Privacy for the Noteflix ChatGPT plugin

Data the plugin handles

Study workflows use text you supply in the current ChatGPT conversation. The plugin does not inspect uploads, retrieve prior chats, query model memory, or search your existing Noteflix library.

Only after explicit save intent, an exact payload preview, and separate confirmation, ChatGPT sends the approved title, Markdown body, optional approved summary and key points, a random request ID, and the identity bound to your OAuth grant. Noteflix also processes OAuth records, eligibility decisions, timestamps, request outcomes, and limited security and rate-limit metadata needed to operate and protect the service.

How the data is used

• Verify the notes:create permission and eligibility for the exact connected account.
• Reject restricted data before hashing, eligibility lookup, or a product write.
• Create one private note and return a minimized receipt.
• Prevent duplicate saves, abuse, and unauthorized access.

The connector cannot read or change existing notes, publish content, generate media, manage subscriptions, or return payment, email, plan, or raw entitlement details.

Retention

• Authorization requests: 10 minutes; authorization codes: 5 minutes; access-token records: 1 hour.
• Refresh-token records: 30 days and rotated on use.
• The public ChatGPT client-registration record is retained for the operating life of the connector or until administratively removed. It contains callback/client metadata, not a Noteflix user identity or note body. Other dynamic client registrations expire after 30 days.
• Idempotency receipts: 30 days. They contain hashes and a minimized receipt, not the note body, summary, or key points.
• Rate-limit records: the active window plus approximately 24 hours.

A private note remains in the connected Noteflix account until the user deletes that note or deletes the account. Production logs use bounded retention and are designed to exclude note bodies, OAuth tokens, passwords, challenge values, and reviewer credentials.

Sharing and processors

OpenAI processes conversation content and tool interactions under the user’s OpenAI settings and terms. Noteflix operates the OAuth service, MCP gateway, eligibility authority, and private-note backend. Google Cloud and Firebase provide hosting, identity, database, and storage infrastructure. The note-only path does not invoke media-generation or public-publication providers.

Your choices

Disconnect Noteflix in ChatGPT to stop future connector access. This does not delete previously saved notes. Use Noteflix product controls to delete notes or the account. For privacy and deletion requests that cannot be completed there, email support@noteflix.com.

Restricted data and age

Do not submit payment-card data, identifiable protected health information, government identifiers, passwords, API keys, authentication tokens, one-time passwords, or verification codes. The plugin is for general audiences age 13 and older and is not directed to children under 13.