<story><title>Show HN: Personal CRM: Note taking, the way it should be</title><url>https://nat.app/calendar</url></story><parent_chain><item><author>noprivacy</author><text>&amp;quot;What are you looking for in a personal CRM?&amp;quot;&lt;p&gt;Privacy and security. And your privacy assurances&amp;#x2F;policies are woefully insufficient.&lt;p&gt;From &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nat.app&amp;#x2F;privacy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nat.app&amp;#x2F;privacy&lt;/a&gt;&lt;p&gt;&amp;gt; Your Gmail data is only used by machines. Our team won&amp;#x27;t read or access any of your email data unless you explicitly ask for it (for support for ex.)&lt;p&gt;&amp;quot;Won&amp;#x27;t&amp;quot; means nothing. The word you&amp;#x27;re looking for is &amp;quot;can&amp;#x27;t&amp;quot;&lt;p&gt;&amp;gt; By default, we don&amp;#x27;t share any data with third parties. The only exception to this rule is Mixpanel, our analytics apps, which receives information about how you use our app only.&lt;p&gt;Yeeaaaaah your privacy policy directly states that if you&amp;#x27;re acquired or go out of business, user data will be transferred or sold.&lt;p&gt;&amp;gt; As required by Google, the authentification tokens we use to retrieve your Gmail data are safely encrypted in our database.&lt;p&gt;&amp;quot;We do what is required&amp;quot; isn&amp;#x27;t convincing me you take privacy seriously, and...encrypted how? A password in the database server&amp;#x27;s config file?&lt;p&gt;&amp;gt; Access to production environments is limited to authorized team members only.&lt;p&gt;And....who are authorized team members? &amp;quot;Authorized team members&amp;quot; could mean &amp;quot;the entire engineering and QA teams, plus the marketing intern collecting demographic data reports.&amp;quot;&lt;p&gt;Your statement doesn&amp;#x27;t distinguish between user data and the production environment as a whole, it doesn&amp;#x27;t commit to strictly keeping access to production AND user data to the bare minimum required.&lt;p&gt;&amp;gt; We use the industry-standard 256-bit encryption with SSL.&lt;p&gt;...like everyone else? This does not inspire faith that your company has exemplary network security if you think this is worth mentioning.&lt;p&gt;&amp;gt; Key passwords are updated on a quarterly basis to reduce risks.&lt;p&gt;You think quarterly password rotation is a noteworthy, or even effective, security practice? You&amp;#x27;re using passwords as your sole authentication for employees? O_o&lt;p&gt;You make no mention of your policies with regards to law enforcement. Do you commit to only releasing data when served with a warrant or subpoena, or can Officer Bob call you up and explain how he&amp;#x27;s investigating a Really Bad Person and you&amp;#x27;ll hand over their data? Seems the answer is yes, you will:&lt;p&gt;&amp;gt; &amp;quot;Nat discloses potentially personally-identifying and personally-identifying information only in response to a subpoena, court order or other governmental request, &lt;i&gt;&lt;/i&gt;or when Nat believes in good faith that disclosure is reasonably necessary to protect the property or rights of Nat, third parties or the public at large.&lt;i&gt;&lt;/i&gt;&amp;quot;&lt;p&gt;What country is your organization incorporated in? What country is user data kept in and thus what laws is it subject to? Is the data stored in the cloud? A server in your uncle&amp;#x27;s basement?&lt;p&gt;You make no mention of systems to assure only a minimum number of designated employees have the access they need when they need it. IE a support team member cannot access a customer&amp;#x27;s data unless there is an open case verified as initiated by the customer.&lt;p&gt;You make no mention of how data or whether data is encrypted; it seems only gmail auth tokens are?&lt;p&gt;You should be using hardware token 2FA for critical employee access and 2FA everywhere else...not rotating passwords quarterly. You should be using vaults for every password used in production. All access should be logged and audited by an outside party.</text></item><item><author>nathanganser</author><text>I&amp;#x27;m finally in love with my product!&lt;p&gt;We&amp;#x27;re a bootstrapped team of 4 four and we&amp;#x27;ve been building our personal crm app for over a year. As the original founder and CEO, I&amp;#x27;ve been waiting for this day for a loooong time! 
