Privacy policy

Last updated: 5 November 2026

NORA consists of this website, of NORA Web at nora.trufflecraft.com/app and of the NORA note recording device. We use no analytics or advertising tools and share no data with advertising networks. Fonts, 3D model and code on this website come from our own server, so loading it sends no data to third parties such as Google. Below is what data is still processed, why, and for how long.

1. Controller

2. Hosting with Cloudflare

The website and NORA Web run with Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary connection data, including IP address, time of the request, the address requested and browser type. This serves to deliver the service and keep it secure and stable. For troubleshooting we keep technical logs for a short time, without the content of your notes. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure, functioning service). Cloudflare also stores the content of your NORA account for us. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework and additionally relies on the EU Standard Contractual Clauses.

3. Waitlist

When you join the waitlist, we store your email address and when you signed up. You then get an email with a confirmation link; only after you click it are you on the list, and we also store when you confirmed. Without confirmation we delete the address after seven days.

We use the address only to let you know once the NORA note can be ordered. We send these emails through Cloudflare Email Sending (see section 2). The legal basis is your consent under Art. 6 (1) (a) GDPR. You can withdraw it at any time, via the link in every email or by writing to nora@trufflecraft.de. We then delete the address straight away.

4. Account in NORA Web

An account needs your email address. To sign in, we email you a link, again through Cloudflare Email Sending. If you set up a passkey, we store only its public part; the private key stays on your device. After you sign in we set a cookie that keeps you signed in for 30 days. It is technically necessary for the service (§ 25 (2) no. 2 TDDDG). Whether you chose the light or dark look is remembered only by your browser.

The legal basis is Art. 6 (1) (b) GDPR (providing the service you use).

5. Notes and recordings

NORA stores what you record or upload: audio recordings, transcripts, summaries, titles, tags and speaker names, plus the time and length of each recording and details about your device such as battery level and software version. This data stays stored until you delete it. For audio you can set in the settings that it is deleted automatically after a number of days; transcript and summary remain.

Under Einstellungen › Konto › „Alle Daten exportieren“ you get all notes, recordings and account settings as one ZIP file. NORA packs it in the background, keeps it in our Cloudflare storage and sends you an email once it is ready. You can download it only while signed in. After seven days we delete the file.

Under Einstellungen › Konto › „Konto löschen“ you delete your whole account. You confirm it with a link we send to your address. After that the account is paused for 48 hours, and you can take the deletion back during that time. Then we delete every note, recording, device, connection, key, passkey and the history. Only a record remains that an account was deleted on a given day, without name, address or identifier. Our database can be restored up to 30 days back; deleted entries can stay in that backup until they drop out of it on their own. We restore from it only after a fault, never a deleted account. What you already handed to a memory or a webhook stays there and is not touched by this deletion.

When you delete a note, a record without content remains for 90 days so that connected programs learn it was deleted. Every access to your notes by devices, programs or assistants is listed in your history for 90 days, also without content.

Recordings can hold very personal content, for example from a doctor's appointment. We process such health data only because, and to the extent that, you record it yourself and ask NORA to process it (Art. 9 (2) (a) GDPR).

6. Services you connect yourself

For transcripts and summaries, NORA uses services you connect in NORA Web with your own access. Depending on your choice, these are:

• For both, as the standard path: OpenRouter, Inc. (USA). You connect your own OpenRouter account with „Mit OpenRouter verbinden“ (Connect with OpenRouter) or enter a key of your own. OpenRouter passes each request to the provider of the model you chose.
• Speech recognition directly: Deepgram, Inc. or AssemblyAI, Inc. (both USA)
• Your own gateway, such as your company's: for summaries, and on the way to Deepgram or AssemblyAI also for speech recognition

For transcripts through OpenRouter, NORA asks in every request for endpoints with zero data retention. OpenRouter then sends the recording only to providers that have committed not to store it. Depending on the model you chose, these are Eleven Labs Inc. (USA), Deepgram, Inc. (USA) or Mistral AI (France).

