Privacy Policy

Effective date: October 17, 2026

Overview

This policy explains what Teak collects, why, who helps us process it, and the choices you have. It covers the Teak web app, the iPhone, iPad, Mac and Android apps, the browser extension, Raycast, the CLI, the API, and MCP (together, the “Service”).

Teak is built and run by Praveen Juge (“Teak”, “we”, “us”). For privacy laws that use the term, we are the controller of your personal data. You can reach us at [email protected].

The short version: your cards are private to you, we don’t sell your data or use it for advertising, and analytics never see what your cards contain.

Data We Collect

Account data: your name, email address, optional profile photo, sign-in details, and account preferences.
Your content: cards (notes, links, images, videos, audio, documents, palettes, quotes), the files you upload, tags, folders, favorites, notes, and timestamps.
Generated data: tags, summaries, audio transcripts, colors, thumbnails, link previews, screenshots and search embeddings that Teak creates from your content (see AI Processing).
Usage and diagnostic data: which features you use (for example, that you saved a card or ran a search), page views, performance timings, error and crash reports, and device, browser and app version details. These are linked to your Teak account ID and email.
Billing data: your plan, subscription status, and the email used for checkout. Payment card details go directly to our payment provider, Polar; we never see or store them.
Capture data: the page URL, title, or text you choose to save from the browser extension, share sheets, Raycast, the CLI, the API, or MCP.
Support messages: anything you send us by email.

How We Use Your Data

To run the Service: store, organize, sync and search your content across devices; create thumbnails, previews, tags, summaries and transcripts; and process imports and exports.
To keep it working: find and fix bugs, measure performance, and understand which features are used so we can improve them.
To keep it safe: prevent abuse, enforce rate and plan limits, and secure accounts.
For billing and support: manage subscriptions and refunds, and answer your questions.
For legal reasons: meet tax, accounting and other legal obligations.

We don’t sell your personal data, we don’t use it for advertising, and we don’t train AI models on your content.

AI Processing

Teak uses AI to tag, summarize and transcribe your cards so you can find them later. These models run on Cloudflare Workers AI, operated by Cloudflare on our behalf. No card content is sent to OpenAI, Anthropic, Google or other AI companies by Teak.

What is processed: the text of text, quote and document cards; image and video thumbnails; audio files (for transcripts); palette colors; and link titles, descriptions and URLs.
What is created: tags, a short summary, visual style labels, and audio transcripts. These are stored with the card and deleted with it.
Search by meaning: Teak turns each card’s title, description, summary, tags, notes, visual style labels, and the start of its text or transcript into a list of numbers (an embedding) with a model on Cloudflare Workers AI. The embedding is stored in a Cloudflare Vectorize search index, tagged with your account so searches only ever return your own cards, and used only to find your cards by meaning. It’s updated when the card changes and deleted when the card or your account is deleted.
Best match: when you search with words and sort by Best match (the default), Teak sends your search words and a short description of each of the top 64 results to a model on Cloudflare Workers AI, which scores how well each card matches. The description is the card’s type, title, site, description, summary, up to six tags, notes and the first 300 characters of its text. The scores are kept for 24 hours under a hash of your search words, so the words themselves aren’t stored. Searches that only use filters, such as a tag or type, send nothing.
AI output can be wrong. You can edit or ignore generated tags and summaries.

Links You Save

When you save a link, Teak’s servers visit that page to fetch its title, description, preview image and a screenshot. The website sees a request from Teak’s servers, not from your device. For posts on X, Teak also asks X’s public embed service for the post’s details.

In the web app, a link’s site icon is loaded from Google’s favicon service, which receives the website’s domain name and your browser’s IP address.

Service Providers

We use these providers to run Teak. Each handles only the data it needs for its job, under its own terms and data processing agreement.

Provider	Purpose	Data involved
Convex	Database and backend	Account data, your content, generated data
Cloudflare	File storage, AI processing, search index, image, video and document processing, page rendering, and routing and rate-limiting API and MCP requests	Uploaded files, card content sent for AI processing, search words and result descriptions for Best match, embeddings of card text, saved page content, API and MCP requests including the content they carry
Vercel	Hosts the web app and website	Requests to the web app and website
WorkOS	Sign-in and sign-in emails	Name, email, sign-in details, session and device information
Polar	Payments, as merchant of record	Email, Teak account ID, payment details, billing address, subscription history
PostHog	Product analytics and error reports	Usage and diagnostic data, account ID and email

Integrations You Connect

If you connect Teak to another tool, such as Raycast AI, an MCP client like Claude or ChatGPT, or your own scripts through the API or CLI, the cards and data that tool requests are sent to it. What happens next is governed by that tool’s own privacy policy. You can revoke API keys and connected apps at any time in Settings.

Product Analytics and Error Reports

Teak uses PostHog (PostHog Inc., United States) for product analytics and error reports across the web app, the iPhone, iPad, Mac and Android apps, the browser extension, and Teak’s servers.

