← Back to Myelin

Privacy Policy

Effective date: April 1, 2026

Myelin ("we", "us", "our") is a personal knowledge management application. We take your privacy seriously. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Category	Data	Purpose
Account	Email address, hashed password	Authentication and account recovery
Content	Notes, tasks, projects, files you create	Core app functionality — storing and syncing your knowledge base
Google integrations	OAuth tokens, email metadata, calendar events (when you connect)	Gmail sync, Google Calendar sync, Google Drive backup — only accessed when you explicitly connect
Device & usage	Error reports, crash logs (via Sentry)	Debugging and improving app stability

We do not collect analytics, browsing history, location data, or advertising identifiers. We do not use cookies for tracking.

2. How We Use Your Data

• Provide the service — store, sync, and display your notes, tasks, and projects across devices
• Google integrations — when you connect Gmail, Calendar, or Drive, we access only the data needed for the features you enable (e.g., syncing emails from a specific label)
• Error monitoring — crash reports help us fix bugs; they contain technical context (error message, stack trace) but not your note content
• Account security — password hashing, session management, encrypted token storage

We never sell, rent, or share your personal data with advertisers or data brokers.

3. Google API Disclosure

Myelin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the Google API scopes necessary for features you enable
• We do not use Google user data for advertising
• We do not transfer Google user data to third parties except as necessary to provide the service
• Google OAuth tokens are encrypted at rest using server-side encryption
• You can disconnect Google integrations at any time from the Settings page, which revokes our access and deletes stored tokens

4. Data Storage and Security

• Infrastructure — your data is stored in Supabase (PostgreSQL) with row-level security policies ensuring users can only access their own data
• Encryption in transit — all connections use TLS/HTTPS
• Encryption at rest — OAuth tokens are encrypted using Supabase Vault (pgsodium). You can also enable client-side AES-256 encryption on individual blocks for sensitive content
• Offline storage — the web app uses IndexedDB locally; the mobile app uses SQLite. This data stays on your device
• Backups — automated daily database backups with 30-day retention

5. Data Retention

We retain your data for as long as your account is active. When you delete content within the app, it is removed from our databases during the next sync cycle. If you delete your account, all associated data is permanently removed within 30 days.

6. Your Rights

You have the right to:

• Access your data — export your entire vault as Markdown files from Settings
• Correct your data — edit any content directly in the app
• Delete your data — delete individual items or request full account deletion
• Disconnect integrations — revoke Google access from Settings at any time
• Port your data — export in standard Markdown format

If you are in the EU/EEA, you also have rights under GDPR including the right to lodge a complaint with your local data protection authority.

7. Third-Party Services

Service	Purpose	Data shared
Supabase	Database, auth, file storage	All account and content data
Firebase Hosting	Web app hosting	None (static file hosting only)
Google APIs	Gmail, Calendar, Drive integrations	OAuth tokens; data flows are user-initiated
Sentry	Error tracking	Error reports, stack traces, user ID (no content)

8. Children's Privacy

Myelin is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has created an account, please contact us.

9. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via email or an in-app notice. The effective date at the top of this page indicates when the policy was last revised.

10. Contact

For privacy questions, data requests, or account deletion:

Email: admin@somanoetic.com