Privacy Policy

This policy explains what Noodle (the “Service”) collects, how it is used, and the choices you have. Noodle is operated by Cranium AI, which is responsible for the information described here. “We” and “us” mean Cranium AI.

1. Information we collect

• Account information. When you sign in with Google, we receive your email address, your name and profile picture as Google provides them, and a user identifier from Firebase Authentication.
• Invites. Noodle is invite-only during the beta. We keep the email addresses we have invited, with the storage limit and the storage used for each.
• Sheets. The images you add, or that an AI assistant you connect sends you, with their titles, sheet numbers, notes and drawing scale.
• Your marks. The pen, highlighter, arrow and box marks you draw, the zones and numbered notes you add with their text, your overall notes, and a copy of each sheet with your marks drawn in.
• Connections to AI assistants. When you connect an assistant such as Claude, we keep a record of the app that connected and the access it was given. The sign-in codes and access tokens are stored only in scrambled (hashed) form.
• Operational records. Request logs, including IP addresses, used to limit abuse and to diagnose problems.

Marks you have not saved yet stay in your browser's storage on your device, and are not sent to us until you press Save.

2. How we use it

• To provide the Service: show you your sheets, save your marks, and let an assistant you connect read and answer them.
• To keep each person's Noodle private to them, and to enforce invites and storage limits.
• To secure the Service and limit abuse.
• To contact you about your invite or your account.

We do not sell your information, use it for advertising, or use your sheets or marks to train AI models.

3. AI assistants you connect

Noodle does not run AI models on your content. When you connect an AI assistant, such as Claude, it can list your sheets, read your marks and the marked-up images, send you new sheets and reply on them, but only for the account you signed in with when you connected it. What the assistant receives is then handled by its provider (Anthropic, for Claude) under their terms and your settings with them, not under this policy. You can end the connection at any time: remove Noodle from the assistant's connectors, or use Disconnect Claude in Noodle.

4. Where your information is kept

Noodle runs on Google Cloud through Firebase. Your account records and marks are kept in Toronto, Canada; images are kept in South Carolina, United States; and the part that answers AI assistants runs in Iowa, United States. Your information is therefore stored and processed in Canada and the United States.

5. Service providers

Google (Firebase and Google Cloud) provides hosting, sign-in, the database, file storage and computing for Noodle, and processes data on our behalf under its own terms.

6. How long we keep it

• Your sheets, marks and account records: for as long as your account exists, or until you remove them.
• Each time you save a sheet, the previous marked-up copy is deleted.
• Sign-in codes expire within minutes, access tokens within an hour, and connection refresh tokens within 30 days of their last use. One-time upload and download links expire after 15 minutes.
• When you delete your Noodle, your sheets, marks, files, connections and sign-in record are removed straight away. Google Cloud's request logs are kept for up to 30 days.

7. Security

Every sheet and file is stored under your own account, and the Service's access rules let only you, and assistants you connected, reach it. Connections use the OAuth standard with short-lived tokens, all traffic is encrypted in transit, and invites limit who can sign up. No system is perfectly secure, but we work to protect your information.

8. Your choices

• Remove any sheet, with its marks, from the sheet's Notes panel.
• Disconnect every AI assistant at once with Disconnect Claude.
• Delete your whole Noodle, every sheet, mark, file and connection along with your sign-in, with Delete my Noodle.
• Ask us for a copy of your information, or for anything else about your data, by email.

9. Children

Noodle is not directed to children, and we do not knowingly collect information from children.

10. Changes to this policy

We may update this policy. If we make material changes, we will update the effective date above and, where appropriate, tell you in Noodle or by email.

11. Contact

Questions about privacy, or a request about your data? Email support@cranium-ai.com.