Privacy Policy

(Last updated: October 2026)

This document is governed by German law. This English version is provided for your convenience.

1. Data Controller

Lukas Wunderlich
Altdorferstraße 3a
93049 Regensburg
Germany

Email: hello@goodterm.net

The data controller within the meaning of the General Data Protection Regulation (GDPR) is the natural person named above.

2. Overview

Goodterm is a note-taking application with AI support. We only process personal data to the extent necessary to provide the service.

Processing is based on the following legal grounds:

• Art. 6(1)(b) GDPR – Contract performance (account, notes, search, AI features, transactional emails)
• Art. 6(1)(f) GDPR – Legitimate interest (security, abuse prevention, system stability)
• Art. 6(1)(a) GDPR – Consent (connecting external AI agents)

We do not sell data or run an ad-funded business. Optional account-linked usage analytics operate only with your consent (Section 3.7).

3. Hosting and Operations

3.1 Hosting Provider

Our application is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The data center locations we use are exclusively in Germany and are ISO 27001 certified.

3.2 Data Processing Agreement

A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Hetzner.

Technical and organizational measures (TOM): https://www.hetzner.com/AV/TOM.pdf

3.3 Server Log Files

Each time you access the service, the following data is automatically recorded in server log files:

• IP address
• Date and time of access
• Page or endpoint accessed
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer URL (previously visited page)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Storage duration: 30 days, then automatic deletion.

3.4 Abuse Prevention

To protect against automated attacks and overload, we limit the number of requests per IP address (rate limiting). The IP address is processed only briefly and is not stored persistently.

Legal basis: Art. 6(1)(f) GDPR (security of the service).

3.5 Operational Monitoring

To ensure operation, we collect technical metrics (load, response times, error rates) from the service's instrumentation and evaluate application logs. The metrics are aggregate and time-series values without any personal reference; they cannot be attributed to an account. Evaluation takes place on our own servers in Germany; metrics are deleted after 90 days, logs after 30 days.

Legal basis: Art. 6(1)(f) GDPR (system stability and error analysis).

3.6 Application Error Reports

If a technical error occurs in the web interface or in the app, the application automatically sends an error report to our own server in Germany. The following is transmitted:

• Error type and error message
• Technical sequence at the time of the error (stack trace)
• Affected area of the application as a pattern without identifiers (e.g. "/verify/$token")
• Application version and platform (web or Android)
• Browser type and version
• Operating system
• Date and time

Not transmitted: the address of the page you were on, search terms or other parameters from the address bar, your account identifier, your username, your email address, a session identifier, the full browser identification string (user agent), and the contents of your notes, chats, and messages.

Purpose: detecting and fixing errors in the application.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional and error-free application).

Storage duration: 7 days, then automatic deletion.

3.7 Optional Usage Analytics

If you explicitly agree, we store daily information linked to your account: whether you visibly opened records or chats or edited content, counts of newly created records, chats and messages, and automated agent changes. We also store measured AI tokens and call counts by day, purpose and model. This helps us understand feature usage, relationships between features and returning users. Automated agents do not count as active people. If you participate, you can view your personal activity and newly created content statistics under Settings → Data control. The display and statistics download do not include token or model details. For full access to your stored personal data, including linked AI usage data, contact hello@goodterm.net (Section 14).

We store no content, document or chat identifiers, individual click trails, device fingerprints or additional analytics cookies. These data are nevertheless personal because they are linked to your account. Only the authorized operator can access them through a separately protected internal interface on our own servers in Germany; they are not shared with analytics services.

Legal basis: Art. 6(1)(a) GDPR (consent). Participation is voluntary and does not affect use of the service. Under Settings → Data control, you can decline, opt in later, download your usage statistics or withdraw consent at any time. Withdrawal stops collection and deletes your linked analytics history. It does not affect the lawfulness of prior processing.

Storage duration: at most 12 months, with daily deletion of expired daily values; withdrawal or account deletion immediately deletes linked values from the active system. Protected backups may retain data until their normal expiry (Section 11). Your decision and its version remain until account deletion so that we can respect your choice. Renewed consent starts a new observation period; past activity is not reconstructed.

Separately, we count total measured AI usage without account identifiers by day, purpose and model for at most 12 months. These totals support capacity planning (Art. 6(1)(f) GDPR) and cannot be assigned to an account in this storage. Current account, record and chat counts come from existing inventory data. Operational monitoring and error reports remain separate (Sections 3.5 and 3.6).

