Privacy policy.
Notes in your browser
Duonote saves note text, formatting, the full webpage URL, position, size, color, visibility, order, timestamps and creator information in this Chrome profile using chrome.storage.local. It also saves appearance preferences, connection permissions, operation receipts and update status. Manual notes work without an account, a native helper or an Internet connection. There is no cloud sync or cloud backup.
The extension uses the current page URL to restore that page's notes. During a browser session, notes already open in a tab also follow that tab to other pages. References to their original URLs and note IDs are kept in chrome.storage.session; they are cleared when the tab closes, Chrome restarts or the extension reloads. Note text remains in its original local record, and the temporary references are not sent to our service. Moving to another website makes the carried notes visible in that website's DOM too. A URL includes its query and fragment, which can contain private information. It does not build a separate browsing-history database or expose page content or device files through its note tools. It does not send every page you visit to a server. Notes displayed on a webpage are part of its DOM and should not be treated as secret from that website.
Purchase and activation
The free version includes one saved note across this browser profile, including hidden notes. A one-time $9.99 purchase unlocks additional notes and includes future Duonote updates. Gumroad handles checkout, payment details, receipts and the 14-day refund policy. Selecting Buy now opens Gumroad checkout in an isolated frame in a separate extension window, with a link to continue directly on Gumroad. No Gumroad page is loaded by the upgrade prompt before you choose to buy. Duonote does not receive or store your payment-card details.
When you activate a license, the extension sends the license key and a random installation identifier to our HTTPS verification service on Cloudflare. The service sends the key and product identifier to Gumroad to verify the purchase and check refund or dispute status. Gumroad may return purchaser information, including the purchase email; our service does not store that response or include it in the signed activation proof. No note text, webpage URLs, browsing history or agent credentials are sent for license verification. The installation identifier is randomly generated and is not a hardware fingerprint.
The extension stores the license key, signed activation proof, installation identifier and verification timestamps in this Chrome profile. It checks an activated license at most once daily automatically, and when you select Check license. Network failures do not expire an activated license. A confirmed refund or invalid license blocks creation of additional notes while preserving access to, editing and export of existing notes. Removing the license in Settings removes the local key and proof; uninstalling clears extension storage. Gumroad retains purchase records under its own privacy and legal obligations.
The verification service has no customer database or application request logging. Cloudflare processes network metadata, including the IP address used to limit repeated activation attempts.
Optional local agents
If you install the separate local connection and approve an agent in Settings, Codex or Claude Code can receive note text, formatting, the requested page URL and note metadata within the permissions you grant. Communication between Chrome and the local helper stays on this computer. No Duonote hosted relay processes those local note operations. The AI application may send tool inputs and results to its provider, under that provider's policies. Connecting an agent is optional; reading, editing and deletion permissions are enforced by the extension.
The setup program installs a native host, MCP runtime and usage skill under your operating-system account and configures your selected agent. It stores credentials in private local files; Chrome stores credential hashes, site permissions and connection timestamps. The host holds note data temporarily while delivering a request and does not keep a note database. Local pairing requests expire after five minutes. Operation receipts expire after 24 hours and are cleaned on startup, writes and maintenance.
The optional installer downloads official Node.js/npm binaries when needed and the versioned Duonote package, verifying their integrity. Optional helper updates check npm metadata at most daily on agent startup. Download services receive normal network metadata, such as IP address, but not note contents from these checks. The helper's --no-auto-update option disables these checks. Chrome manages extension updates separately.
Existing hosted connections
The earlier remote connection is separate from local setup. When you authorize it, requested note content and URLs pass through our Cloudflare service and your selected AI application over HTTPS/WSS. This route is not end-to-end encrypted through the service. It does not synchronize a copy of your notes to the cloud.
The hosted service retains an opaque browser identifier, browser name, hashed device credentials, authorized client names, allowed origins, permissions, OAuth records, connection timestamps and aggregate usage counts. It does not durably store note bodies or full page URLs in its application databases or logs. Cloudflare may process operational network metadata. Google sign-in and Google tokens are not used by the current connection flow.
