Privacy Policy
Version 1.0 · effective from 29 September 2026
This policy explains what data about you ConfNote processes, why, for how long, and what your rights are. We have tried to keep it plain. If anything is unclear, write to privacy@confnote.io.
1. Who is responsible for your data
The controller of your personal data (within the meaning of the GDPR) is Adam Sokołowski, a natural person running the ConfNote service (confnote.io), hereinafter “ConfNote”, “we”.
Contact for all data matters: privacy@confnote.io.
We have not appointed a data protection officer — at the current scale of the service this is not required. The controller answers all questions.
2. Who this policy applies to
- Users with an account — the account is created by the controller at your request (public sign-up is currently closed).
- Guests — people who entered ConfNote by scanning an invitation QR code (for example during a presentation). A guest account has no email address and no password.
- Visitors to ConfNote's public pages who are not signed in.
- People named on public conference websites that ConfNote reads (see section 13).
3. What data we process and where it comes from
| Category | Examples | Source |
|---|---|---|
| Account data | email address, first and last name, password (we store only its encrypted hash) | you, or the controller who creates the account at your request |
| Guest account | a random account identifier; instead of an email, a technical address that does not work | created automatically after you scan the QR code |
| Research profile | field and discipline (required), affiliation — university, faculty, unit (optional), research interests (optional, up to 7 phrases), interface language | you |
| Your activity in ConfNote | tracked conferences, reminders, hidden conferences and deadlines, excluded fields, conferences you added and edited, data error reports, searches you typed, your feed decision history (“Matching signals”) | created as you use the service |
| Notifications | email address for notifications, your browser's push subscription identifier, private calendar link | you, when you turn these features on |
| Feedback | the text of a message sent with “Send feedback”, the page it was sent from, browser type | you |
| Technical data | IP address, browser and system type, request times, sign-in log | automatically, when you use the service |
We do not ask for special categories of data (for example about health, beliefs or religion). Please do not enter them in research interests, feedback or conference descriptions.
4. Why we process data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, signing in (including by QR code and “Sign in with your phone”) | Art. 6(1)(b) — providing the service you ask for |
| ConfNote features: conference feed, tracking, timeline, reminders, push and email notifications, weekly deadline summary, calendar subscription, adding and editing conferences | Art. 6(1)(b) |
| Matching content to your discipline and interests (section 5) | Art. 6(1)(b) — for the data you enter in your profile; Art. 6(1)(f) — for your feed decision history |
| Showing your name to other signed-in users next to conferences you added and on the list of people tracking a conference (section 7) | Art. 6(1)(f) — transparency of where shared data comes from; you can turn this off |
| Security: protection against abuse and overload, sign-in log, error detection | Art. 6(1)(f) — our legitimate interest in running the service securely |
| Developing and improving ConfNote: activity log, search statistics, feedback, AI model usage | Art. 6(1)(f) — improving the service and controlling costs |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) |
We do not send advertising or marketing. The emails you receive are only notifications you turned on yourself (confirmations, deadline reminders, a weekly summary of deadlines of tracked conferences) or technical messages (for example a password reset).
Do you have to provide data? An email address (for a regular account) and a discipline are needed to use ConfNote. Affiliation, research interests, signing your conferences and notifications are optional.
5. Content matching and profiling
ConfNote aims to match conferences to your research. Today it works like this:
- The feed order is not personalised. Conferences are listed newest first; only your own filters apply (hidden conferences, excluded fields).
- We collect data for future matching: your disciplines, research interests and feed decision history (hides, undos, tracking, excluded fields). We turn the text of your disciplines and interests into so-called semantic vectors using an OpenAI model — without your name, email or identifier.
- You can see how many signals have been collected in your profile (“Matching signals”).
This is profiling within the meaning of the GDPR (assessing your interests), but we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). Before matching starts to affect what you see, we will update this policy and let you turn it off.
You can change or remove your research interests in your profile at any time and object to the use of your feed decision history (section 11).
6. Artificial intelligence in ConfNote
- Conference information (dates, deadlines, fees, topics) is found and read automatically by AI models from public conference websites. It may contain errors — check it on the event's official website. You can report an error on the conference card.
- When you add a conference, the text you type (name, website address or description) is sent to search providers and AI models (section 8). Do not enter personal data there.
- We do not send your email, name, feedback or reports to AI models.
- We do not train our own models on your data.
7. What other users see
- Your name — next to conferences you add (“Added by…”), and your name and university — on the list of people tracking a conference. Only signed-in users see this. You can turn it off in your profile with the “Sign my conferences” switch.
- We do not display your email address to other users.
- Visitors who are not signed in see conferences and the number of people tracking them, with no data about individuals.
