Privacy Policy
Noterva · Noterva Journals · Noterva Assistant — by The Writing Project. Last updated: 16 July 2026.
This policy covers the three Noterva browser extensions. Where they behave differently, it says so per product. We have tried to write it so that you can check it against what the extension actually does — the code is readable in the store package, and nothing below is hidden in it.
1. The short version
What we do receive is the minimum needed to run a licence: an anonymous device identifier, and — if you register for a licence — your name and email address.
2. What each extension sends, and where
| What | Goes to | Why | Applies to |
|---|---|---|---|
| Anonymous device ID (a random UUID generated on your computer) | community.thewritingproject.me | To check whether your licence or free trial is active, and to stop one code being used on many machines. It is not derived from your hardware and cannot identify you. | All three |
| Your name and email | community.thewritingproject.me | Only if you fill in the licence form. Used to issue your licence and to contact you about it. | All three |
| AI model files (download only — nothing is uploaded) | huggingface.co, or hf-mirror.com if your connection blocks it | To fetch the on-device models the first time you use them. Standard file downloads. Your text is never part of this. | Assistant |
| The text you selected | The AI provider you chose — Groq, OpenAI, Anthropic or Google | Only if you switch off on-device mode and enter your own API key. See section 3. | Assistant |
3. Noterva Assistant: on-device by default, cloud only if you ask
Co-Pilot mode sends nothing anywhere. It builds a prompt from your selection, copies it to your clipboard, and opens the AI website you chose so you can paste it yourself.
API keys you enter are stored only in your browser’s local extension storage, on your computer. They are never transmitted to us.
4. Permissions, and why each one exists
Noterva Assistant requests:
- contextMenus — to add the right-click menu.
- storage and unlimitedStorage — to save your settings and licence status locally, and to cache the on-device AI models, which are large.
- activeTab and scripting — to show the result panel on the page you are reading, when you ask for it.
- offscreen — to run the on-device AI models in a background page.
- Access to the sites you visit — the extension needs to read the text you have selected in order to summarize or translate it. It reads only your selection, only when you invoke an action, and sends it nowhere unless you have opted into a cloud provider.
- Network access is limited to the specific hosts in section 2. Access to OpenAI, Anthropic and Google is optional and is requested only if you choose one of them.
Noterva (Reference Manager) additionally uses downloads (to save PDF, RIS and BibTeX files) and tabs (for “Collect All Tabs”). Noterva Assistant requests neither.
5. Storage and security
Licence codes are signed with ECDSA P-256 and verified in the extension against a public key. This protects a code from being forged or tampered with. It is a signature, not encryption: it protects the licence, and it is not a claim about the confidentiality of anything else.
Settings, licence status and any API keys are stored in your browser’s extension storage on your own computer. Uninstalling the extension removes them.
6. Children
These extensions are intended for researchers and students in higher education and are not directed at children under 13. We do not knowingly collect data from them.
7. Your rights
Ask us and we will tell you what we hold against your email address, correct it, or delete it. There is no dark pattern here — email us and it is done. To remove everything held locally, uninstall the extension; to clear only your API keys, use “Clear all keys” in the settings.
8. Changes
If we change what data is collected or where it goes, we will change this page and the “last updated” date above, and say what changed. We will not quietly broaden it.