3.8 Operational Usage and Abuse Prevention

To monitor AI consumption, detect unusual costs and investigate possible abuse, we store daily AI call counts and measured input, output, thinking and cached tokens by function and model for all accounts, together with failed and aborted call counts. Missing provider values are marked as unknown. This processing is independent of optional usage analytics and is not used for retention or behavioural analysis. Withdrawing optional analytics consent does not stop this separate operational processing.

We additionally record individual AI calls with their time, function, model, token usage, calculated costs and outcome, together with monthly totals. These manage your monthly chat allowance, including ongoing reservations, tier assignment and additional grants. Only chat and its research agents consume this allowance; other AI functions are recorded for cost monitoring. Measured and estimated values are distinguished. When the allowance is exhausted, new chat requests pause until the next monthly allowance or an adjustment by the operator. You can view your allowance and reset date under Settings → Usage. This does not suspend your account or your other functions.

These data contain no chat or note content, additional IP histories or device fingerprints. Only the authorized operator can access them through the protected internal interface on our servers in Germany. Reaching a usage threshold sends the operator an email for review; it does not automatically suspend an account. Account creation sends the operator the account identifier, handle, email address, time, registration method and verification status. These internal notifications use our existing email provider Brevo (Section 4).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests are preventing abuse and maintaining an economically sustainable, available service. You may object on grounds relating to your particular situation; we assess each case under Art. 21 GDPR. For objections and access requests including these data, contact hello@goodterm.net. The optional statistics download does not include operational data.

Storage duration: individual AI calls for at most 90 days; monthly usage and allowance totals and allowance changes for at most 13 months. Supplementary daily operational values remain for at most 30 calendar days including the current day, internal mail jobs for at most 30 days, with automatic cleanup. The current tier assignment remains until it changes or the account is deleted. Deleting an account removes linked data from the active system. Operator emails are deleted from the operator mailbox within 30 days. Protected backups follow Section 11.

4. User Account

4.1 Registration with Email Address

An account is required to use the service. We process:

• Username (handle)
• An optional display name
• Email address
• Password (stored exclusively as a cryptographic hash, never in plain text)
• Time of registration

To confirm your email address, we send a verification link. The associated tokens are stored only as hashes and only for a limited time.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4.2 Signing In with Google or GitHub

Alternatively, you can sign in via Google or GitHub. If you use this option, you are redirected to the respective provider and sign in there. We then receive:

• the provider's persistent user identifier,
• your email address and whether the provider reports it as verified,
• the time of the most recent sign-in.

We receive no password and no access to your content held there. The providers are:

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (a subsidiary of Microsoft Corporation)

Signing in via GitHub involves a data transfer to the USA. Microsoft is certified under the EU-U.S. Data Privacy Framework (see section 6.5).

The redirect only happens once you actively click the corresponding button.

Legal basis: Art. 6(1)(b) GDPR (contract performance – providing the sign-in method you chose).

4.3 Session Management

To keep you signed in, we store for each active session:

• a session key,
• the IP address and browser identifier (user agent) at the start of the session,
• the time of last use.

This allows you to spot and terminate sessions you do not recognize.

Storage duration: 30 days from the start of the session, or immediately upon sign-out.

Legal basis: Art. 6(1)(b) and (f) GDPR (contract performance and account security).

4.4 Account Deletion

You can delete your account yourself at any time. As a safeguard, you confirm the deletion via a link we send to your email address. Deletion removes the account, settings, notes, chats, sessions, agent connections, and the associated search vectors. Regarding residual copies in backups, see section 11.

5. Your Content

5.1 What We Store

We store the content you create in the service:

• Notes (title, text, timestamps, favorite and trash status)
• Chat histories with the AI feature
• Notes created by AI agents ("messages")
• Your settings, including optional custom instructions for the AI

This content is yours. We do not evaluate it for our own purposes, do not pass it on to third parties, and do not use it for advertising or analytics. Disclosure occurs only to the processors named in this policy and only to the extent necessary to provide the respective function.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

5.2 Change History

So that you can trace and restore edits, the service maintains a change history. It records when an entry was changed and by whom (you or an AI agent you connected), and retains intermediate content snapshots.