What it receives: page views, product events such as “card saved” or “signed in”, performance timings, AI usage counts (model, token counts and timing, never prompts or results), and error reports. Events are linked to your Teak account ID and email so we can fix problems you hit.
Session replays (web only): a sample of web sessions, and sessions where an error occurs, are recorded so we can see what went wrong. Replays mask all text and typed input and block images and media, so your cards and notes are never visible in them.
Feedback surveys (web only): if you answer an in-app survey, your answer is stored in PostHog.
What it never receives: the content of your cards, files, notes or searches, or AI prompts and results. Search text is masked in page addresses before anything is sent.
Where it doesn’t run: the Share and Safari extensions on Apple devices, the Firefox extension, the content scripts the Chrome extension adds to web pages, Raycast, and the CLI send nothing.

Your cards are private. Teak has no public sharing, and no other Teak user can see your content.
We share data only with the service providers above, with integrations you connect, when the law requires it (such as a valid court order), to protect the safety or rights of people or the Service, or as part of a merger, acquisition or sale of Teak, in which case this policy continues to apply to your data.
We don’t sell or “share” personal data for cross-context behavioral advertising, as those terms are defined in California law.

Data Retention

Data	How long we keep it
Cards, files and generated data	Until you delete them
Cards in Trash	30 days, then deleted for good
Data exports	7 days after they’re ready
Your account and content after you delete your account	Deletion starts immediately and finishes within 30 days
Deletion record	After deletion we keep a minimal record (account ID, email and deletion date) to prove the deletion and prevent abuse
Billing records	As long as tax and accounting law requires, held by Polar
Analytics and error reports	Up to PostHog’s retention period, until you delete your account, or until you ask us to delete them
Backups	Overwritten on our providers’ backup schedule, after which deleted data is gone from backups too

Data Security

Encryption in transit (HTTPS) and at rest
Secure, revocable sign-in sessions and API keys
Each account’s data is isolated from every other account
Automated backups for durability

No system is perfectly secure. If a breach affects your personal data, we’ll tell you as the law requires.

Your Rights & Controls

Wherever you live, you can:

Access your content in any Teak app.
Export your cards and original files as a ZIP from Settings in the web app, or with the API or CLI.
Correct your name or email by emailing us.
Delete individual cards or your entire account. See Delete Your Account.
Ask us for a copy of the data we hold about you, or to delete analytics and error reports, by emailing [email protected].

Depending on where you live (for example, the EEA, UK, California or India), you may also have the right to object to or restrict processing, to withdraw consent, to appoint someone to act for you, and to complain to your local data protection authority. We won’t treat you differently for using these rights. We answer requests within 30 days and may need to confirm your identity first.

Legal Basis (EEA and UK)

Contract: to provide the Service you signed up for, including AI processing and link previews.
Legitimate interests: analytics, error reports, security, and abuse prevention. You can object by emailing us.
Consent: where we ask for it, such as device permissions. You can withdraw it at any time.
Legal obligations: tax, accounting and responding to lawful requests.

International Data

Teak stores your account, content and files in the United States. Some providers, such as Cloudflare, may also process data in other countries where they operate, for example to run AI processing close to where it’s requested. Where the law requires it, these transfers are covered by safeguards such as the Standard Contractual Clauses in our providers’ data processing terms.

Platform Practices

Web: essential cookies for your sign-in session and sidebar layout; local storage for your theme; a first-party cookie and local storage entries that hold your PostHog analytics ID, account ID and email.
iPhone, iPad and Mac apps: sign-in credentials stored in the Keychain; camera (iPhone and iPad) and microphone only when you capture a photo or record audio; photos only through the system picker, which shares just the items you choose; crash reports and app open and close events through PostHog.
Android app: camera and microphone only when you use them; photos through the system picker; a notification while uploads finish in the background; crash reports and app open and close events through PostHog.
Browser extension: reads the current tab’s address, title, or selected content when you save. To add save buttons on supported sites (such as X, Hacker News, Instagram and Pinterest), it has access to the pages you visit, but it only acts on supported sites and sends nothing until you click save. It doesn’t track your browsing. In Chrome, error reports and a “card saved” event go to PostHog directly from the extension, without any remote code. The Firefox extension sends neither.
CLI, Raycast, API, MCP: authenticate with browser sign-in or an API key you control; revoke keys and connected apps anytime in Settings.

Cookies

Essential: sign-in sessions, sidebar layout, and security. These are needed for the web app to work.
Analytics: a first-party PostHog cookie for product analytics and error reports, served through Teak’s own domain. No advertising or cross-site tracking.

The Teak website and documentation set no cookies and run no analytics.

Privacy questions and data requests: [email protected]
Grievance officer: Praveen Juge, [email protected]
We reply within 7 days and complete data requests within 30 days.