Privacy Policy

Effective 4 November 2026

This policy describes SuperNotebookLM's website and browser extension. SuperNotebookLM is an independent research companion operated by Shakthi Sundar, not Google or NotebookLM. Questions and privacy requests: supernotebooklm@gmail.com.

Information the product handles

• Research: captured questions and answers, selected page/source content, notebook and source identifiers, titles, URLs, citations, and organization metadata. Supported content scripts can capture research on supported pages while the extension is enabled; user-triggered imports and optional automations are separate features.
• Sensitive research content: captured conversations and sources can include health information, including clinical questions from supported medical-research pages such as OpenEvidence. The extension does not filter out health information before saving a capture. That content follows the same local storage, optional sync, provider-transfer, export, retention, and deletion rules described here. Only use content you are authorized to handle, and review it before sending it to another service.
• Local settings: saved prompts, folders/tags, usage state, optional audio/transcripts, and configured provider credentials. Research is stored in your browser's extension storage and IndexedDB. Browser-profile access can expose local data; local storage is not a promise of end-to-end encryption.
• Accounts: name, email, authentication identifiers, session information, and plan/access status when you sign in. Your SuperNotebookLM account and your Google NotebookLM account are separate.
• Billing: payment/customer identifiers, subscription/license status, and transaction events needed to provide purchased access. Dodo Payments handles checkout and payment details; do not send card details to our support email.
• Website operations: hosting/security request information and website performance/usage analytics processed by Cloudflare. This is separate from the research captured by the extension.

Local research, cloud sync, and public sharing

Local captures do not automatically mean your research is available on the website. Eligible signed-in cloud features send research and organization metadata to our Convex backend. When cloud sync is active, it can run at startup and periodically as well as through Sync now. Review extension settings and the account before enabling sync or automations.

Private cloud sync does not publish a notebook. Public directory inclusion is controlled by founder/admin approval; new community self-publication is disabled for this release. Approved public publication makes the selected notebook available to others. Third-party exports, downloads, and copies have separate storage and deletion controls. A connection badge verifies neither a completed upload nor publication.

Sync conflicts can retain recoverable local copies and versioned cloud evidence. Selecting Keep both creates a separate capture; selecting a replacement does not erase unrelated local history. Review the account and both versions before resolving a conflict.

When hosted audio is enabled for an eligible account, imported audio and upload metadata are stored using private Cloudflare R2 storage or existing Convex storage. Upload recovery retains an account-bound upload identifier and completion receipt. A local Saved badge alone does not confirm a hosted upload. Private RSS URLs contain access tokens: anyone given the URL may access its episodes while that feed remains enabled. Keep these URLs confidential; revoking a feed cannot erase files already downloaded by a podcast app.

Optional providers and transfers

We use the information above to provide research capture, organization, authentication, sync, exports, generation, hosting, support, and security. Transfers depend on the features you use:

• Convex and Cloudflare: cloud application/storage, private hosted audio (including Cloudflare R2 when enabled), website delivery, authentication infrastructure, and operational services.
• Google: Google sign-in when selected, NotebookLM requests for requested imports/artifacts, and configured server-side Gemini generation or speech features.
• AI integrations: optional OpenRouter, window.ai, or another configured provider receives relevant prompts/research for the AI feature. Provider terms and retention rules apply; an integration is not necessarily offline or local.
• Notion and other export destinations: selected content is sent when you request the integration/export.
• Hugging Face: local transcription can download model files from its infrastructure. Supported local inference processes audio in the extension; separately selected hosted audio/AI features involve cloud processing.
• Dodo Payments: checkout, billing, and related customer information when you request a purchase or billing service.

Do not capture or send information you lack permission to use. Review a provider's privacy terms before sending confidential research. Data processed by cloud providers may be handled outside your country.

Limited use of research and browsing data

We use research and browsing data only to provide or improve the disclosed research features. We do not sell this data, use it for advertising, or transfer it for advertising or unrelated monetization. Transfers are limited to providing these features, security purposes, and applicable legal requirements.

Human access to identifiable research is limited to support with your consent, security investigations, or legal requirements. These restrictions apply to our use of extension data, including data handled locally. Optional provider transfers remain subject to the feature choices and disclosures above.

Retention, deletion, and your controls

You can manage local captures/settings in the extension and keep exports before deleting data. Uninstalling removes the extension's local storage; it does not delete cloud records, public publications, or third-party exports. Clearing browser data can also remove local research.

Cloud research and account records are retained to provide the service until removed through available controls or a verified deletion request, subject to security, backup, billing, and legal retention needs. Source removal may retain versioned evidence; removing a merged collection does not delete its original sources. We do not promise immediate backup erasure or a fixed provider-retention period.

To request access, correction, cloud/account deletion, or details about retention, email supernotebooklm@gmail.com from your account email. We may verify account ownership. There is not currently a complete self-service account-deletion workflow. Explain whether you also need a public notebook removed; third-party copies may require contacting their destination.

Security and policy changes

Cloud requests use secure connections. Keep your device, browser profile, provider keys, and private RSS URLs protected. No service can guarantee absolute security. Contact us promptly about suspected unauthorized access without emailing passwords, tokens, or payment credentials.

We may update this policy as the product changes; the effective date above identifies this version. Material new data uses require updated disclosures and any required consent before they are introduced.