Notipala
Back to workspace ↗
Authentication and account boundaries
Notipala uses Firebase Authentication for hosted account sign-in. API requests verify account credentials and check session ownership before accessing private session resources. Connector state is scoped to the account. These are implemented controls, not a guarantee that software can never contain a vulnerability.
OAuth and connector access
Gmail uses a read-only OAuth permission. You grant access on Google’s authorization screen; Notipala does not ask for your Gmail password. Notion access is limited to content shared with the connection. OAuth state is time-limited and tied to the authorization flow. You choose which results to import after connecting.
Credential protection
Connector tokens are encrypted on the server with a separately configured encryption key. OAuth client secrets are server configuration, not browser code. This statement applies to connector credentials; it is not a claim that every document, log or backup uses application-level encryption.
Content processing and provenance
Bodies, extracted attachment text and page references are preserved as source material for memory generation. Source references accompany extracted evidence so users can review it. Quoted replies and common boilerplate are removed from extraction views, while original source content is retained. AI and OCR results still require review.
Disconnecting and deleting
Disconnect removes the saved connector credentials. Revoke the provider grant separately in Google or Notion. Delete the conversation to remove its stored session content and graph artifacts. Account-level requests can be sent using the contact below. See the Privacy Policy for data handling and retention limitations.
Review and assurance
This page describes the application’s controls; it is not a security certification. We do not claim a completed Google restricted-scope review, CASA assessment or SOC 2 certification. Approval of Google sign-in, domain ownership or application branding is not equivalent to a security assessment.
Report a security issue
Contact [email protected] with a description of the issue, affected feature and safe reproduction steps. Please avoid including passwords, access tokens, full mailboxes or unnecessary personal data. Do not access another user’s information or disrupt the service while investigating.
Let’s talk.
Privacy, account or security questions? [email protected]