At a glance

Your local notes, wiki files, and workspace content stay on your device unless you choose an online feature that sends them out.
We do not sell your personal data. We do not share it for targeted advertising. We do not run third-party behavioral ad analytics on the Walnut website today.
Online features use only the data needed for that feature, such as Google sign-in, checkout, downloads, support, sync, or AI requests.
We name the main service providers we use and explain why they receive data.
If a valid legal request requires disclosure, we disclose only the minimum data legally required.

Key facts

Last updated: 2026-06-26
Effective date: 2026-06-26
Operator: Walnut operator responsible for the website, account, billing, and online services; details may appear in checkout, invoice, account notices, or official support replies.
No sale / ads: No sale of personal data; no sharing for targeted advertising
Local storage: Desktop content stays local unless you enable sync, upload, hosted AI, or another online feature
Contact: support@evofarm.top

1. Scope

This policy applies to Walnut's website, account portal, billing and checkout flows, download pages, download mirror, and online services operated for Walnut.

It does not cover third-party websites, payment providers, AI model providers, cloud providers, or app marketplaces that you choose to use. Their own terms and privacy policies also apply when you use them.

2. Local-first data boundary

Walnut is designed so your personal knowledge base can live on your own device. Opening the desktop app or visiting the website does not upload your default local notes, wiki files, or workspace content.

Data leaves your device only when you take a visible action that needs an online feature. Examples include signing in, starting checkout, downloading through a mirror, emailing support, enabling cloud sync, uploading a file, or sending an AI request.

3. Information we collect

The data we collect depends on what you use. A user who only downloads the desktop app shares much less data than a user who signs in, pays, syncs, or sends AI requests.

Account data: name, email address, avatar, sign-in method, account status, and identity verification facts.
Device and session data: login state, device identifiers used for access control, browser information, timestamps, and security events.
Billing data: selected plan, order records, subscription state, invoice or payment-provider references, refunds, cancellations, and chargeback facts.
Support data: emails, bug reports, screenshots, logs, or other information you choose to send us.
Technical logs: IP-derived region signals, request paths, error codes, download mirror logs, and aggregated download statistics.
Online content: content you explicitly send by enabling sync, using an upload/share control, or sending an AI request.

4. How we use information

We use personal data to run the specific Walnut features you ask for and to keep the service safe and reliable.

Sign you in and maintain your account session.
Show account, subscription, checkout, and device-access status.
Process payments, taxes, refunds, invoices, fraud checks, and chargeback handling through checkout providers.
Deliver downloads and publish privacy-safe aggregate download statistics.
Provide sync, upload, hosted AI, or BYOK-related flows only when you use those features.
Debug errors, monitor uptime, prevent abuse, and protect accounts and infrastructure.
Meet tax, accounting, recordkeeping, consumer protection, and legal obligations.

5. No sale, no targeted advertising

We do not sell your personal data.

We do not share your personal data for targeted advertising.

We do not run third-party behavioral advertising analytics on the Walnut website today. If we introduce analytics later, we will update this policy and explain the provider, purpose, and opt-out choices where required.

Sharing data with service providers is different from selling data. Service providers receive data only to perform work for Walnut, such as hosting, login, checkout, download delivery, or support. They are not allowed to use Walnut data for their own advertising or resale when they process data for us.

6. Data recipients

These are the main categories of third parties that receive Walnut data today or when you choose a connected feature.

Google: verifies your identity when you use Google sign-in or Google One Tap. Walnut does not give the desktop app your Google password or Google access token.
Creem or the checkout provider shown on the checkout page: processes payment, taxes, subscription state, invoices or receipts, fraud checks, refunds, and chargebacks.
Vultr and server infrastructure providers: host the Walnut website, account portal, billing bridge, operational logs, and security controls.
GitHub Releases and Walnut download mirrors: distribute public installers. Mirror logs are used to produce aggregate download statistics; raw IP addresses, user agents, and request identifiers are not published.
Support email provider: receives the messages and attachments you send to support@evofarm.top so we can reply and investigate.
AI model or cloud providers you choose: process prompts, files, sync data, or other content only when you connect that provider or use a feature that sends data to it. Current paid plans do not include hosted AI compute by default.

7. Legal and safety disclosures

We disclose personal data for legal or safety reasons only when the situation is specific and justified.

To respond to a valid court order, subpoena, regulator request, or other legally binding request.
To protect Walnut, our users, or the public from fraud, abuse, security incidents, or unlawful activity.
To handle a merger, acquisition, financing, reorganization, or similar business transfer, if the receiving party must protect the data under appropriate terms.

8. Cross-region processing

Walnut serves users across regions. Account, billing, download, support, cloud, AI, and security providers can be located outside your country or region.

When you choose a feature that uses such a provider, the data needed for that feature can be transferred to, stored in, or accessed from another region. We use a data-minimization approach and apply notice, consent, contractual, assessment, or other transfer mechanisms where applicable law requires them.

9. Retention and deletion

We keep personal data only as long as needed for the purposes in this policy, unless law, accounting, tax, dispute, chargeback, or security obligations require a longer period.

Our target retention periods are: technical logs for up to 90 days, backup copies for up to 90 days after rotation, support messages for up to 24 months, and billing or tax records for up to 7 years after the relevant transaction unless a longer period is required.

After a verified deletion request, we aim to delete or de-identify account profile data Walnut controls within 30 days, subject to legal and operational limits.
Deleting a Walnut account does not automatically delete data stored by third-party providers you connected.
Local files on your device remain under your control unless you delete them yourself.

10. Your privacy rights

Depending on where you live, you can ask to access, correct, delete, export, restrict, or object to certain processing of your personal data. You can also withdraw consent where consent is the legal basis.

If you are in California or another jurisdiction with similar rights, you can ask what categories of data we hold, request deletion or correction, and ask for information about disclosures. Stronger mandatory local rights prevail.

Email us with the account email, request type, and enough detail to verify your identity.
We keep information that law requires us to keep, or that we need for security, billing, dispute handling, or fraud prevention.
If we need more information to process a request, we ask only for what is necessary.

11. Security and children

We use reasonable technical and organizational safeguards, including access controls and operational security practices. No online service can be 100% secure. Please protect your device, account, model keys, cloud accounts, and billing credentials.

Walnut is not directed to children under 13, children under 14 in mainland China, or children under the minimum age required by local law. We do not knowingly collect personal information from children in those groups. If we learn that we collected such information without required consent, we will delete it or obtain appropriate consent as required by law.

12. Changes to this policy

We update this policy when Walnut's product, providers, legal obligations, or data flows change. The updated page will show the new effective date or updated date.

If a change materially affects how we handle personal data, we will use a reasonable notice method, such as a website notice, account notice, product notice, or email where appropriate.

Contact

For privacy questions, data requests, or complaints, email support@evofarm.top. Include the account email and enough context for us to verify and handle the request.

support@evofarm.top

Privacy Policy