cloud, which runs Mazkir's server and keeps its logs; Firebase, which hosts the website, stores your data, and runs Firebase Authentication for email-and-password accounts; Google Cloud Storage, which keeps the images in your notes; and Google Analytics.
• Cloudflare Turnstile, only when you create an account with an email and password, reset a password, or ask for the verification email again, and on the Support form when you aren't signed in. It checks your browser to tell people from bots, under Cloudflare's own privacy policy.

We may also disclose information when the law requires it, to protect people or the service, or as part of a business transfer with appropriate safeguards.

Where your data is stored

Mazkir stores your data on Google Cloud in the United States. The server runs in the us-central1 region, and the database in a United States multi-region. If you live outside the United States, for example in the EU or the UK, your data is transferred there. Google and Cloudflare both take part in the EU-U.S. Data Privacy Framework, and their data processing terms include the European Commission's standard contractual clauses. Transfers rely on those safeguards.

How long we keep it

• Your account, projects, notes, folders, and images: until you delete them.
• Deleted notes: 30 days in their project's trash, where you or anyone who can edit the project can restore them. Then they're deleted for good, automatically. “Delete for good” and “Empty the trash” delete them sooner.
• Deleting a project deletes its notes, folders, images, and trash with it, for everyone in it, withdraws its invitations, and deletes the feed items and notifications about it.
• Making a project private takes it off its public page and the public list at once. Copies others cloned while it was public are theirs and stay. Your username is kept after you delete your account, attached to no one, so no one else can take it.
• Leaving a project, or being removed from it, ends your access to it. What you wrote in it stays in the project, which is its owner's.
• Deleting your account in Settings immediately deletes your projects (shared ones too, for everyone in them) with their notes, folders, images, and trash, removes you from the projects you joined, deletes your picture, stars, follows, blocks, feed, and notifications, and deletes the support requests you sent while signed in, the email we store, and the email-and-password login with your email if there is one. It also disconnects every app you connected. What you wrote in projects you joined stays there, with the project's owner. Your Google account itself stays with Google.
• Sign-in records expire on their own. A sign-in session or an app's connection lasts up to 14 days unless you sign in again, and the short-lived access an app uses lasts 1 hour. Expired records are deleted automatically, usually within a day. After you delete your account, a record of its ID is kept for about an hour so that access given before the deletion is refused.
• Reports about public projects and people: as long as we need them to moderate the project and handle any dispute about it.
• Support requests: as long as we need them to resolve and document the request, meet legal obligations, prevent abuse, and protect the service. If you weren't signed in, the email you gave us is kept with the request. Those requests aren't tied to an account, so ask us if you want them deleted.
• Technical logs: 30 days, Google Cloud Logging's default.
• Analytics data: Google Analytics deletes it after 14 months.

Your rights

Depending on where you live, you have the right to:

• Access the information we hold about you.
• Correct information that's wrong.
• Delete your information. You can delete notes at any time, and your whole account in Settings.
• Export your notes. “Export notes” in Settings downloads them as Markdown files.
• Object to uses based on our legitimate interests, including AI agent usage statistics.
• Withdraw your consent to website analytics at any time.
• Complain to your local data protection authority, or in Israel, to the Privacy Protection Authority.

To make a request, email support@mazkir.io or use the Support page with the “Privacy request” topic.

Security and encryption

We use access controls, and every request for your notes is checked against your signed-in account. No online service can promise absolute security. Mazkir doesn't claim zero-knowledge or end-to-end encryption, because the server needs to read your notes to search them and to give them to the AI agents you connect.

Children

Mazkir isn't directed to children under 13.

Changes to this policy

We may update this policy as Mazkir changes. When we do, we'll update the effective date at the top.