Skip to content
Rightnote
Add to Chrome

Security

Last updated October 12, 2026

Rightnote works with your email, so we treat access to it as the most sensitive thing we hold. This page explains how we protect it. Our Privacy Policy describes exactly what we access and store.

Your Google account

  • Google sign-in only. Rightnote has no passwords to steal or reuse. Sign-in uses Google’s OAuth authorization code flow with PKCE and a single-use state value.
  • Only the scopes we need: openid, email, profile, gmail.send, gmail.readonly and gmail.compose. Each one maps to a feature, listed in the Privacy Policy. Rightnote cannot delete your email or change your Google account settings.
  • Encrypted tokens. The OAuth refresh and access tokens Google issues are encrypted with AES-GCM before they are written to the database, using a key held as a separate secret, not in the database.
  • Server-side sending. Sequence emails are sent by our servers through the Gmail API. The Chrome extension never holds your Google tokens and never sends mail itself.
  • Easy to revoke. Disconnecting an inbox or deleting your account revokes Rightnote’s access with Google. You can also remove it yourself at myaccount.google.com/permissions.
  • Independent review. Because Rightnote uses restricted Gmail scopes, its Google integration is subject to Google’s OAuth app verification and an annual third-party security assessment.

Your data

  • Encryption. All traffic to rightnote.ai, app.rightnote.ai and t.rightnote.ai uses HTTPS. Data is stored in Cloudflare D1 and encrypted at rest by Cloudflare.
  • Minimal email storage. We don’t keep a copy of your mailbox: we read message headers, and the body only of replies in threads Rightnote tracks, keeping a short snippet and a one-line summary.
  • Workspace isolation. Every request is checked against your workspace membership and role before any data is read or changed.
  • AI on our own infrastructure. Reply classification and suggestions run on Cloudflare Workers AI. Your data is not sent to other AI providers or used to train models.
  • Payments. Card details go directly to Stripe and never touch our servers.

Sessions and the extension

  • Hashed session tokens. Web and extension sessions are random tokens; we store only their SHA-256 hashes, so a database copy can’t be used to sign in.
  • Web app. The session cookie is HttpOnly and SameSite=Lax, and every change made with it must come from the app’s own origin.
  • Extension. The extension receives its own session from the web app through an origin-checked handoff on app.rightnote.ai, and calls our API only from its background service worker. It runs only on Gmail and the Rightnote app. Extension sessions expire after 180 days without use, and signing out of the web app signs the extension out too.
  • Separate tracking host. Open pixels, click redirects and unsubscribe pages are served from t.rightnote.ai, which sets no cookies and has no access to your session.
  • Rate limits protect sign-in and other sensitive endpoints from abuse.

How we work

  • Rightnote runs on Cloudflare’s platform, which handles physical security, network protection and patching of the underlying infrastructure.
  • Access to production systems is limited to the people who need it. We access customer data only as described in the Privacy Policy, for example to investigate a problem you report.
  • If a breach affects your personal information, we will notify you without undue delay and as the law requires.

Reporting a security issue

If you believe you have found a vulnerability in Rightnote, please email security@rightnote.ai. Include a description of the issue, steps to reproduce it, and its potential impact. We will acknowledge your report, keep you updated while we investigate, and let you know when it is fixed.

While researching, please:

  • only test against accounts and data you own, and stop as soon as you reach anyone else’s data;
  • avoid privacy violations, degrading the service, sending email to people who haven’t agreed to it, and social engineering;
  • give us reasonable time to fix the issue before disclosing it publicly.

We will not pursue legal action against researchers who act in good faith and follow these guidelines. For privacy questions that aren’t security issues, email privacy@rightnote.ai.