Yes. Private notes in LotsNotes never reach an agent: over MCP or the API they answer "not found", as if they didn't exist. Every save keeps a version you can restore, agents work inside the same roles and folder access as the person who connected them, and Connected apps on the Workspace page cuts any agent off everywhere in one click.
I run all of LotsTech's agents on LotsNotes: their instructions, plans, handoffs and ledgers, plus every product's marketing context. So these are the controls I rely on every day. Below is what each one does, checked against the LotsNotes docs, the tool list and the policies on 22 October 2026, and what changes between Free and Pro.
LotsNotes safety at a glance
| Worry | What LotsNotes does |
|---|---|
| "Will my agent read my private notes?" | No. Private notes stay on lotsnotes.com. Over MCP and the REST API they return "not found", so an agent can't even tell one exists |
| "Can an agent see every folder?" | It sees what the person who connected it can see. A member or viewer limited to selected folders gets an agent limited to the same folders |
| "What if an agent overwrites a note badly?" | Every save creates a version. Restore any version, and the current state is kept in history too |
| "What if two agents edit the same note?" | An agent that sends the version it read gets a conflict instead of overwriting the other edit. In the app, LotsNotes asks before overwriting |
| "Can an agent delete everything?" | No tool permanently deletes a note. Trash, archive and folder deletion can all be restored |
| "How do I cut an agent off?" | Workspace page, Connected apps, Disconnect. It loses access at once on every device where it was signed in |
| "Does an agent hold a permanent key?" | No. MCP agents sign in with OAuth: access tokens last 1 hour, and refresh tokens last 30 days and are replaced each time they're used |
| "What happens if Pro ends?" | Nothing is hidden or locked. Only creating more than Free allows waits for Pro |
Private notes: never returned to an agent
Every note in LotsNotes is either shared or private. A shared note is visible to your workspace, within each person's role and folder access, and to the agents they connect. A private note is visible to you, on lotsnotes.com, and nowhere else.
The rule is enforced on the server, not in the agent's instructions. When an MCP agent or a REST call asks for a private note, LotsNotes answers the same way it answers for a note ID that was never created: not found. Search results skip private notes, and read_note on a private note's ID returns not found, so an agent can't confirm that the note is there. The agent skill on lotsnotes.com/skill.md tells agents the same thing: a private note looks like it does not exist.
Two things to know when you use it:
- New notes start shared. The composer defaults to Workspace or Folder visibility, because most notes are written for agents to read. Click the visibility label to make a note private before or after you write it. One click switches it back, and only the note's author can change it.
- Agents can't make a note private, or make a private note shared. Notes an agent creates over MCP or the API are always shared notes, and a visibility change from an agent is refused. Private notes are managed only on lotsnotes.com.
What I keep private: margins, client rates, half-formed strategy, anything I want in the same place as my business context but never in an agent's prompt.
Version history and restore
Every time a note is saved, by you in the app or by an agent through save_context_note, LotsNotes stores a version snapshot of the title and content. In the app, open a note's history to see the versions and restore one. Agents have the same three tools: list_context_versions (newest first), get_context_version to read one, and restore_context_version.
Restoring doesn't throw anything away. The note's current state is saved as a version first, so if the restore was a mistake, you restore again.
Two more guards stop edits from colliding:
- Version check on save. An agent that read a note earlier sends
expected_versionwith its save. If anyone changed the note since, the save fails with a conflict (NOTE_VERSION_CONFLICT) and the agent reads it again and merges, instead of overwriting the other edit. In the app, LotsNotes asks before a conflicting edit overwrites. This is what keeps a shared handoff note safe when Claude Code, Codex and Cursor take turns on the same work, as set out in Claude Code Handoff. - A link on every note. Every note an agent creates, reads or saves comes back with its
https://lotsnotes.com/note/...link. A well-behaved agent hands you that link, so you can open exactly what it changed.
If a save fails in the app, your edits stay on screen with a Retry button.
Nothing an agent does is permanent
I checked every tool in tools.json. The removing tools are all reversible:
trash_notesoft-deletes a note, andarchive_context_notearchives one.restore_context_notebrings either back.delete_folderworks only on a folder with no subfolders, hides its notes without deleting them, andrestore_folderbrings everything back.archive_workspaceis owner only, needs the workspace name typed asconfirm_name, and can't archive your only workspace. Nothing in an archived workspace is deleted, and the owner can restore it for 30 days.remove_workspace_memberandleave_workspaceremove access, never notes. The notes that person shared stay in the workspace.
There is no MCP or API tool that permanently deletes a note or a workspace. Emptying the trash is something you do yourself on lotsnotes.com. The tool descriptions also tell agents to confirm with you before archiving a workspace, removing a member or leaving.
Roles and folder access
An agent acts as the person who connected it, with that person's role. It never gets more access than they have.
| Role | Shared notes | Folders | Team |
|---|---|---|---|
| Owner | Read and edit everywhere | Every folder | Invites, changes and removes anyone; archives and restores the workspace |
| Admin | Read and edit everywhere | Every folder, always | Invites, changes and removes members and viewers, not other admins |
| Member | Read and edit | All folders, or only selected ones (and everything inside them) | None |
| Viewer | Read only | All folders, or only selected ones | None |
A few rules worth knowing:
- Workspace notes are for everyone in the workspace. A member limited to one folder still reads workspace-wide notes, such as your top-level
AGENTS.md. Keep client-specific details in client folders, or give a client its own workspace. - Nobody can be made owner through an invite or a role change, and the owner can't be removed.
- Invitations are bound to one email address and the link works for 7 days.
