Privacy Policy
This policy explains how Notch ("we", "us") handles personal information: the company that runs Notch is named in our Terms of Service. It covers the website at notchhq.app, the app at app.notchhq.app, and the emails Notch sends. Questions or requests: hello@notchhq.app.
The short version
- We collect what Notch needs to work: your account details and the work you and your team put in.
- The marketing website uses Google Analytics to count visits. The app itself has no advertising or analytics trackers.
- We do not sell personal information or use it for advertising.
- A small number of service providers process data for us, listed below.
1. What we collect
Account information
Your name, email address and profile picture, from the email or Google account you sign in with, plus your time zone and workspace role.
What you and your team put in
Issues, comments, mentions, files, projects, cycles, labels, time entries, estimates and settings. This includes data a workspace admin imports from other services such as Linear or Everhour, which may contain your name, email and past work.
Usage and technical data
When you use the app we record things needed to run and secure it, such as when you were last active in a workspace, request logs (IP address, browser, time) and error reports.
Website visits
On notchhq.app (including the blog) we use Google Tag Manager and Google Analytics to understand how many people visit and which pages they read. Google sets cookies for this and receives your IP address and browser details. See section 6 for your choices.
2. Why we use it
- To provide Notch: sign you in, show your workspace, run timers and reports, and send the emails you expect, such as invites and notifications. (Legal basis where GDPR applies: performance of our contract with you or your organization.)
- To keep Notch secure and working: prevent abuse, investigate problems and keep backups. (Legitimate interests.)
- To improve the website: understand which pages are useful. (Consent where the law requires it, otherwise legitimate interests.)
- To talk to you: reply when you write to us, and tell admins about important changes. (Legitimate interests, or contract.)
- To meet legal obligations.
We do not use your content to train machine learning models, and we do not make automated decisions about you that have legal effects.
3. Who processes data for us
| Provider | What for |
|---|---|
| Cloudflare | Hosting the website and app, file storage, network security |
| Neon | The database that stores workspace data (hosted in Singapore) |
| Clerk | Sign-in and account security |
| Resend | Sending emails such as invites and notifications |
| Google (Google Sign-In, Tag Manager, Analytics) | Signing in with Google if you choose it; counting website visits |
They process data on our instructions under their own security and privacy terms. We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of Notch, in which case this policy continues to apply.
4. Where data is stored
Our providers operate in several countries, including the United States and Singapore. When data moves across borders we rely on the safeguards our providers offer, such as the EU Standard Contractual Clauses.
5. How long we keep it
- Workspace content stays while the workspace exists. When a workspace or account is deleted, we delete its content within 90 days, and backups roll off on their normal schedule.
- When someone leaves a workspace, their past issues and time entries stay in it so the team's records remain complete; the workspace admins control that history.
- Request logs are kept for a short period for security. Website analytics follow Google Analytics' retention settings.
6. Your choices and rights
- Access, correct, export or delete your information by writing to hello@notchhq.app. If your data sits in a workspace run by your employer or a client, we may pass your request to its admins, who control that workspace.
- Notification emails: you can turn optional emails off in Notch's settings when they are offered; invites and essential account emails still arrive.
- Website analytics: you can block or delete cookies in your browser, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
- If you are in the EU, UK or a similar jurisdiction, you may also object to or restrict some processing, withdraw consent, and complain to your data protection authority.
- If you are a California resident, you have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.
7. Security
Data travels over encrypted connections and is stored with providers that encrypt it at rest. Access inside Notch is limited by workspace and role. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.
8. Children
Notch is for work and is not meant for anyone under 16. We do not knowingly collect their information.
9. Changes
We will update this policy as Notch changes. For changes that matter, we will tell workspace admins at least 30 days ahead. The date at the top shows the latest version.
Contact
hello@notchhq.app