Privacy policy

Last updated: 24 October 2026

Knipp is where you save everything you want to keep: notes, links, images, video and audio. Your content is yours. Your notes, links, images, recordings and files are encrypted on your devices before they are stored. This policy explains in concrete terms what information Knipp processes, why, who processes it on our behalf, where it is kept, and what rights you have.

Who is the controller

The controller for the personal data processed in Knipp is Studio Fosse Lien (organisation number 935 151 171), Herslebs gate 19, 0561 Oslo, represented by Jonathan Fosse Lien. If you have questions about privacy or want to exercise your rights, write to studio@fosselien.no.

What information we process

Account information

Your email address and your password, which is only stored as a hash. If you sign in with Apple or Google, we get your email address and name from them instead of a password. Your name and profile picture, if you add them.

The content you save

Everything you put into Knipp: notes, links, images, video, audio recordings, files, lists, collections, reminders, comments and tags, and the location if you pin a place to a trip. This is ‘your content’, and you own it. Notes, links, images, recordings and files are encrypted. What is not encrypted is described under Encryption of your content.

What AI creates

Summaries, hidden keywords, titles, captions, the text in images and transcripts of recordings. It is encrypted on your device and stored together with the knipp it belongs to.

Information about others

The email addresses of the people you share with, and the names and replies of guests who respond to an event or reserve something from a wishlist you have shared.

Usage and technical data

How much AI you have used, to prevent misuse, and technical logs. What the logs contain and how long they are kept is described under ‘How long we keep information’.

Notifications

If you turn on notifications, we store the address that push notifications are sent to on your device, and, for a browser, which browser it is.

Face ID and fingerprint

If you lock the app or a note, the phone itself checks your face or fingerprint. The biometric data never leaves the device, and Knipp never receives it.

Keys and devices

The public keys for your account and your devices, the other keys only in encrypted form, and the name of each device you have approved. See Encryption of your content.

Why we process the information (legal basis)

• To provide the service: storing and syncing your content, letting you sign in, share, send reminders and run the AI that is part of Knipp. Legal basis: the contract with you (Article 6(1)(b) of the General Data Protection Regulation).
• For security and operations: preventing misuse, finding faults, protecting against data loss and keeping the service secure. Legal basis: legitimate interest (Article 6(1)(f)).

Encryption of your content

Your notes, links, images, recordings and files are encrypted on your device before they are sent to Knipp, and they can only be opened on your devices and by the people you share with. This also applies to titles, comments, keywords and what the AI has created. At Supabase they are only stored encrypted, so neither we, Supabase nor anyone who breaks in there can read them. New files get a name that only says what kind of file it is.

Anything you saved before encryption was introduced is encrypted on your device the first time you open Knipp after the update. Until then, it is stored as before. Files from that time keep the names they had. The backups may contain the unencrypted version for up to 7 days afterwards.

The keys

• Your account has its own key. It is kept on your devices: in the phone’s secure key storage on iPhone and Android, and in the browser for Knipp on the web. On our side it is only stored locked, with the recovery code and with the key of each device you have approved.
• The recovery code is given to you when encryption is turned on, and you must confirm that you have kept it safe. We do not store it. Under Settings > Encryption you can create a new one, and the old one then stops working.
• A passkey can also lock the key. It unlocks Knipp with Face ID, your fingerprint or the device passcode, and follows you to your other devices if it is stored in iCloud Keychain or Google Password Manager. The passkey gives the device a secret that is never sent to us. We only store the account key locked with it, and which passkey it belongs to.
• A new device is unlocked with a passkey, from a device that is already unlocked (when both show the same six characters), or with the recovery code. Under Settings > Encryption you can see your devices and remove them. Removing a device does not take the key away from it: it can still read the content as long as it can get into your account.
• The browser extension gets the key from Knipp on the web in the same browser, see The browser extension. The Obsidian plugin is approved as a new device. The notes it puts in Obsidian are ordinary files on your computer, without encryption.

If you lose all your devices, the passkey and the code

Then your content is gone. No one can recover it, not even Studio Fosse Lien, because we do not have the key. That is why Knipp asks you to keep the recovery code safe, and to confirm it if you do not have a passkey that follows you to your other devices. You can start again with the same account, but everything that was stored will then be deleted.

