Your study data stays yours.

This summary is written for speed, not for precision. The sections that follow it are the operative ones.

We do not run advertising, we do not embed advertising, attribution or cross-app tracking SDKs, we do not build advertising profiles, and we do not sell or share your personal information.

knot is developed and published by Numinous Lab, an independent software and publishing studio. Where this policy says “we”, “us” or “our”, it means Numinous Lab. Where it says “knot”, it means the knot mobile application for iOS and Android (bundle identifier com.numinouslab.knot).

For the purposes of data protection law, Numinous Lab is the data controller for the limited personal information described in this policy. You can reach us at support@numinouslab.com.

knot stores your study material in a local database on your device. This is the core of the product, not an afterthought: the application is built to work with the network switched off entirely. The following is written to that local database, and is not transmitted to us unless you send it yourself (sections 5 and 6):

• Notes and recall cards, their collections and tags.
• Their review schedules and your review history.
• Focus sessions and their timings.
• Events and study sessions in your plan.
• Study plan preferences, reminder preferences and app settings.

You can use knot for local study without an account. An account exists for two reasons: to connect your knot Pro subscription to an identity that survives a change of device, and to use Ask Knot (section 6), which needs one so its requests can be counted and limited.

Where you choose to create one, we process:

• Your email address — used to send you a sign-in link, and to contact you about your account or subscription if we need to. knot uses passwordless sign-in, so we never hold a password for you.
• Details from Google or Apple, if you sign in with them — your name, email address and, from Google, your profile photo. With Apple you can choose to hide your email address. We never receive your Google or Apple password.
• An account identifier — a random identifier generated for your account, used internally to link your subscription entitlement and your Ask Knot request count.
• A display name, if you set or change one.
• Account timestamps — when the account was created and last updated.

We process this information to perform our contract with you: providing the account, the subscription entitlement, and Ask Knot when you use it. Signing out, or deleting your online account, does not remove the study data held locally on your device.

Backup files

knot can write a backup of your study database to a file — your notes and recall cards, their collections and tags, their review schedules and review history, your focus sessions and your study plan preferences. The file is made on your device and saved where you choose: on Android, in your Downloads folder, or anywhere you send it from the share sheet. It is not sent to us, and it is not encrypted, so keep it somewhere you trust. Restoring reads a backup file you pick, on your device.

Account backup

knot does not back up your study data to our servers. If we add automatic backup to your account, we will update this policy before it is offered, and it will only run if you turn it on.

Importing from Anki and Quizlet

You can bring flashcards in from an Anki deck file or from text you copy out of Quizlet or a spreadsheet. The file or text you pick is read on your device and turned into cards there; it is not sent to us, to Anki or to Quizlet.

Ask Knot drafts notes, flashcards, collections and plan events from what you ask for. It only runs when you send it a request, and nothing it drafts is saved until you accept it. It needs a knot account.

When you send a request, knot sends:

• What you type, and the earlier messages in that conversation.
• A photo or PDF, if you attach one. knot reads only the file you pick, when you pick it.
• The full text of any notes you mention in the request.
• The names of your collections and the current date and time, so drafts land in the right collection and events at the right time.

The request goes to our server, which passes it to an AI model and returns its drafts to your device. We do not store your requests, files or the drafts, and we do not log their content; we keep only a count of your requests, to apply the free allowance.

• knot’s own model. A free account’s few requests, and older versions of the app, run on Google’s Gemini API, which we pay for. Under Google’s terms for the paid Gemini API, Google does not use these requests to improve its products.
• Your own AI key. With knot Pro, Ask Knot runs on a key you add from Google, OpenAI, Anthropic or OpenRouter. The key is kept in your device’s secure storage and sent with each request, used for that call only, and never stored or logged by us. Your request goes to the provider you chose, under your account with them and their privacy policy — some free tiers, including Google’s, may use requests to improve their products.

Requests to the model pass through Cloudflare’s AI Gateway, which we have set not to keep their content: it records only the model, token counts, cost and whether the call succeeded.

knot Pro is sold as an auto-renewing subscription through the Apple App Store and Google Play. Your payment is processed entirely by Apple or Google. We never receive, see or store your card number, billing address or any other payment credential.

To know whether your subscription is active, knot uses RevenueCat, a subscription infrastructure provider, as a processor on our behalf. RevenueCat receives the purchase and renewal events from the stores and tells the application whether the knot Pro entitlement is active. The identifier we give RevenueCat for you is the opaque random identifier of your knot account — never your email address. If you use knot without an account, the identity is anonymous and device-generated.

Your entitlement state — whether Pro is active, and until when — is also recorded against your account on our own server, because access to Pro features such as Ask Knot on your own key is checked server-side rather than trusted from the application.

knot uses PostHog, a product analytics service, as a processor on our behalf, to understand which features are used and where the application falls short. When something happens in the app — for example a card is created or reviewed, a focus session finishes, onboarding is completed or the subscription screen is opened — knot records an event describing it.

