OrchidNote
中文 Free download

Privacy Policy

Effective: September 26, 2026 · Last updated: October 1, 2026

The short version

  • OrchidNote doesn't collect your files or notes. Reading, annotating and exporting need no account; the only thing sent is an anonymous install count (you can turn it off).
  • Annotations, thoughts, reading logs and OCR results are all stored on your own computer.
  • Only when you use “Ask AI” or LLM translation is the content you selected sent — directly — to the AI provider you configured, never through us.
  • When you sign in or buy Pro, we process only your email and subscription status; payments are handled by Paddle, and we never see your card number.

This Privacy Policy explains how the OrchidNote software and the orchidnote.com website (together, the “Service”) handle your personal information. We process personal information in accordance with the Personal Information Protection Law of the People's Republic of China and other applicable laws, following the principles of lawfulness, legitimacy, necessity and good faith.

1. Data the Software stores on your computer

The following data is stored only on your computer, and we cannot access it:

LocationContents
%APPDATA%\OrchidNote\settings.jsonSettings, recently opened files, favorites
%APPDATA%\OrchidNote\annotations.dbAnnotations
%APPDATA%\OrchidNote\learning.dbThoughts, reading logs and reading time, Ask AI history
%APPDATA%\OrchidNote\ocr_cache.db、translation_cache.dbCached OCR, table recognition and translation results
%APPDATA%\OrchidNote\file_page_states.jsonReading position for each file
%APPDATA%\OrchidNote\Logs\Program logs, kept for 7 days, only for your own troubleshooting or to send to us if you choose
%LOCALAPPDATA%\Deft\undo\Original files moved by File Explorer quick actions, kept for 30 days so they can be restored

The AI API keys you enter are encrypted with the Windows Data Protection API (DPAPI) and stored on your computer; only your Windows user account can decrypt them. You can delete the folders above at any time to remove all of this data.

2. When the Software connects to the internet

Reading, annotation, OCR, layout analysis, table recognition and local translation all work offline. The Software connects to the internet only in the following cases:

  • Ask AI / LLM translation / mind maps / automatic outlines (when using an AI model): the Software sends the text you selected, the image region you captured, the content of files you attached, the chapter text you cited and your question directly to the provider endpoint you configured under “LLM API” (such as DeepSeek, Kimi, Qwen, Zhipu, OpenAI, Google Gemini or a custom endpoint). This data does not pass through our servers. How the provider handles it is governed by that provider's privacy policy, which you should read before configuring it.
  • Downloading models: when you confirm a download of a component such as layout recognition or offline translation in the app, OrchidNote downloads public model files from a model hosting platform (currently ModelScope and others); none of your files are uploaded. The platform may log access information such as your IP address under its own policies.
  • Account sign-in and licensing (once signed in): when you sign in with your email, the Software sends our server (www.orchidnote.com, or the backup address www.deftpdf.cn for the same server if the first can't be reached) your email address, the verification code you received or the password you set, your computer name (so you can tell your computers apart among signed-in devices), and a device identifier (a salted one-way hash of the Windows machine GUID; the server can't recover the original value, and it's used only so each computer can claim the free trial once). A password is optional; the server stores only a salted hash (PBKDF2), never the password itself. The name you choose is stored in your account so it can be shown on all your devices. The first time you sign in, and when you sign in after the terms change, the server records which version of the Terms of Service and this policy you agreed to, and when. Once you're signed in, the Software periodically fetches your subscription status and available features from the server. Your sign-in credentials are encrypted with the Windows Data Protection API (DPAPI) and stored on your computer.
  • Update checks and anonymous usage statistics (automatic): at most once a day, the Software asks our server whether a new version is available and sends one anonymous record: a random install ID generated at installation, the version, the interface language and whether you are signed in. It contains no email address, files, notes or computer information and is not linked to your account; it is used only to count installs and active users. You can turn it off by unchecking “Send anonymous usage statistics” in the user menu at the bottom left.
  • Upgrading and managing your subscription: when you click “Upgrade to Pro” or “Manage subscription”, the Software opens the payment page or Paddle's subscription management page in your browser.

The Software contains no third-party analytics, advertising or crash-reporting SDKs.

3. Information we process for accounts and purchases

When you sign in or buy Pro, we process the following to provide your account, activate and manage your subscription, and provide support:

  • Account information: your email address (for verification codes and support), sign-up time, the name you chose, and a salted hash of your password (if you set one);
  • Consent records: which version of the Terms of Service and this policy you agreed to, and when;
  • Sign-in records: the computer name, sign-in time and last-used time of each device, so you and we can spot unusual sign-ins;
  • Trial records: when your free trial started and ends, and the device identifier (hash) of the computer that claimed it, so the same computer can't claim the trial again;
  • Subscription information: plan, billing period, subscription status and expiry, and the payment platform's subscription and customer IDs.

Online payments are processed by Paddle.com as Merchant of Record. The payment details you enter at checkout (card number, PayPal account, billing address, tax ID and so on) are collected and processed directly by Paddle under the Paddle Privacy Policy. We do not obtain or store your card number or other sensitive payment account information; we only receive notifications from Paddle when your subscription status changes.

4. Websites

The English and Chinese (/cn/) pages of orchidnote.com are two language versions of the same static product pages. They use no cookies and embed no third-party analytics or advertising code. The payment page loads Paddle's checkout script, which is subject to Paddle's cookie policy. The website only stores your light / dark theme choice locally in your browser. Our hosting provider may keep access logs (such as IP address, access time and browser type) under its own policies for security and troubleshooting.

5. Emails between you and us

When you email us for support, we keep the correspondence and any attachments you choose to send (such as logs or sample files) solely to resolve your issue, and delete them within 12 months after it is resolved. Please don't send files containing sensitive information; if you must, remove the sensitive parts first.

6. Sharing

We do not sell your personal information. We share only the necessary information with third parties in the following cases:

  • Paddle: as reseller, to complete payments, issue receipts, and handle refunds and taxes (we pass your account ID to Paddle to link your subscription);
  • Email delivery provider (Alibaba Cloud DirectMail): to send you sign-in verification codes;
  • Business email provider (Alibaba Mail): to receive and reply to the emails you send to support@orchidnote.com;
  • Server hosting provider (Amazon Web Services, Tokyo region, Japan): where our server and database are hosted;
  • where required by law, litigation or a binding request from a government authority.

7. Retention and security

  • Account information is kept until you delete your account. Subscription records are kept after the subscription ends for as long as the law requires for transaction records (generally 3 years), then deleted or anonymized. Unused sign-in verification codes expire after 10 minutes.
  • We protect the limited information we hold with encrypted transport (HTTPS), access controls and other measures.
  • In the event of a personal information security incident, we will notify you promptly and take remedial action as required by law.

8. Your rights

You have the right to access, copy, correct and delete your personal information, withdraw consent, delete your account, and ask us to explain how we process your information. For data on your computer, you can view and delete it directly; for the account and subscription information we hold, email support@orchidnote.com and we will handle your request within 15 business days.

9. Minors

The Service is intended mainly for adults. Minors under 14 should only buy the paid version with the consent and guidance of a parent or guardian. If a guardian finds that a minor's personal information was provided without consent, please contact us to have it deleted.

10. Changes to this policy

We may update this policy and will change the “Last updated” date on this page. If an update materially changes the purpose, method or scope of processing, we will let you know through an in-app notice or a website announcement.

11. Language versions

This policy is provided in Chinese and English. You may read the version in the language of your choice, and both versions have equal effect. If the two versions are inconsistent, the English version prevails.

12. Contact us

For anything related to personal information, please contact support@orchidnote.com.