Hosted authorization challenges expire after ten minutes, socket tickets after 30 seconds, access tokens after one hour and refresh tokens after 30 days. Expired challenges are removed by a daily job. Browser/grant metadata and usage totals remain until deletion is processed. Contact us to request deletion of hosted metadata; we must verify ownership before acting.
Your choices and security
You can edit or delete individual notes and disconnect agents in Settings. A note's menu can copy its text to your clipboard or download it as a Markdown file; these actions do not send the note to our service. Downloaded files are separate from extension storage and remain after uninstalling. Disconnecting preserves notes and blocks subsequent agent operations; it does not erase copies already received by an AI provider. Uninstalling the extension removes that installation's Chrome storage. There is no bulk backup/import interface or cloud restore. Do not uninstall to repair an update if you still need the notes. An unsaved draft can also be downloaded as plain text if an extension update interrupts saving.
Local notes remain until you delete them, clear the extension's storage or uninstall it. Empty page records and unexpired operation receipts may remain after the final note is deleted. Local connection credentials and installed helper files remain on disk until removed; browser revocation invalidates access. Duonote does not add application-level encryption to Chrome's local storage. Protect access to your operating-system account and browser profile.
Website analytics
This section applies to ahmedmagdi.com, including this Duonote website. It does not add analytics to the browser extension or read your saved notes.
When enabled, Google Analytics measures visits to public pages, views of website sections, FAQ and demo interactions, and clicks to products, guides, contact channels, the Chrome Web Store and Gumroad. The website sends controlled page and event labels, not note text, email addresses, license keys, raw search queries or private receipt URLs. Google processes normal network and device information to provide Analytics. Google Signals, advertising personalization and user-provided data collection are disabled.
We use a country signal from the website’s existing Cloudflare connection to apply our reviewed regional consent settings. We do not request precise location or store the connection trace or IP address in the consent preference. Where opt-in is required, Analytics stays off until you accept. If the region is unknown or has not been reviewed, Analytics stays off unless you enable it yourself. Browser privacy signals are respected. Country detection is approximate and can be affected by VPNs.
Use Analytics preferences in the footer to accept or reject Analytics at any time. Your choice is stored in this browser for up to 180 days and applies across the personal and Duonote pages on this domain. Rejecting does not limit access to the website. Withdrawal stops future website measurement and removes this site’s Analytics cookies; it does not retroactively erase events already received by Google.
Analytics cookies are configured to last up to 180 days, with expiry refreshed on use. The existing Analytics property retains event data for 2 months and user data for 14 months, with the user-retention period reset by new activity. Aggregated reporting can be retained longer. The consent preference is necessary to remember your choice and is separate from Analytics cookies.
Gumroad operates checkout under its own privacy practices and provides our sales records. Clicking Buy now on this website records purchase intent only, not a completed sale. Gumroad’s separate Analytics integration, when enabled, reports transaction information such as an order identifier, product, amount and currency. Payment-card details are not collected by this website. Website consent should not be assumed to control another domain’s checkout.
Limited use
Our use of information received through Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use restrictions. We use note data only to provide the described note and authorized-agent features. We do not sell it, use it for advertising, lending or credit decisions, or train a Duonote model with it. Human access is limited to your specific consent, security investigations or legal obligations. Data may be disclosed when required by law.
Duonote contains no advertising, analytics SDKs or AI model. Payment-card collection happens on Gumroad’s origin, including when its checkout is displayed in the separate purchase window. Duonote cannot read the contents of that cross-origin checkout frame. Fonts, icons, release notes and animation assets are bundled locally. Displaying them does not contact a CDN. Release reminders use only locally stored version/read status. This product is independent of Google, OpenAI and Anthropic.
Changes to these practices will be reflected in this policy; material changes to data use will also be disclosed in the product.