Privacy, written to be read

The short version

Your library lives in plain files on your own devices. There is no Tenoa account. The library remains on the devices you authorize, content is encrypted while moving between devices, and Tenoa-operated infrastructure does not store or process readable library content.

Tenoa is a local-first visual library. You save pages, images, videos, and notes into a library of plain files on your own computer. The app reads and organizes those files locally.

Data we do not collect

• No account. You never sign up, and we never hold your email to use the app.
• No copy of your library. Your saved items are never imported to, stored on, or processed by a Tenoa server in readable form.
• No usage analytics or crash reporting in the apps or extensions.
• No selling of data. We do not send your library to third parties unless you explicitly connect your own AI provider account as described below.

Your library

Everything you save is written as plain files into a folder on your device. You can open that folder, read the files, back them up, and delete them without Tenoa. Uninstalling Tenoa leaves your files where they are.

AI enrichment (summaries, tags, and image descriptions) runs on your own computer by default. If you explicitly connect your own AI provider account with your API key, only new items captured after that consent are sent directly from your computer to that provider, under its privacy terms. You can turn cloud enrichment off at any time. Tenoa-operated infrastructure does not receive or proxy those requests. Enrichment only touches items saved into Tenoa; it does not process notes you wrote yourself.

Sync between your devices

If you pair devices, Tenoa syncs your library between them using end-to-end encryption. To help your devices find and reach each other, the sync engine uses Tenoa-operated discovery and relay servers (for example discovery-us.tenoa.app, discovery-eu.tenoa.app, and the relay pool at pool.tenoa.app).

Here is exactly what those servers can and cannot see:

• They see connection metadata: device identifiers, IP addresses, and timing, which they need to route traffic between your devices.
• When traffic passes through a relay, the relay carries ciphertext. Content is encrypted end to end between your devices. Tenoa cannot read it.
• Nothing from your library is stored on these servers.

Devices on the same network sync directly over the local network when they can.

The browser extensions (Tenoa Capture)

Tenoa Capture saves the current page, a selection, an image, or a video into your Tenoa library. It does this by talking to the Tenoa app running on your own computer, at a local address (http://127.0.0.1 or http://localhost). That is the only place the extension sends what you capture.

• The extension acts only when you act: clicking the toolbar button, a right-click menu item, or the hover-save button on an image.
• When you save, the page URL, title, and the content you chose are sent to the Tenoa app on the same machine. They do not leave your computer through the extension.
• The extension stores its own settings (the local bridge address, an access key for the local app, hover-button preferences, your excluded-sites list) in your browser's extension storage, on your device.
• The extension does not track your browsing, does not read pages in the background, and does not send anything to Tenoa's servers or anyone else's.

Firefox requires extensions to declare data handling. Tenoa Capture declares that it handles browsing activity and website content because you deliberately send a page's URL and content to your own local app when you save. That transfer stays on your machine.

Purchases

The desktop app is paid, with a 14-day free trial; the iPhone and iPad apps are free. If you buy Tenoa, checkout runs through Lemon Squeezy, our merchant of record, which handles your payment details under its own privacy policy. We receive what we need to issue and support your license, such as your email address and purchase record. We use it for that and nothing else.

License activation. When you activate your license key in the desktop app, and occasionally afterward to confirm it is still valid, the app sends the key and an identifier for that computer to Lemon Squeezy's licensing service; like any web request, that call also exposes your IP address to them. Nothing from your library is ever included. The trial itself involves no network call at all — trial state lives only on your computer.

Websites we operate

tenoa.app is a static site with no analytics. It hosts one launch signup form: if you submit your email, it is stored with our form host (Netlify) and our mailing list (MailerLite), and used only to write to you about Tenoa. Every email includes an unsubscribe link, and you can ask us to delete your address at any time at hello@tenoa.app.

Children

Tenoa is not directed at children under 13 and we do not knowingly collect personal information from them. We collect almost nothing from anyone.

Changes

If this policy changes, we will update this page and the effective date. We will not weaken the core promise: your library stays on your devices, and Tenoa infrastructure does not store or process readable library content.

Contact

Questions about this policy or your data: hello@tenoa.app