Privacy

txt stores the content and metadata that an account chooses to synchronize so those files can be available across authorized clients. A file may include its name, text, type, folder, context, tags, availability preference, timestamps, versions, links, comments, and collaboration state. Local-only material stays outside the cloud API until a client uploads it. Public or shared links expose only the resource and permissions selected by the owner; owners should review a link before distributing it.

API keys are generated for an account, shown once, and stored as cryptographic hashes rather than recoverable plaintext. Keys may be scoped, expired, rotated, and revoked. OAuth tokens and provider credentials are handled as secrets. Browser-supplied AI credentials use the configured encrypted vault and are not returned by read APIs. Agents and integrations must not place tokens, passwords, private keys, or unrelated personal data into note bodies, prompts, logs, URLs, webhook targets, or support reports.

The service records limited operational information needed for security and reliability, including request identifiers, credential identifiers, aggregate usage, response status, and latency. API responses expose rate-limit state so clients can self-throttle. Webhooks are signed and private-network targets are rejected. Users control ordinary deletion through recoverable trash where supported and can permanently purge only through an explicit confirmation path. This page describes current product behavior and is not a substitute for a separately executed enterprise data-processing agreement.