Privacy

This notebook is a copy of LockIn, which is open-source software, run by Naman Khandelwal. This page says what it keeps about you, who else can see it, and how to take it away. Questions go to namankhandelwal.dev@gmail.com.

What is kept

• Your account. Your email address, your name if you gave one or Google passed it on, and when you signed up. A password is kept only as a bcrypt hash, never as you typed it.
• Your notebook. Subjects, notes, tasks, the links and PDFs you save and the text read out of them, images you paste, focus sessions, and your conversations in Ask. So that notes can be searched by meaning, passages of them are also kept as lists of numbers (embeddings).
• Your connections. The names of the agents and apps you connected and when each was last used. Their tokens are kept only as hashes.
• Sign-in tries. To slow down password guessing, tries are counted against the email address typed and the network address they came from. A count is dropped about a day after it stops being used.

In your browser

The only cookies are the ones signing in needs (they keep you signed in and protect the sign-in form) and one holding your time zone, so that dates are right. Your theme and your Ask settings are kept in the browser's own storage. That includes any model API key you enter: it stays in the browser and is never sent to this server. There are no advertising cookies, no analytics and no trackers.

What it is used for

To run your notebook, and nothing else. It isn't sold, shared for advertising or used to train a model. Notes are not encrypted against the person running the server, so Naman Khandelwal is able to read them, and doesn't, except to fix a fault you have reported or where the law requires it.

Who else sees it

• Agents and apps you connect. Each can read your notes and add to them, until you disconnect it in Settings.
• The model you choose in Ask. With a model in your browser or on your own machine, nothing leaves. With a provider's key (Anthropic, OpenAI, Gemini, OpenRouter), your browser sends the question and the passages of your notes used to answer it straight to that provider, under their terms.
• Model downloads. A model that runs in your browser is downloaded by your browser from where it is published, mostly Hugging Face. That host sees your network address, as any website you visit does.
• Google, if you use Continue with Google. Google learns that you signed in here, and this notebook receives your email address and name from it.
• An email service, where this notebook sends email: it carries the confirmation and password-reset messages, so it sees your address and those messages.
• Sites you save a link to. The server fetches the page to read its text. The site sees the server's address, not yours.
• Anyone you give a link to. A shared page can be read by whoever has its link until you turn the link off. Images and PDFs you upload are served from long addresses that can't be guessed but need no sign-in, so anyone handed such an address can open that file.

Where it is kept

On a Google Cloud server in Mumbai, India. Nightly backups are kept for 30 days.

Keeping and deleting

Everything is kept until you delete it. Settings exports the whole notebook as one JSON file, and each subject exports as Markdown or JSON. “Delete account” in Settings removes the account, the notebook, its files and every agent's access at once. Backups made before then still hold a copy until they are themselves deleted.

To ask for a copy of what is kept about you, to have something corrected, or to have your account removed for you, write to namankhandelwal.dev@gmail.com.

Changes

This page changes when what it describes does. The date at the top says when it last did.