Storage duration: Full snapshots are kept for 90 days. After that, older snapshots of ongoing edits are removed automatically; the current state as well as creation, deletion, and restore events are retained. Deleting your account deletes the entire history.

Legal basis: Art. 6(1)(b) GDPR (contract performance – versioning and restore functionality).

5.3 Trash

Deleted entries first move to the trash and remain restorable:

• Chats: permanently removed 30 days after deletion.
• Notes and messages: remain in the trash until you delete them permanently.

5.4 Voice Recordings and Connected Watches

When you send a voice recording, we process the audio file and resulting transcript to keep your thought as text. On Wear OS, a completed recording you send is automatically transcribed and saved as a Record in your account. Transfers can resume after an interruption; the recording remains on the watch until acceptance is confirmed. Granting microphone access alone does not start a recording.

For transcription, we send the recording to Google through the Gemini API described in section 6. For Wear recordings, we store audio on our servers for reliable delivery and recovery. Successfully processed recordings are deleted after 30 days. If processing fails or no text is recognized, we delete the audio 30 days after our server accepted it. Recordings whose processing or delivery is still in progress remain stored until that work finishes. Incomplete uploads expire after at most seven days. Saved Records follow the normal deletion rules for notes.

To pair and manage a watch, we store its account association, device name, connection and security identifiers, and connection timestamps. You can disconnect a watch under Settings → Devices. This ends its further access; recordings already accepted continue processing. Connection and delivery receipts remain until account deletion for security and to prevent duplicate Records.

Account deletion removes associated recordings and connections from the active system. Backups follow section 11. Legal basis: Art. 6(1)(b) GDPR (providing the recording, transcription and device features you request).

6. Artificial Intelligence

6.1 Service Used

For AI features (chat, text correction, transcription, semantic search) we use the Gemini API:

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

6.2 Processed Data

When using AI features, the following is transmitted to Google:

• the text you enter and the content your request refers to — including entries that the AI itself looks up in your content in order to answer,
• voice recordings you send for transcription,
• your optional custom instructions for the AI,
• technical metadata (timestamps, session ID).

Transmission occurs only when you actually invoke an AI feature. As long as you do not use an AI feature, your notes do not leave our servers — except for conversion into search vectors as described in section 6.7. Entries you have marked as protected are fully exempt from this: they are neither converted into search vectors nor transmitted to the AI model — not even when you invoke an AI feature.

6.3 Google's Use of Data and Abuse Monitoring

We use the Gemini API on the paid tier ("Paid Services"). Under the Gemini API terms, Google does not use your inputs or generated responses on this tier for general product improvement.

To detect and prevent abuse and make legally required disclosures, Google retains prompts, accompanying context and responses for 55 days under its current abuse monitoring policy. Authorized Google employees may review content flagged by safety filters or abuse detection systems. These logs are not used to train or fine-tune AI models, except models used exclusively to enforce usage policies.

Further information: Gemini API terms and Google's abuse monitoring policy.

Independently of this, under Google's terms the Paid Services data protection standard applies in any case to users in the European Economic Area, Switzerland, and the United Kingdom.

6.4 Legal Basis

Processing is based on Art. 6(1)(b) GDPR (contract performance), as AI-powered text processing is an essential function of the service.

6.5 Data Transfer to the USA

Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). The EU Commission's adequacy decision of July 10, 2023 permits data transfers to certified US companies.

In addition, the EU Standard Contractual Clauses (SCCs) apply as an independent safeguard. Should the adequacy decision cease to apply in the future, transfers remain protected by them.

More information:

• Google Privacy: https://policies.google.com/privacy
• Check DPF certification: https://www.dataprivacyframework.gov/list

6.6 Data Processing Agreement

A data processing agreement pursuant to Art. 28 GDPR exists with Google on the basis of the "Data Processing Addendum for Products Where Google is a Data Processor", which applies to the Gemini API on the paid tier.

6.7 Semantic Search and Embeddings

So that you can search your entries by meaning rather than keywords alone, your content is converted into semantic vectors (embeddings).

How it works: The texts are transmitted to the Gemini API for conversion (see sections 6.2 to 6.6) and returned as numerical vectors.

Storage location: The vector database runs on our own servers in Germany. Vectors are not transmitted to third parties.

Storage duration: Vectors are deleted together with the associated content.

Legal basis: Art. 6(1)(b) GDPR (contract performance – search function as a core component of the service).