- Tracked conferences, reminders, hidden cards and your profile are private.
- The private calendar link lets anyone who has it (including your calendar provider) see the list of conferences you track. Do not share it; if needed, generate a new one in your profile — the old one will stop working.
- Conferences you add are shared content and stay in the database after your account is deleted. When we delete your account, we also remove their link to you, including your email address.
8. Who we share data with
We do not sell data. We share it only with companies that help us run ConfNote and process data on our instructions (processors):
| Recipient | Role | Data | Location |
|---|---|---|---|
| Supabase | database and sign-in | all data from section 3 | EU (Ireland) |
| Vercel | application hosting | site traffic, IP address, technical logs | EU (Ireland); US company |
| OpenAI | AI models: reading conference websites, semantic vectors | text typed when adding a conference; text of your disciplines and interests (without an identifier); in semantic search — the query text | USA |
| Google (Gemini API) | AI model: classifying conference fields | conference name and description; text typed when adding | USA |
| Tavily | searching for and retrieving conference websites | text typed when adding a conference | USA |
| Serper.dev | finding a conference website | conference name typed when adding | outside the EEA |
| Upstash | overload protection (rate limiting) | IP address, account identifier | EU or USA |
| Inngest | scheduled jobs (reminders, summaries) | account identifier, push subscription identifier | USA |
| Resend | sending emails | email address, notification content | EU or USA |
| Browser push services (Google, Mozilla, Apple) | delivering push notifications | device identifier; the notification content is encrypted | depends on the browser |
Public authorities may also receive data where the law requires it.
9. Transfers outside the European Economic Area
Some providers are based in the USA. Transfers rely on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for providers participating in it, or on standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to privacy@confnote.io.
10. How long we keep data
| Data | Period |
|---|---|
| Account and profile | until the account is deleted |
| Guest account | until deleted, or after 90 days without activity |
| Tracked conferences, reminders, settings | until the account is deleted, or until you change them |
| Feed decision history, activity log, searches, sign-in log | 12 months |
| Feedback | 24 months |
| IP address in overload protection | about 1 minute |
| Hosting technical logs | according to the provider's settings, no longer than 30 days |
| Text typed when adding a conference (background job) | 30 days |
| Conference website text stored for diagnostics | 90 days |
| “Sign in with your phone”: one-time code, PIN and the computer's browser name (e.g. “Chrome, Windows”) | up to 2 hours |
| Database backups | according to the provider's cycle, no longer than 30 days — deleted data disappears from backups after that |
| Conferences you added | indefinitely as shared content, without a link to you after your account is deleted |
When these periods end, we delete the data or anonymise it permanently.
11. Your rights
You have the right to:
- access your data and receive a copy,
- rectification — you can correct most data yourself in your profile,
- erasure (“the right to be forgotten”),
- restriction of processing,
- portability of the data you gave us, in a machine-readable format,
- object to processing based on our legitimate interest (Art. 6(1)(f)) — including the use of your feed decision history for content matching.
How to exercise them:
- Account with an email address: write from the address linked to your account to privacy@confnote.io. We will reply without undue delay and within one month at the latest (in exceptional cases this may be extended by two further months — we will tell you if so).
- Guest account: it has no email address, so ask for deletion or any other right from inside the app with “Send feedback” — this way we know the request comes from your account.
- You can change many settings yourself in your profile: research interests, affiliation, signing your conferences, notifications, the private calendar link.
12. Complaint to the supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. We encourage you to write to us first — we will try to help.
13. Data of people named on public conference websites
To complete conference information, ConfNote reads the conference's public website. Such pages often contain the names of committee members, speakers or contact persons.
- We do not build profiles of these people and do not store their data on conference cards — a card contains only facts about the event (name, dates, venue, deadlines, fees, topics).
- We keep the cleaned page text for 90 days to diagnose reading quality, and then delete it.
- Legal basis: Art. 6(1)(f) — the legitimate interest in providing reliable information about scientific conferences.
- If you are such a person and want to exercise your rights (including objection), write to privacy@confnote.io — you do not need an account.
15. Security
Our measures include: encrypted connections (HTTPS), row-level access control in the database, storing passwords only as hashes, short-lived single-use invitation and phone sign-in codes, overload protection, and safeguards that stop the page-fetching mechanism from reading internal addresses.
If a personal data breach may put you at risk, we will report it to the President of UODO within 72 hours, and if the risk is high, we will inform you without undue delay.
16. Age
ConfNote is intended for people aged 16 or over. If we learn that an account belongs to someone younger, we will delete it.
17. Changes to this policy
We may update this policy when ConfNote's features, providers or the law change — in particular before personalised feed ordering is turned on. We will announce significant changes in the app. The current version is always available at confnote.io/privacy.