Security
CleverNote never moves your money.
When you connect a bank, CleverNote gets read-only access. Below is what happens to your bank login, where your data lives, what goes to AI, and how to delete everything. We also tell you what we don’t have yet.
Bank connection · US and Canada
You sign in through Plaid. CleverNote only reads.
Read-only
CleverNote asks Plaid only for transactions and investment data. It does not request transfer or payment access, so it has no way to move money.
Your login never passes through us
You enter your username and password in Plaid or on your bank’s own site. Those credentials stay with Plaid and never reach CleverNote.
Instead of your password, an encrypted token
To fetch new transactions, CleverNote keeps an access token issued by Plaid, encrypted on our server. It is not your password.
Disconnect anytime
When you disconnect, CleverNote asks Plaid to end its access and removes the transactions that came from that bank. The same request goes out when you delete your data or your account.
Bank connection is an optional Pro feature for supported banks in the US and Canada. CleverNote Finance works fully without it.
Your data
Encrypted in transit. Stored on a server in the US.
CleverNote runs on a Hostinger server in the United States.
Encrypted connection
All traffic uses TLS, and browsers are instructed never to open CleverNote without it.
Sign-in without a password
You sign in with a single-use link or code sent by email. On the web, your session lives in a signed cookie that page scripts cannot read.
Your card stays with Stripe
On the website, payment goes through Stripe (PCI-DSS Level 1), and card details never touch our server. On iPhone, the purchase goes through the App Store.
Encrypted daily backup
Every day, a copy of the database is encrypted before it leaves the server and is stored with Backblaze. The key that opens it is kept outside production.
AI
What goes to AI, and what stays out.
What is sent
What you save (text, photos, audio, and transactions, including those from your bank) goes to AI providers so it can become answers: OpenAI and, through OpenRouter, Anthropic. Two features add two more, also through OpenRouter: Google analyzes the video in links you save, and Typesafe helps pick what to bring back. They process it and send the result back.
What stays out
Your email and account identity do not go with it. And CleverNote does not train models on your content.
You’re told first
The first time you save, ask, or connect a bank, the app shows who receives your content and asks you to confirm. After that, the notice stays in the app under “How CleverNote uses AI”, so you can read it again.
What we don’t have yet
We’d rather you know before you decide.
- Record-by-record encryption in the database. Today, content is readable in the database while the server runs, and the people who administer the infrastructure can access it. The bank access token is already encrypted. Encrypting the rest is planned, with no date yet.
- Contracted zero retention with AI providers. It is not active yet, so we don’t promise it. Today, each provider handles what it receives under its own API data policy.
Your control
Export or delete everything, without asking anyone.
Export
Request an export in the app and get an email link to download everything as a JSON file. The link works once, for 72 hours.
Delete
A deleted note disappears right away from your list, search, and chat, and is permanently removed 30 days later.
Delete your account
Deleting your account erases everything from the database right away, irreversibly. Encrypted backup copies go away in the normal backup disposal cycle.
Who runs CleverNote
SPAKLABS AI INC., in Edmonton, Alberta, Canada.
Questions about security, or something that looks wrong: write to hello@clevernote.net. The full list of providers is in the privacy policy.