- Removing someone takes effect at once. Their access ends, and so does the access of every agent they connected to that workspace, because those agents act as them.
Your agent can do this team work too. invite_workspace_member, update_workspace_member and remove_workspace_member follow the same rules, and the tool descriptions tell the agent to confirm the email address and role with you first. I wrote up the per-client setup for agencies in How Agencies Keep Each Client's Context Separate.
Cutting off an agent: Connected apps
Open the Workspace page on lotsnotes.com and scroll to Connected apps. It lists every AI agent that can reach your notes right now: Claude, ChatGPT, Codex, Cursor or any other MCP client, with the date it connected and when it was last used ("Used today", "Used 3 days ago").
Click Disconnect on any of them and confirm. The agent loses access to your notes immediately, on every device where it was signed in. LotsNotes revokes every credential that agent holds for you, so the next tool call fails. To use it again, someone has to sign in from the agent and approve it, which means you.
Three details:
- An agent can't disconnect itself or another agent, and can't see this list. Listing and revoking connections works only in the browser, signed in as you. Over MCP and the API those calls return not found.
- Apps connected to your other Lots products are listed on lotstech.com/dashboard/connected-apps. LotsNotes links to it from the same card.
- API keys are separate. Cloud agents and scripts that use the REST API hold a key you created at lotstech.com/api. Revoke the key there when you're done with it. A key can't read private notes either.
Even without a disconnect, MCP access expires on its own: access tokens last 1 hour, and the 30-day refresh token is replaced each time it's used, so an agent you stop using drops off.
What happens on Free versus Pro
The safety controls above are the same on both plans. Private notes, version history, restore, trash, roles and Connected apps aren't plan features. The plans only decide how much you can create.
| LotsNotes Free | LotsNotes Pro | |
|---|---|---|
| Price | $0 | $99 once, not a subscription |
| Workspaces | 1 | Unlimited |
| Folders | 3 | Unlimited |
| Team members | None (one person) | Unlimited, with roles |
| Notes and checklists | Unlimited | Unlimited |
| MCP and REST access | Included | Included |
| Private notes, versions, Connected apps | Included | Included |
LotsNotes Pro is also included while you hold a Pro or Business plan of LotsSocial, LotsBlog, LotsTeam, LotsCRM, LotsInvoice, LotsBusiness or LotsStore. Prices are on the pricing page, and the full breakdown is in LotsNotes Pricing Explained.
If included Pro ends, because that plan ends, nothing you created is hidden, locked or deleted. Your extra workspaces, folders and teammates keep working. Only creating something new past the Free limits waits until you have Pro again. Limits follow the workspace owner, so a teammate invited into a Pro owner's workspace pays nothing. And if LotsNotes can't check billing for a moment, your notes stay usable.
Where your notes live
LotsNotes is built by LotsTech AI Solutions Private Limited and covered by the LotsTech privacy policy and terms. Per the privacy policy, data is stored primarily on servers in the United States through service providers such as Supabase and Cloudflare, encrypted in transit with TLS, with sensitive data encrypted at rest with AES-256. Account deletion is by request, and personal data is deleted or anonymized within 30 days of deleting an account unless the law requires keeping it.
LotsNotes has no AI of its own reading your notes. It stores them. The agents you connect do the reading and writing, through MCP or the REST API, and only for shared notes they're allowed to see.
What I'd set up on day one
- Put rules and facts every agent needs in shared notes, starting with a workspace-level
AGENTS.md. - Mark anything sensitive as private before you save it.
- Connect each agent with its own sign-in (setup for Claude, ChatGPT, Codex and Cursor), so each shows up as its own row in Connected apps.
- Invite teammates as members or viewers with only the folders they need, and keep admin for the people who manage the team.
- Once a month, open Connected apps and disconnect anything you no longer use.
It works with the AI agent you already use, and the dashboard does all of the above too. The step-by-step connection guide is in How to Connect Claude, ChatGPT, Codex and Cursor to LotsNotes.
FAQ
Can AI agents read my private notes in LotsNotes?
No. Private notes stay on lotsnotes.com and are never returned through MCP or the REST API. If an agent asks for one, LotsNotes answers "not found", the same as for a note that doesn't exist, and search results leave private notes out.
Can I undo a change an agent made to a note?
Yes. Every save creates a version. Open the note's history in the app, or ask the agent to use list_context_versions and restore_context_version. Restoring saves the current state as a version first, so you can undo the restore as well.
How do I disconnect an AI agent from LotsNotes?
Open the Workspace page on lotsnotes.com, find Connected apps, and click Disconnect next to the agent. It loses access immediately on every device where it was signed in, and it needs your sign-in to connect again. For REST access, revoke the API key at lotstech.com/api.
Can an agent delete my notes for good?
No. The agent tools only trash, archive or hide notes and folders, and each one has a restore tool. An archived workspace can be restored by its owner for 30 days. Permanently emptying the trash is done only by you on lotsnotes.com.
Can I limit an agent to one folder?
Yes, through the person who connects it. Invite them as a member or viewer with access to selected folders, and any agent they connect sees only those folders plus workspace-wide notes. A viewer's agent can read but not edit.
What happens to my notes if LotsNotes Pro ends?
Nothing is hidden, locked or deleted. Existing workspaces, folders and teammates keep working, and only creating more than Free allows (1 workspace, 3 folders, no team members) waits for Pro. The safety features work the same on Free and Pro.
Sources
Checked on 22 October 2026:
- LotsNotes: tool list, API docs, agent skill, pricing, home page and llms.txt.
- LotsTech: privacy policy (storage, encryption, retention), terms of service (included access) and API keys.