6.8 Transparency Regarding AI Content

In chat you are visibly interacting with an AI system; AI contributions are marked as such in the interface. Changes that a connected AI agent makes to your notes are labelled as agent actions in the change history.

Text you copy from an AI response into a note is not technically marked as such. If you publish such content, labelling obligations may apply to you — in particular under Art. 50 of Regulation (EU) 2024/1689 (AI Act).

AI-generated content may contain errors and should be independently reviewed before use.

7. Connecting External AI Agents

You can connect external AI applications (such as Claude or other programs supporting the Model Context Protocol) to your account. These agents then access your content through a secured interface.

This is a deliberate disclosure of your content to a third party of your choosing. Please note:

• The connection is only established once you explicitly confirm it in an authorization dialog.
• For each agent you individually decide whether it may create, read, modify, and delete notes. All permissions are disabled by default. Create permission is granted independently; modify includes read, and delete includes modify and read.
• Granted read, modify, and delete permissions apply to unprotected notes in your account outside the trash, not just selected notes. AI-protected notes and Goodterm chats are excluded from this access. Only you can change AI protection. Deletion by an agent moves a note to the trash.
• For each agent we store the name it provides when connecting, the permissions granted, and connection and access timestamps.
• What the agent does with the retrieved content is governed by its provider's privacy policy. We have no influence over this.
• You can revoke any connection in your settings at any time with immediate effect.

Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out beforehand.

8. Email Delivery

8.1 Provider

For sending emails we use:

Brevo GmbH
Köpenicker Straße 126
10179 Berlin
Germany

8.2 Scope

We send transactional emails required to operate your account:

• Confirmation of your email address
• Password reset
• Confirmation and completion of an account deletion

You may also voluntarily subscribe to Goodterm news by email, including without an account. Editions cover product updates and ways to use Goodterm. You receive the newsletter only after confirming your separate subscription. Creating an account or giving feedback does not subscribe you.

Unsubscribe at any time using the link in each edition or by emailing hello@goodterm.net. This independent subscription is not automatically changed by deleting your account or changing your account email. Unsubscribing from the newsletter does not stop necessary account emails. We evaluate neither open nor click behavior.

8.3 Processed Data

When you submit feedback under Settings → Feedback, we send your entered text and account handle through Brevo to hello@goodterm.net. We send a copy to your verified email address, if available, and include it as the reply address. Notes, chat history and device diagnostics are not automatically attached. Feedback is not stored as a Record or in application logs; the message is handled as an email.

For account emails: email address, username, and time of sending. For the newsletter: email address, chosen language, consent wording, subscription and confirmation times, withdrawal, and sending and delivery status. Brevo also processes technical access data when its subscription form is opened. Note, chat, and feedback content is not used for the newsletter.

8.4 Data Storage

Brevo stores email delivery data within the European Union. Subprocessors outside the EU may be involved in support and technical maintenance. Where this involves processing personal data in third countries, the safeguards agreed in the data processing agreement apply, in particular standard contractual clauses under Art. 46 GDPR or applicable adequacy decisions. Information about these safeguards is available from hello@goodterm.net.

Newsletter data is used for the duration of the subscription. Withdrawal stops further newsletter sending. Necessary consent and withdrawal evidence is kept with restricted access until the end of the third calendar year following termination of the subscription, then deleted unless a specific legal case requires longer retention. A minimal suppression record also ensures your withdrawal is respected. Unconfirmed registrations do not authorize newsletter delivery; their confirmation link expires after 30 days.

8.5 Legal Basis

Necessary account emails: Art. 6(1)(b) GDPR (contract performance). They cannot be unsubscribed from while the account is operated.

Newsletter: Art. 6(1)(a) GDPR (consent) and Section 7(2)(2) of the German Act Against Unfair Competition (UWG). Using Goodterm does not depend on subscribing. Withdrawal takes effect for the future and does not affect the lawfulness of prior processing. Restricted evidence retention is based on Art. 6(1)(c) together with Art. 5(2) and Art. 7(1) GDPR, and Art. 6(1)(f) GDPR (accountability and legal defence). Minimal suppression data is used to respect your withdrawal.

8.6 Data Processing Agreement

A data processing agreement pursuant to Art. 28 GDPR exists with Brevo.