An event contains:

• The name of the action, and plain counts and settings about it — such as how many cards were created, the grade given in a review, a focus session’s length, or whether Strict Mode was on.
• A random identifier generated by the application on your device, so that events from the same installation can be grouped.
• Technical details: the knot version, your device model, operating system and version, language, time zone and screen size.
• An approximate location (country and city) that PostHog derives from the IP address the event arrives from.

If you sign in, events are linked to your knot account identifier, and we give PostHog your email address and name so that we can recognise your account when you contact us about a problem. If you sign out, the link is reset and new events are recorded against a new random identifier.

We rely on our legitimate interest in maintaining and improving knot. You can object to this processing, or ask us to delete the analytics linked to your account, by writing to support@numinouslab.com.

When crash reporting is enabled in a released build, a failure in the application sends us a technical report so that we can fix it. A report contains the error name and message, the stack trace, the component involved, a small amount of technical context such as which operation was running, the knot version, and your platform and operating system version.

Unhandled errors are also reported to PostHog (section 8) with the same technical details as its events, and are linked to your account if you are signed in, so that we can follow up on a problem you report. Crash reports never contain your notes, cards or any other study content, and are not used for advertising. If crash reporting is not configured in a build, reports stay in memory on the device and are shown only in the in-app diagnostics view.

knot’s reminders are local notifications. They are scheduled by the application on your own device, from your own review schedule, and are delivered by your operating system. There is no push server involved: we do not register a push token for your device, and we do not send you notifications remotely.

On Android, knot requests permission to schedule exact alarms so a reminder arrives at the time you set rather than whenever the system next decides to batch work. You can turn reminders off inside knot, or revoke the notification permission in your operating system settings, at any time.

• No advertising, and no advertising identifiers.
• No advertising, attribution or session-replay SDKs. The only analytics service is PostHog, used for our own product analytics as described in section 8.
• No tracking of you across other apps or websites.
• No sale of personal information, and no sharing of it for advertising.
• No disclosure of your data to data brokers.
• No AI processing of your notes or cards unless you send them to Ask Knot yourself (section 6), and no use of them by us to train anything.

We may disclose information where we are legally required to do so — for example in response to a valid legal process — but note that the design above means there is very little to disclose.

We use a small number of providers to run knot. They act on our instructions and are bound to protect the information they process for us.

On your device

Local study data is kept until you remove it. Deleted notes and cards wait in Trash before they are removed for good. Uninstalling knot deletes the local database and everything in it.

Your account

You can delete your knot account from inside the application. Deleting it removes your sign-in record, your profile, your entitlement record and your Ask Knot request count from our servers. Analytics events already recorded are not removed automatically; write to us and we will delete the ones linked to your account. This is not reversible, and it does not delete the study data on your device.

Your subscription

A store subscription is separate from your knot account and is not cancelled by deleting the account. Cancel it through your Apple or Google account, or through the subscription management screen in knot. We keep a minimal record of subscription events for as long as needed to honour entitlements and to meet tax and accounting obligations.

Ask Knot

Requests, files and drafts are not kept on our servers once a request is answered. Your request count is kept while you have an account.

Diagnostics and analytics

Crash reports are retained only as long as they are useful for fixing the failure they describe, and are deleted on a rolling basis. Analytics events are kept only as long as they are useful for understanding how knot is used, and are then deleted.

Depending on where you live, you have rights over the personal information we hold about you — including under the Nigeria Data Protection Act, the EU and UK GDPR, and comparable laws elsewhere. These typically include the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have your information deleted.
• Receive a copy of your information in a portable form.
• Object to or restrict certain processing.
• Withdraw consent, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

Much of this is built into the application: your study data is already in your possession, account deletion is available in-app, and your data can be exported from Settings. For anything else, write to support@numinouslab.com and we will respond within the time your law requires, and in any event within 30 days. We do not sell or share personal information as those terms are defined under California law, and we do not process sensitive personal information for advertising.

knot is a study tool for university-level material and is not directed at children under 13. You must be at least 13 years old to create a knot account, or older where your country sets a higher age for consent to data processing — 16 in parts of the European Economic Area. Local study without an account requires no personal information at all.

If you believe a child has created an account with us, contact support@numinouslab.com and we will delete it.

Traffic between the application and our servers is encrypted in transit. Our database enforces row-level access rules so that account records are readable only by the account that owns them, and our hosting provider encrypts stored data at rest. No system is perfectly secure, and we cannot guarantee absolute security, but we design to keep the amount of information worth attacking as small as possible.

Our providers operate infrastructure in several countries, so information may be processed outside your country of residence. Where such a transfer involves personal information protected by your local law, we rely on appropriate safeguards for the transfer.

If we change this policy we will update the effective date and version at the top of this page. Where a change materially affects how we handle your information, we will give notice in the application before it takes effect. Continuing to use knot after a change takes effect means you accept the updated policy.

Questions about this policy, or a request about your information, can be sent to support@numinouslab.com. Please tell us which application you are writing about and, if you have an account, the email address you use with it.