Obsidian

The Terms make clear that user-provided content in Obsidian Publish is owned by the customer, who represents and warrants they own all rights to it. The Privacy Policy states Dynalist does not receive or store content saved to the local device. Overall the user retains ownership of the data and notes they create.

The Terms state that work product resulting from use of Obsidian belongs to the user. Because Obsidian is a note-taking tool rather than a generative AI service, output is essentially user-authored content that the user retains. There is no vendor claim over user work product.

Neither document describes any AI/ML model training, and the Privacy Policy states no personal data or telemetry is collected from the apps and that only aggregated (not individual) data is used for statistical analysis. There is no indication user notes are used to train any model. The policies are silent on AI training because the product surface does not present AI features.

The Privacy Policy provides clear consumer deletion mechanics for Sync/Publish: data remains one month after subscription expiry then is deleted, immediate deletion on self-cancellation, and account deletion via the dashboard. However, the Terms allow the Company to retain archived copies of Customer Data for an 'archive cycle' with no defined duration, and the core policy retention statement is vague ('only as long as it is required'). No formal retention schedules or deletion SLAs tied to security frameworks are provided.

The Privacy Policy states email is not shared except with named payment processors and that Dynalist does not provide personally identifiable information to advertisers. However, the Terms contain a broad clause under which the user 'expressly permits' sharing of Customer Content and Customer Data with Third Party Service providers, and the Privacy Policy discloses transfers to service providers and in business-transaction (M&A) scenarios. Sharing is generally disclosed and tied to service delivery, but the Terms' consent language is broad.

The policies provide some opt-out and control mechanisms: users can disable update checks and cookies, can delete their account, can change consent preferences by contacting Dynalist, and can opt out of logo usage. However, several disclosures rely on 'deemed consent' and the mechanisms are informal (email contact) rather than a self-service privacy console for all data uses. Opt-out exists but is fragmented and partly manual.

The documents claim alignment with Canada's PIPEDA and corresponding provincial privacy acts but name no third-party certifications or attestations (no SOC 2, ISO 27001/27018, GDPR, or CCPA references in the supplied text). For a consumer-general tool the universal baseline frameworks are largely unaddressed, and the policy's Canadian orientation may not satisfy GDPR/CCPA obligations for non-Canadian users. A Cure53 audit report URL was referenced in inaccessible sources but does not appear in the analyzed policy text.

The documents describe no AI/ML model behavior, and therefore provide no explainability or model-auditing commitments. Because the product surface does not present AI features, this category is largely not applicable, but the silence means enterprise auditors get no transparency assurances. There is no reference to audit rights or logging for enterprise customers in the supplied documents.

The documents disclose several security controls: encryption of all data at rest and in transit, end-to-end encryption for Sync including file names, TLS for transmission, physical/electronic/organizational safeguards, and contractual obligations on third parties. However, the Terms heavily disclaim security guarantees, no penetration testing / bug bounty / SOC 2 evidence appears in the analyzed text, no breach-notification SLA is defined, and a referenced security page and Cure53 audit PDF were inaccessible. No breach history is disclosed.

The core local app collects no personal data regardless of tier, but paid Sync/Publish services store user data on Dynalist servers, changing the data-handling profile. An 'Enterprise' offering is linked in navigation but no enterprise-specific terms or DPA were available in the supplied documents, so the material differences for business tiers cannot be assessed. Free commercial use is now permitted, but that does not by itself alter data handling.

For the local app the policy states no one, not even Dynalist, can read notes and content is not received or stored. However, the Terms reserve a discretionary right to investigate and remove User Provided Content in Obsidian Publish, which implies human access to Publish content. Sync content is described as end-to-end encrypted, limiting human review there; access to Publish content is possible.

The documents reference disclosure of personal information where required by law and note that data processed abroad may be subject to disclosure under foreign laws, but provide no transparency report, government-request policy, or litigation history. The privacy policy contemplates compliance with legal and governmental requirements without detailing safeguards or user notification. There are no specific disputes or law-enforcement cooperation details disclosed.

The local apps collect no personal data, but the website/account flows collect a range of PII: email, login credentials, IP address, browser/device information, clickstream URLs, cookies, and detailed session interaction data. The core policy also references categories like age, income, date of birth, and ethnic origin as examples of personal information, though it states collection is limited to what is required. Significant PII is collected on the web side with adequate but not granular disclosure, and no clear SPI collection is described.

The Terms were last updated February 20, 2025 (~17 months before the analysis date) and the Privacy Policy summary was last updated November 1, 2023 (~2.6 years before), with the embedded core policy still dated December 11, 2020. The product surface shows a note-taking app with plugins and no visible AI features, and the policies do address local storage, Sync/Publish, and third-party plugins — so coverage of the shipped product is reasonable. The mixed and partly stale dating and the layered/duplicated 'last updated' dates in the Privacy Policy pull this to YELLOW.

Two documents were supplied (Terms and Privacy Policy), enabling a cross-document check. A notable tension exists on data sharing: the Privacy Policy assures users their email/PII is not shared with third parties except named processors, while the Terms grant broad express permission to share Customer Content and Customer Data with Third Party Service providers. This is a reconcilable-but-real divergence in scope of consent, warranting a MINOR rating.