What is not encrypted

So that Knipp can sync, sort, share and remind you of things, the following is not encrypted:

• that a knipp exists, what type it is, and the times: when it was created and changed, and when a reminder is due
• which collection and which space it is in, and whether it is pinned, locked or archived
• the file type and size of files
• who it is shared with, and whether it has a shared link
• the names of your spaces
• the features behind the ‘Plans’ switch: the items in shopping lists, wishes and reservations, and replies and contributions to events
• your account information

When content passes through Knipp’s server functions

• AI: when the AI is working, your device sends what it needs, in plain text, to Knipp’s server functions. They pass it on to Anthropic or OpenAI and send the response back to your device. The functions do not store the content and do not log it, only status, time and error codes. A recording is sent as a temporary copy, encrypted with a key used for that one time only, and the copy is deleted afterwards. What is sent, and how long the AI providers keep it, is described under AI.
• Links: when you save a link, Knipp’s server function receives the address, fetches the public page and sends the title, image and text back to your device. The address is not stored there.

In these moments, what protects the content is not encryption but the fact that the functions do not store or log it. That is a property of the code, and whoever runs the functions could in principle change it. If you turn off Automatic AI, nothing is sent to AI automatically.

The export under Settings is created on your device and is not encrypted, so look after the file.

AI: what is sent, to whom and where

AI is part of Knipp, and it runs automatically on what you save, so you can find it again later. If you do not want that, turn off Automatic AI under Settings. Knipp then sends nothing to AI automatically, but anything you ask for with a button still works. The setting applies to your account, on all your devices.

Your notes, links, images and recordings are encrypted where they are stored. That is why it is your device that sends the AI what it needs, in plain text, at the moment it is working. It passes through Knipp’s server functions, which neither store nor log it, and the response is encrypted on your device before it is stored. See Encryption of your content.

Automatically, while Automatic AI is on

• Summaries, keywords and titles: the title, the text (the first 6,000 characters), the caption and the comment of anything you have saved in the last 30 days, including notes and transcripts of recordings, are sent to Anthropic. You get a short summary and hidden keywords, and links and images without a title get one.
• Images: images you save are sent to Anthropic, which creates a title and a caption and reads the text in the image, so you can search for it.
• Recordings: new audio recordings, and audio files you add or share to Knipp, are sent to OpenAI and transcribed into text.

Locked notes are never sent to AI automatically.

Only when you ask

• ‘Read text in image’ and ‘Create caption’ (Anthropic), and ‘Transcribe recording’ and dictation in a note (OpenAI).
• The features behind the ‘Plans’ switch, which is off until you turn it on: the plan builder makes a plan from the knipps you choose (Anthropic). The travel letter writes a summary of a trip (Anthropic).

Where it is processed, and how long it is kept there

Knipp’s own server functions at Supabase in the EU pass the content on to Anthropic (Claude) and OpenAI, which process it in the USA. Neither of them uses your content to train their models. This is stated in the terms for the APIs Knipp uses. Anthropic stores it for up to 30 days, but content their systems flag as a breach of the terms of use may be kept for up to two years. OpenAI stores it for up to 30 days to detect misuse. The AI’s response is encrypted on your device and stored in the knipp, like the rest of what you have saved.

Information about links

When you save a link, Knipp’s server fetches the public page to find the title, image and text. For YouTube links, the server asks YouTube (Google). This is not AI, and it also happens when Automatic AI is off. The server receives the address in plain text but does not store it. In your knipp it is stored encrypted.

Sharing

You can share a note or a list with another Knipp user. We then use the email address you enter to find their account, and that person gets access to what you shared. You can also create a link that anyone who has it can read in a browser. Apart from the service providers below, we never share your content with anyone other than the people you choose yourself, and we never sell your personal data.

What you share is still encrypted. If you share with a Knipp user, your device locks the key to the knipp so that only that person’s devices can open it. If the person has not opened Knipp since encryption was introduced, the share arrives once they have done so and one of your devices has been online. A link you share has the key in the link itself, after the #. Browsers never send that part to the server, so neither Netlify, Supabase nor we can see it. Anyone who has the whole link can read what you have shared. The notification and the email about a share say who shared, not what.

Locked notes

A locked note only shows its title in lists, search, notifications and widgets. The content is opened with Face ID or fingerprint in the app on your phone, and it cannot be opened on the web. If you lock a note, public links to it stop working, and anyone who has received an invitation link only sees the title. If you have shared it with a Knipp user, that person can still read it. Locked notes are never sent to AI automatically.

A locked note is encrypted like your other notes. The lock comes on top of that and hides it on your devices until you have used Face ID or fingerprint. It is included when you export.

The browser extension

Knipp for Chrome and Microsoft Edge saves pages, links, selected text, images and notes to your Knipp account. What you save with the extension is processed like all other content in Knipp.