9. Cookies and Local Storage

9.1 Technically Necessary Cookies

We use only technically necessary cookies:

These cookies are configured as httpOnly and cannot be read by JavaScript in the browser. This protects against Cross-Site Scripting (XSS).

9.2 No Tracking or Marketing Cookies

No analytics, tracking, or marketing cookies are used. Optional usage analytics under Section 3.7 use no additional cookies.

9.3 Legal Basis

The use of technically necessary cookies is based on § 25(2) No. 2 TDDDG (German Telecommunications-Telemedia Data Protection Act – strictly necessary) and Art. 6(1)(b) GDPR (contract performance).

A cookie banner with consent request is therefore not required.

9.4 Local Browser Storage

In addition, we use your browser's localStorage and sessionStorage for technically necessary functions such as user settings and interface state.

This data remains in your browser and is not transmitted to our servers. You can delete it at any time via your browser settings.

Legal basis: § 25(2) No. 2 TDDDG (technically necessary).

9.5 Interface Hints

Text hints in input fields depend on the area you have opened, the current input or recording state, the available features and the local calendar date. These hints are selected directly in the application. We do not create a separate usage history or transmit additional usage data for this purpose. The optional usage analytics described in Section 3.7 are not used to select these hints. You can turn tips on or off under Settings → Appearance. This display preference is stored only on your device and remains in place when you switch accounts.

10. Native App

Goodterm is also available as an Android app. It accesses the same interface as the web application; the sections above apply.

For distribution and installation via an app store, the respective store operator is independently responsible under data protection law. We have no influence over its processing (such as download statistics or device identifiers).

The app contains no analytics or advertising SDK; optional usage statistics are collected only after your consent as described in Section 3.7. If a technical error occurs, the app sends an error report as described in Section 3.6. Sign-in data is stored in the operating system's protected storage.

11. Backups

To protect against data loss, we create regular backups of the database. These are transferred encrypted to a geographically separate storage location in Germany.

Database backups are retained on a staggered schedule: up to 24 hourly, seven daily, four weekly, six monthly and one yearly snapshot. Older snapshots are automatically removed according to this schedule. Backup retention can therefore exceed the deletion periods in the active system. For technical reasons, deleted data only drops out of backups once those expire. Restoration takes place solely in an emergency to recover the overall system.

Legal basis: Art. 6(1)(f) GDPR in conjunction with Art. 32(1)(c) GDPR (resilience).

12. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: TLS for all data transfers
• Passwords: stored exclusively as hashes, using an established method in line with the state of the art
• Tokens: session, device, and confirmation tokens are stored only as hashes
• Access control: authentication and authorization management, agent permissions disabled by default
• System security: regular updates and security patches
• Hosting: ISO 27001 certified data centers in Germany
• Backups: encrypted and geographically separate

13. Storage Duration at a Glance

Personal data is deleted as soon as the purpose of processing ceases and no statutory retention obligations exist.

14. Your Rights

You have the following rights regarding your personal data:

14.1 Right of Access (Art. 15 GDPR)

You can request information about whether and what personal data we process about you.

14.2 Right to Rectification (Art. 16 GDPR)

You can request the correction of inaccurate data or the completion of incomplete data.

14.3 Right to Erasure (Art. 17 GDPR)

You can request the deletion of your data, provided no statutory retention obligations prevent this. You can delete your account yourself at any time (see section 4.5).

14.4 Right to Restriction (Art. 18 GDPR)

You can request the restriction of processing, e.g., if you dispute the accuracy of the data.

14.5 Right to Data Portability (Art. 20 GDPR)

You can request to receive your data in a structured, commonly used, and machine-readable format.

14.6 Right to Object (Art. 21 GDPR)

You can object to the processing of your data insofar as it is based on legitimate interest (Art. 6(1)(f) GDPR).

14.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You can withdraw a given consent — such as the connection of an external AI agent — at any time with effect for the future.

14.8 Exercising Your Rights

To exercise your rights, contact: hello@goodterm.net

We will respond to your request without undue delay, at the latest within one month.

15. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

Competent supervisory authority for Bavaria:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany

Phone: +49 (0) 981 180093-0
Email: messagestelle@lda.bayern.de
Website: https://www.lda.bayern.de

16. No Automated Decision-Making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

17. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to comply with changed legal requirements or changes to our service.

The current version is always available at goodterm.net/legal/privacy.

Last updated: October 2026