I finally love my own app and use it on a daily basis (hopefully you will too).&lt;p&gt;We&amp;#x27;ve already launched a long time ago but today we&amp;#x27;re launching a new feature: Note taking, straight from your inbox.&lt;p&gt;We email you before every meeting with all the notes you&amp;#x27;ve taken about the person you&amp;#x27;re going to meet and you simply have to reply to the email to log a note! Making it the easiest way to build your database of notes about your contacts.&lt;p&gt;I know that there are tons of people who tried to build a personal CRM and that everyone has his opinion on how the &amp;quot;right&amp;quot; personal crm should work.&lt;p&gt;Personally, we&amp;#x27;ve decided that:
- it should be fully automated (sync with calendar and email)
- super simple to use (no complex and clunky interface)
- it should be magic (our app tells you who you&amp;#x27;re losing touch with based on your data)&lt;p&gt;And you? What are you looking for in a personal crm?</text></item></parent_chain><comment><author>dang</author><text>It&amp;#x27;s of course fine to make the case for privacy and security in a product like this, but please do it without snark and especially without being an internet asshole. Those things are destructive of the ecosystem here, and the ecosystem is more important than any particular thread or product.&lt;p&gt;I&amp;#x27;m sure you wouldn&amp;#x27;t litter in a city park or dump motor oil into a lake, so please don&amp;#x27;t do the analogical things on HN.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;newsguidelines.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;newsguidelines.html&lt;/a&gt;</text></comment>
<story><title>Show HN: Personal CRM: Note taking, the way it should be</title><url>https://nat.app/calendar</url></story><parent_chain><item><author>noprivacy</author><text>&amp;quot;What are you looking for in a personal CRM?&amp;quot;&lt;p&gt;Privacy and security. And your privacy assurances&amp;#x2F;policies are woefully insufficient.&lt;p&gt;From &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nat.app&amp;#x2F;privacy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nat.app&amp;#x2F;privacy&lt;/a&gt;&lt;p&gt;&amp;gt; Your Gmail data is only used by machines. Our team won&amp;#x27;t read or access any of your email data unless you explicitly ask for it (for support for ex.)&lt;p&gt;&amp;quot;Won&amp;#x27;t&amp;quot; means nothing. The word you&amp;#x27;re looking for is &amp;quot;can&amp;#x27;t&amp;quot;&lt;p&gt;&amp;gt; By default, we don&amp;#x27;t share any data with third parties. The only exception to this rule is Mixpanel, our analytics apps, which receives information about how you use our app only.&lt;p&gt;Yeeaaaaah your privacy policy directly states that if you&amp;#x27;re acquired or go out of business, user data will be transferred or sold.&lt;p&gt;&amp;gt; As required by Google, the authentification tokens we use to retrieve your Gmail data are safely encrypted in our database.&lt;p&gt;&amp;quot;We do what is required&amp;quot; isn&amp;#x27;t convincing me you take privacy seriously, and...encrypted how? A password in the database server&amp;#x27;s config file?&lt;p&gt;&amp;gt; Access to production environments is limited to authorized team members only.&lt;p&gt;And....who are authorized team members? &amp;quot;Authorized team members&amp;quot; could mean &amp;quot;the entire engineering and QA teams, plus the marketing intern collecting demographic data reports.&amp;quot;&lt;p&gt;Your statement doesn&amp;#x27;t distinguish between user data and the production environment as a whole, it doesn&amp;#x27;t commit to strictly keeping access to production AND user data to the bare minimum required.&lt;p&gt;&amp;gt; We use the industry-standard 256-bit encryption with SSL.&lt;p&gt;...like everyone else? This does not inspire faith that your company has exemplary network security if you think this is worth mentioning.&lt;p&gt;&amp;gt; Key passwords are updated on a quarterly basis to reduce risks.&lt;p&gt;You think quarterly password rotation is a noteworthy, or even effective, security practice? You&amp;#x27;re using passwords as your sole authentication for employees? O_o&lt;p&gt;You make no mention of your policies with regards to law enforcement. Do you commit to only releasing data when served with a warrant or subpoena, or can Officer Bob call you up and explain how he&amp;#x27;s investigating a Really Bad Person and you&amp;#x27;ll hand over their data? Seems the answer is yes, you will:&lt;p&gt;&amp;gt; &amp;quot;Nat discloses potentially personally-identifying and personally-identifying information only in response to a subpoena, court order or other governmental request, &lt;i&gt;&lt;/i&gt;or when Nat believes in good faith that disclosure is reasonably necessary to protect the property or rights of Nat, third parties or the public at large.&lt;i&gt;&lt;/i&gt;&amp;quot;&lt;p&gt;What country is your organization incorporated in? What country is user data kept in and thus what laws is it subject to? Is the data stored in the cloud? A server in your uncle&amp;#x27;s basement?&lt;p&gt;You make no mention of systems to assure only a minimum number of designated employees have the access they need when they need it. IE a support team member cannot access a customer&amp;#x27;s data unless there is an open case verified as initiated by the customer.&lt;p&gt;You make no mention of how data or whether data is encrypted; it seems only gmail auth tokens are?&lt;p&gt;You should be using hardware token 2FA for critical employee access and 2FA everywhere else...not rotating passwords quarterly. You should be using vaults for every password used in production. All access should be logged and audited by an outside party.</text></item><item><author>nathanganser</author><text>I&amp;#x27;m finally in love with my product!&lt;p&gt;We&amp;#x27;re a bootstrapped team of 4 four and we&amp;#x27;ve been building our personal crm app for over a year. As the original founder and CEO, I&amp;#x27;ve been waiting for this day for a loooong time! 
I finally love my own app and use it on a daily basis (hopefully you will too).&lt;p&gt;We&amp;#x27;ve already launched a long time ago but today we&amp;#x27;re launching a new feature: Note taking, straight from your inbox.&lt;p&gt;We email you before every meeting with all the notes you&amp;#x27;ve taken about the person you&amp;#x27;re going to meet and you simply have to reply to the email to log a note! Making it the easiest way to build your database of notes about your contacts.&lt;p&gt;I know that there are tons of people who tried to build a personal CRM and that everyone has his opinion on how the &amp;quot;right&amp;quot; personal crm should work.&lt;p&gt;Personally, we&amp;#x27;ve decided that:
- it should be fully automated (sync with calendar and email)
- super simple to use (no complex and clunky interface)
- it should be magic (our app tells you who you&amp;#x27;re losing touch with based on your data)&lt;p&gt;And you? What are you looking for in a personal crm?</text></item></parent_chain><comment><author>philsnow</author><text>I was already put off by the email-centric flow of this (I want to spend &lt;i&gt;less&lt;/i&gt; time in my email inbox, not more), but it looks like from this comment that signing up requires me to auth nat.app to read my gmail?&lt;p&gt;Complete non-starter for me.  So many reset flows go through email these days that your primary email is the keys to the kingdom.&lt;p&gt;I could set up a specific email account on my domain just for nat.app but the whole point of this CRM is that it&amp;#x27;s in the same flow as the rest of my email, isn&amp;#x27;t it?</text></comment>