Privacy policy

Information we collect

Waitlist. When you join the monthlet AI waitlist, we store your email address, your language preference, the time of signup, and your browser’s user-agent string. We use this only to notify you when monthlet AI becomes available and to share closely related product updates. We do not use it for anything else.

Download counting. When you download the app via /download, we record a one-way hash of your IP address (SHA-256 with a salt that changes daily), the date, and your browser’s user-agent. The raw IP address is never stored, and the hash cannot be traced back to you. This exists only to count unique downloads per day.

Update-check counting. The monthlet app periodically contacts our update endpoint to check for new versions. When it does, we record one-way hashes of the IP address (SHA-256 with salts that rotate daily, weekly, and monthly), the date, and the request’s user-agent string. The raw IP address is never stored, and the hashes cannot be traced back to you or linked across periods. This exists only to count unique active installations per day, week, and month.

Site analytics. We use Cloudflare Web Analytics, which is cookie-less and aggregate. It does not identify individual visitors.

Cookies. This website does not use cookies for tracking.

Where your data lives

The website and its data run on Cloudflare (hosting, the waitlist database, and analytics). Waitlist entries are also copied to a private Google Sheet for operational review. Downloads and app updates are served from GitHub Releases, so GitHub receives your IP address when downloading them, under its own privacy policy.

Storing data with these providers is a form of entrustment: we review their terms and security practices and supervise that your data is handled appropriately.

We do not sell your data, show ads, or share your information with anyone beyond the service providers above.

How we protect your data

We collect as little as possible to begin with, and protect what we do hold: access is limited to the operator and guarded with multi-factor authentication, and the services that store the data (Cloudflare and Google) apply access controls and encryption in transit and at rest.

Where the data is processed. Waitlist data is stored on Cloudflare and Google servers located in the United States. We keep ourselves informed about the data-protection rules that apply there and apply the safeguards above accordingly.

Retention and your rights

Waitlist entries are kept until they have served their purpose (notifying you about monthlet AI) or until you ask us to remove yours.

Under applicable law (including Japan’s Act on the Protection of Personal Information), you may ask us to disclose the personal data we hold about you or its purpose of use, correct it, delete it, stop using it, or stop providing it to third parties. Email [email protected] from the address you signed up with (or with other reasonable proof of identity), and we will respond without undue delay. If a legal exception prevents us from fulfilling a request, we will tell you why.

The monthlet app and your notes

Your notes are plain HTML files stored locally on your Mac. They are never uploaded to our servers.

When you use the in-app chat with your own AI provider API key, requests go directly from your device to that provider (such as Anthropic, OpenAI, or Google) under that provider’s terms. We do not proxy, log, or store those requests.

Google account integrations (upcoming)

Future versions of monthlet may offer optional integrations with Google services (such as Calendar). If you enable one, access is granted by you through Google’s OAuth consent flow, the data is used only to provide the feature you enabled, and it is processed on your device, not stored on our servers.

monthlet’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who operates this service

This website and monthlet are operated by t27d, an individual developer based in Japan. The operator’s legal name and address, as required to be made available under Japanese privacy law, will be provided without undue delay on request at [email protected].

Changes to this policy

If this policy changes, we will update this page and the date above. Material changes will be noted on this page.

Contact

Questions or requests: [email protected]