Derive Notes is operated by Derive Notes Pty Ltd ("Derive", "we", "us"), a company registered in Queensland, Australia (ACN 696 859 597). Derive is a canvas-first note-taking app for math, science, and engineering students. This policy explains what data we collect, why, who processes it on our behalf, how we handle it internationally, and the rights you have.
What we collect
- Account information. Your email address, and a display name and avatar if provided by your sign-in provider or by you. Used to create and secure your account.
- Your content. The notebooks, handwriting, drawings, and text you create in the app. Stored so it syncs across your devices.
- AI request data. When you use handwriting recognition or the AI tutor, the relevant handwriting and page text are sent to our AI providers to generate a result. We ask for your consent in the app before these features are used, and you can withdraw it at any time.
- Payment information. If you purchase a subscription on our website, now or in the past, your payment is processed by Stripe. Stripe handles your card details. We receive and store only limited billing identifiers, such as a Stripe customer ID and subscription ID, to manage your subscription. We do not store full card numbers. If you purchase a subscription through the iOS app, payment is processed by Apple through your Apple ID, and we do not receive your card details.
- Waitlist and mailing list information. If you join our waitlist or sign up on our website, we collect your email address, along with any details you choose to give us, such as your device or study area. We use it to manage your place on the waitlist and to send you product updates and marketing emails. You can unsubscribe from marketing emails at any time using the link in any email, or by contacting us.
- Identifiers. An internal account or user identifier that ties your data to your account. We do not collect an advertising identifier (IDFA).
- Diagnostics. Crash reports and performance data, including error-session replays, to help us find and fix problems.
- Website usage data. How visitors find and use derivenotes.com, collected through PostHog analytics. See our Cookie and Analytics Notice.
We do not collect location, health, or advertising data. We do not sell your personal information.
Why we use it
- Provide the core app: create, store, and sync your notebooks.
- Provide handwriting recognition and AI tutoring, only with your consent.
- Process payments and manage subscriptions for website purchases, via Stripe.
- Develop, evaluate, and improve our features and AI models, using your content in de-identified or aggregated form. See "Improving our services and AI" below.
- Authenticate you and keep your account secure.
- Diagnose crashes and improve stability and performance.
- Manage our waitlist, and send product updates and marketing emails you can unsubscribe from at any time.
- Understand how our website is used so we can improve it.
We do not use your data for advertising, and we do not track you across other companies' apps or websites. Derive does not present an App Tracking Transparency prompt because it performs no such tracking.
Third parties who process data for us (subprocessors)
We use trusted service providers to run Derive. They process data only to provide these services to us:
- Supabase: authentication and storage of your account and notebook data.
- Google (Gemini): AI processing of your handwriting and page text for recognition and tutoring.
- OpenAI: AI processing of your handwriting and page text for recognition and tutoring.
- Sentry: crash reporting and diagnostics.
- Stripe: payment processing for subscriptions purchased on our website.
- Brevo: email delivery. We sync your email address to Brevo to send waitlist updates, product news, and service emails.
- PostHog: product analytics for our website, to understand how it is used and improve it.
- Vercel: website hosting. Vercel may process technical data such as IP addresses and request logs.
Handwriting and page text are sent to Google (Gemini) and OpenAI only when you use recognition or tutoring features, to produce the result you requested.
International data transfers
We are based in Australia, and some of our subprocessors, including Google, OpenAI, Sentry, Stripe, Brevo, PostHog, and Vercel, process data on servers outside Australia, including in the United States. Where we transfer personal data internationally, including from the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we take reasonable steps to ensure your data is protected consistently with this policy.
Improving our services and AI
We may use your content, including handwriting, drawings, and text, to develop, evaluate, and improve Derive's features and to train and improve AI models. Where we use content for this purpose, we work with it in de-identified or aggregated form and take reasonable steps to remove information that directly identifies you first. If you decline AI features, your content is not sent to our AI providers.
Sharing
Your notebooks are private by default. Derive is invite-only: content you create is visible only to you and to anyone you explicitly invite to a shared notebook. There is no public feed or public sharing. We do not share your personal data with third parties except the subprocessors listed above, or where required by law.
Data retention
We keep your account and content for as long as your account is active. When you delete your account, your account data and notebooks are deleted. Diagnostic data is retained only as long as needed to investigate and fix issues. Our subprocessors retain data per their own policies for the time needed to provide their service.
Payment and transaction records may be retained for up to seven years, even after you delete your account, to comply with tax and accounting obligations under Australian law.
Deleting your account
You can delete your account and its content from within the app, in Settings → Account. Deleting your account removes your account data and notebooks. If you only joined our waitlist and never installed the app, or you need help with any of this, email us at matt@derivenotes.com and we will delete your details.
Your privacy rights
You can exercise any of the rights below by emailing matt@derivenotes.com. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights.
Everyone
- Decline or withdraw consent for AI features. Recognition and tutoring only run with your consent.
- Delete individual notebooks, or your whole account, in the app.
- Request access to, or deletion of, your personal information.
Australia
We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you have a concern about how we handle your data and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
European Economic Area, United Kingdom and Switzerland (GDPR)
If you are in the EEA, UK, or Switzerland, Derive Notes Pty Ltd is the data controller for your personal data. Our legal bases for processing are:
- Performance of a contract: to provide the app and sync your notebooks.
- Consent: for sending your content to AI providers for recognition and tutoring. You may withdraw consent at any time.
- Legitimate interests: to secure accounts and diagnose and fix problems, balanced against your rights.
You have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.
California (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. The categories of personal information we collect are described in "What we collect" above.
Children
Derive is not directed to children and is rated for older users. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
Cookies on our website
Our website uses PostHog for product analytics, which sets analytics cookies. See our Cookie and Analytics Notice for the details and your choices.
Governing law
This policy is governed by the laws of Queensland, Australia, without regard to its conflict-of-laws rules, and subject to any non-excludable rights you have under the laws of your own country.
Changes
We may update this policy. Material changes will be posted at derivenotes.com/privacy with a new "Last updated" date.
Contact
Questions about this policy or your data? Contact us at:
- Email: matt@derivenotes.com
- Entity: Derive Notes Pty Ltd (ACN 696 859 597)
- Location: Queensland, Australia