Outline.co / Privacy

Privacy, in plain words

Outline.co keeps what it needs to show you your own work, and nothing else. Last updated 2026-11-07.

What is kept

• Your account: your email address, the name you give, when you joined and last signed in, and which emails you want.
• Your work: the notes, boards, cards, comments, reactions, labels and hidden fields you write.
• Your sessions: for each device you sign in on, the browser it reported and when it was last used — so the account page can show them and you can sign one out.
• Files you attach, in the file storage this instance is set up with.

What is never done

• No advertising, and nothing about you is sold or shared for marketing.
• No third-party analytics or tracking scripts, and no cookies. Your sign-in is kept in your browser’s own storage.
• Nothing is sent to an AI vendor. The assistant runs on open-weights models through Cloudflare, only when you ask, and nothing is used as training data.

Counting visits

Outline.co counts its own visits, so it knows which pages are read and where visitors come from. It does it itself, without cookies and without any analytics company:

• Each page sends its address, the site that linked to it and any campaign tag in the link — nothing you write, and nothing about your notes or boards. An address that names one of your notes or boards is counted without its id.
• Your IP address is kept with each visit, for 90 days, and seen only by the site’s administrators — to spot abuse and to tell real visits from automated ones. It is deleted with the visit. Visits are told apart by a code made from that day’s random key, your address and your browser — the key is deleted the next day, so the code cannot match one day’s visits to the next.
• What is kept is the device type (phone, tablet or computer), the system and browser’s names (never versions), the language, the screen’s size class, whether someone is signed in (never who), and the country, region, city, timezone and a location rounded to about 10 km, as the network reports them.
• Search terms are kept only where a link still carries them. Crawlers — search engines and AI companies’ — are counted by their published names when they read the site; no person is.
• If your browser says Do Not Track or Global Privacy Control, nothing is sent at all. Bots are not counted.
• The visits themselves — IP addresses with them — are deleted after 90 days; only daily totals are kept.
• Once you are signed in, a few things are counted where they happen — an account made, a sign-in, a note written, a board made, a card added, a share sent, the assistant asked — as a number for the day and nothing else: not who, not what, and nothing you wrote.

Who else handles it

• Cloudflare runs the site, the service and the assistant’s models.
• Turso hosts the database (in the United States).
• Email — sign-in links, reminders, invitations — is sent through Cloudflare, or an email provider where Cloudflare cannot deliver.
• Google Fonts serves the typefaces the pages are set in.

Who can see your work

Only you, unless you share it. A board is seen by the people you invite to it. A note is private unless you choose to show it to everyone signed in, or to anyone with its link.

Your data, your call

To have your account and everything in it deleted, or to ask what is kept about you, write to [email protected].