Show HN: Personal CRM: Note taking, the way it should be

Privacy and security. And your privacy assurances/policies are woefully insufficient.

From https://nat.app/privacy

> Your Gmail data is only used by machines. Our team won't read or access any of your email data unless you explicitly ask for it (for support for ex.)

"Won't" means nothing. The word you're looking for is "can't"

> By default, we don't share any data with third parties. The only exception to this rule is Mixpanel, our analytics apps, which receives information about how you use our app only.

Yeeaaaaah your privacy policy directly states that if you're acquired or go out of business, user data will be transferred or sold.

> As required by Google, the authentification tokens we use to retrieve your Gmail data are safely encrypted in our database.

"We do what is required" isn't convincing me you take privacy seriously, and...encrypted how? A password in the database server's config file?

> Access to production environments is limited to authorized team members only.

And....who are authorized team members? "Authorized team members" could mean "the entire engineering and QA teams, plus the marketing intern collecting demographic data reports."

Your statement doesn't distinguish between user data and the production environment as a whole, it doesn't commit to strictly keeping access to production AND user data to the bare minimum required.

> We use the industry-standard 256-bit encryption with SSL.

...like everyone else? This does not inspire faith that your company has exemplary network security if you think this is worth mentioning.

> Key passwords are updated on a quarterly basis to reduce risks.

You think quarterly password rotation is a noteworthy, or even effective, security practice? You're using passwords as your sole authentication for employees? O_o

You make no mention of your policies with regards to law enforcement. Do you commit to only releasing data when served with a warrant or subpoena, or can Officer Bob call you up and explain how he's investigating a Really Bad Person and you'll hand over their data? Seems the answer is yes, you will:

> "Nat discloses potentially personally-identifying and personally-identifying information only in response to a subpoena, court order or other governmental request, or when Nat believes in good faith that disclosure is reasonably necessary to protect the property or rights of Nat, third parties or the public at large."

What country is your organization incorporated in? What country is user data kept in and thus what laws is it subject to? Is the data stored in the cloud? A server in your uncle's basement?

You make no mention of systems to assure only a minimum number of designated employees have the access they need when they need it. IE a support team member cannot access a customer's data unless there is an open case verified as initiated by the customer.

You make no mention of how data or whether data is encrypted; it seems only gmail auth tokens are?

You should be using hardware token 2FA for critical employee access and 2FA everywhere else...not rotating passwords quarterly. You should be using vaults for every password used in production. All access should be logged and audited by an outside party.

I had a call with him about this and he clearly explained to me how hard it was to implement and all the compromises you have to make. In our case, as we want to offer the most effortless experience, end-to-end encryption is going to be hard, but we definitely want to get there at some point.

We're already encrypting some data though :)

What makes our note taking tool special is that we send you an email before every meeting with all the notes you've taken about the person you're about to meet. Then you can simply write a new note by replying to the email.

This is why the calendar integration is required. Hope that makes sense!

1) If your admin allows it you're fine. We work with G Suite as well. What concerns do you have? Please check out https://nat.app/privacy to understand how we treat your data, to summarize: - Your data is never accessed by a human - We don't share it with any third parties - Your data is safely stored and sent to you when needed (aka. before your next meeting). That's it.

If you're fine writing down notes into a web app, sending them per email is the same level of safety/security.

2) Its Nat indeed. We were previously called Nat Bot (initially we tried to build a chatbot, but pivoted a bit. Nat it is :)

AKA - I learned how to make a CRUD app - pay me money (or your data) for it!

The automatic reminders to read and type notes via emails solves a problem that I expect many people have with taking these kinds of notes: remembering to write them after meetings and remembering to read them before meetings.

Make one that saves everything to my Github account and then we'll talk.

In order to sync across devices, I use Standard Notes, which also implements end to end encryption of your data.

There's a self-hosted open source version. And there's a paid version to host on their servers, which I've used for a few years now and have never had an issue with.

If you like the plain text format (with option to use Markdown), you might like it. For me, the benefit is when I have random things throughout the day I realize I need to do. I add it to my phone, and I then immediately have it on all of my Linux and Mac desktops and laptops. I also live in the mountains and frequently take notes while out of cell/wifi service and syncing has still been great.

But things like collaborative editing become impossible with this model. Or maybe i don't know enough.

I want to be able to access the notes. At all times. If I've got battery power, I should have my notes. Even Evernote screws this up sometimes if you're on a slow (not down) network

I've switched to Joplin myself because it just syncs every so often. My notes aren't hidden behind some bloated app that struggles with high latency and as a bonus my central storage is my NAS over WebDAV (and Tailscale to access it everywhere I have internet access)

Monica is fully manual. You have to add every interaction manually and open their web app if you want to add a note. We're much more integrated and proactive: you'll receive an email before every meeting with all the notes about the person you'll meet in that meeting for example.

Our main app also tells you who you're losing touch with based on your data. Monica is really a sexy database, we add some "magic" on top of that.

But 20k is a steep price :/ especially for a bootstrapped company like us.

Some might say Google is trying to prevent small companies to innovate upon Gmail...

Simply search for nat.app or "nat personal crm"

Our main personal crm syncs with Gmail and uses an AI in order to find out who you're losing touch if that's what you mean.