• What it reads, and when: only when you save something yourself (the Knipp button, the right-click menu or the keyboard shortcut). It then reads the address, the title and the readable text of the page, the text you have selected, the image you right-click on, or the titles and addresses of your tabs when you choose ‘Save all tabs’. It never reads pages in the background and keeps no log of which pages you visit.
• Bookmarks: only if you turn on ‘Sync bookmarks to Knipp’. Your bookmarks then become links in Knipp. The extension never changes or deletes bookmarks.
• Signing in: you sign in at knipp.fosselien.no. A small script on Knipp’s own websites (knipp.fosselien.no and knipp.netlify.app) sees which account is signed in there and gives the extension its own sign-in to the same account. It only reads Knipp’s own sign-in and the language you have chosen, and only on those websites. When Knipp on the web is unlocked in the browser, the same script gives the extension the key to your account. The extension checks that the key belongs to the account it saves to before storing it. Without the key it saves nothing to Knipp: what you save waits in the browser until Knipp on the web is unlocked.
• What it stores in the browser: the sign-in (a session, not your password), the key to your account, anything waiting for a connection or a sign-in, and your choices (space and bookmark sync). ‘Sign out’ removes the sign-in and the key, and if you remove the extension, everything it has stored in the browser is deleted.
• Where it goes: to your Knipp account at Supabase in the EU, and to AI as described above. The content and images are encrypted in the browser before they are sent to Knipp. The extension has no AI key of its own, no ads, no tracking and no analytics tools.
• Permissions: activeTab and scripting (reading the page you save, when you save it), storage (the sign-in and what is waiting), contextMenus (the right-click menu), alarms (trying again while something is waiting for a connection) and access to Knipp’s own websites (the sign-in). Tabs and bookmarks are optional, and you are asked the first time you use ‘Save all tabs’ or bookmark sync.

We do not sell user data, and we do not use it for anything other than storing and showing what you have saved in Knipp. The data is not used to determine creditworthiness or for lending purposes, and we comply with the Limited Use requirements of the Chrome Web Store.

Who processes data on our behalf

These service providers (processors) process information so that Knipp can work:

Reminders that your phone has set up itself are created on the phone and do not go through any server. Reminders from Knipp’s server only say ‘You have a reminder in Knipp’. They go through Expo and Apple or Google to your phone, and encrypted through the browser’s own push service to the browser. A notification about something shared with you says who shared it, not what.

Some services load content directly from the source, under their own terms. If you open a knipp with a video or a post from YouTube, Vimeo, Spotify or X, their player is loaded, and they see your IP address and what you open. The same applies to preview images loaded from the page a link points to. If you pin a place to a trip, the phone asks Apple (iPhone) or Google (Android) for the name of the place.

Where data is processed outside the EEA, the transfer takes place on a valid basis, such as the European Commission’s standard contractual clauses (SCCs).

How long we keep information

• Your content is kept until you delete it or delete your account. If you delete your account, everything you have saved is deleted immediately.
• Backups: deleted data may remain in backups for up to 7 days before it disappears.
• Technical logs: Supabase logs every request to Knipp with the IP address, time, browser or app, which function was used, and the response code. The address that was requested may contain file names and search terms, and the sign-in log contains the email address. The content of your notes and files is not logged. The logs are deleted automatically after up to 7 days.
• With the AI providers: up to 30 days, as described above. Content that Anthropic’s systems flag as a breach of the terms of use may be kept for up to two years.

Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• access the information we hold about you,
• have incorrect information rectified,
• have your information erased (‘the right to be forgotten’),
• receive your content in a common format (data portability), and
• restrict or object to the processing.

Under Settings in the app you can export everything you have saved (‘Export everything’: all your knipps as Markdown, with images and attachments), turn off Automatic AI and delete your account (‘Delete account’). If you want to exercise your other rights, write to studio@fosselien.no. If you believe we are processing your information incorrectly, you also have the right to lodge a complaint with the supervisory authority in the country where you live or work, such as the Norwegian Data Protection Authority, the Swedish Authority for Privacy Protection (IMY) or the Danish Data Protection Agency.

How we protect your information

• Encrypted on the device: notes, links, images, recordings and files are encrypted on your devices before they are stored, and only your devices and the people you share with have the key. What this means, and what is not encrypted.
• Encrypted in transit: all traffic goes over HTTPS (TLS), and the website requires it (HSTS).
• Encrypted on disk: the database and files are stored on encrypted disks at Supabase.
• Access control in the database: rules on every row ensure that a user can only reach their own content and what others have shared with them. Files are kept in a private area with the same rules.
• Passwords are only stored as hashes.
• Limits on the use of AI and sharing, so that the service cannot be misused.
• Lock the app or individual notes with Face ID or fingerprint.

Children

Knipp is not aimed at children, and we do not knowingly collect information from children under 15.

Changes to this policy

We may update this policy when the service changes. If there are significant changes, we will notify you in the app or by email. The date at the top shows when it was last changed.