For summaries through OpenRouter, NORA sends the transcript text to the model you chose. These requests do not ask for zero-data-retention endpoints. The terms of the provider that runs the model for OpenRouter apply (for Claude, for example, Anthropic or a cloud provider that hosts Claude), along with the settings in your OpenRouter account.

NORA sends recordings and text to these services only when you ask for a transcript or summary, or have set that to happen automatically. The privacy terms of the services you have your own contract with apply; on the standard path that is OpenRouter. We store your access details encrypted and use them only for your notes.

You also decide whether calendars, a digital memory such as gbrain, AI assistants such as Claude or ChatGPT, or your own programs get access to your notes. You set up each of these connections yourself, approve its rights and can disconnect it at any time. The legal basis is Art. 6 (1) (b) GDPR, and for health data your consent under Art. 9 (2) (a) GDPR.

7. Recording other people

When you record a conversation with others, you also process their data. So only record conversations when everyone involved has agreed. In Germany the law requires it too (§ 201 StGB).

8. Contact by email

When you write to us, we process your email address, your name and your message in order to reply. The legal basis is Art. 6 (1) (b) GDPR where it concerns a contract, otherwise Art. 6 (1) (f) GDPR. We delete the message once it is no longer needed for this and no retention duty applies.

9. Feedback from NORA Web

In NORA Web you can report a problem or suggest something under Settings › Help › “Send feedback”. The form comes from our feedback service FeedbackKit, and NORA Web loads it only when you choose “Send feedback”. Loading it means Cloudflare processes the usual connection data (see section 2). When you send the form, you send us:

• your text and your answers in the form,
• pictures you attach yourself, and a screenshot of the current page if you take one with the button in the form,
• the page address up to any ? or #, which in NORA Web is just the app's address, such as “nora.trufflecraft.com/app/”,
• browser, operating system, window size and language of your device,
• a random ID for your account (not your email address or name) and the version of NORA Web.

A screenshot is only taken when you press the button. It shows the page as you see it at that moment, including any note content on it; before you send it, you see it as a thumbnail and can mark it up or remove it. By taking it, you explicitly consent that the screenshot may contain health information, which is processed with your report (Art. 9 (2) (a) GDPR). After sending, you can ask us to delete it. Apart from that, the form does not send notes, recordings or transcripts. Please don't copy content from your notes into it either. To stop anyone from flooding the service, FeedbackKit limits requests per hour. For that it uses your IP address only as a salted hash that cannot be reversed, and deletes the hash after 24 hours at the latest.

To turn your report into a complete issue, FeedbackKit sends the report text, the first picture (usually the screenshot), the page and the device details to an AI model. The model sorts the report as a bug or a request, fills in the fields of the issue and asks one follow-up question if something is missing. It does not get your account ID or the version. The request goes through our own AI proxy (LiteLLM) on our server to Gemini by Google LLC (USA). If Gemini is down, a model by OpenAI Ireland Limited (Dublin) answers instead. Data may reach the USA in the process: Google LLC is certified under the EU-US Data Privacy Framework, and according to its privacy policy OpenAI bases transfers to the USA on the EU Standard Contractual Clauses.

We use your report only to fix problems and improve NORA. The legal basis for the report is Art. 6 (1) (f) GDPR (legitimate interest in a functioning service), and for health information in a screenshot your consent. Using the form is voluntary.

FeedbackKit runs as a Cloudflare Worker in our own Cloudflare account (see section 2). It turns your report into an entry (issue) in our private repository at GitHub, Inc. (88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). Pictures you attach stay in our Cloudflare storage; the issue links them through a random address that appears only there. For transfers to the USA, GitHub is certified under the EU-US Data Privacy Framework.

FeedbackKit deletes its copy of the report, the screenshot and attached pictures after 90 days. The issue at GitHub stays as a record of product development; we delete it on request.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Write to us at nora@trufflecraft.de. In NORA Web you can export or delete individual notes yourself, and under Einstellungen › Konto export all your data and delete your account (section 5). Feedback reports (section 9) carry only a random identifier that leads to no one once the account is deleted; on request we delete them too.

You can also lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

The German version (Datenschutzerklärung) is the legally binding one.