You win some, you lose some.

That’s what Evernote said after publishing a new privacy policy last Tuesday that inspired a media storm and subsequent ire by users of the note-taking app. Many took to Twitter to express their outrage, threatening to uninstall the app and move their notes to rival services.

So what exactly happened? On Tuesday, December 13, Evernote emailed users to let them know they were making updates to their privacy policy effective January 23, 2017. In that email, they reiterated their three laws of data protection: “Your data is yours, protected, and portable.” However, they changed two privacy policy provisions about how Evernote handles customer data, causing the controversy.

In the email, Evernote said that, by virtue of continuing to use Evernote after January 23, users were consenting to the new privacy policy. In other words, users can’t opt out. By Thursday, Evernote CEO Christopher O’Neill backpedaled, retracting the new privacy policy and apologizing to customers.

“We recently announced an update to Evernote’s privacy policy that we communicated poorly, and it resulted in some understandable confusion. We’ve heard your concerns, and we apologize for any angst we may have caused. In response to the questions you’ve raised, let me be clear about what’s not changing and what is changing,” O’Neill said in a December 15 blog post.

He went on to assure users that “Evernote employees do not view the content of user notes except in very limited cases,” and that “the number of employees who are authorized to view this content is extremely limited by our existing policies, and I am personally involved in defining them.”

O’Neill said that Evernote’s intent with its new privacy policy was to make users more productive by employing machine learning and other technologies that would help automate manual functions. As it experiments, Evernote’s data scientists “need to do spot checks.” This change will take place on January 23, but users will be able to control whether or not their data can be used for that purpose.

“If you choose to participate in these experimental features, you’ll enjoy a more personalized experience. Select Evernote employees may see random content to ensure the features are working properly but they won’t know who it belongs to. They’ll only see the snippet they’re checking. Not only that, but if a machine identifies any personal information, it will mask it from the employee,” O’Neill said.

In a separate December 15 post, O’Neil said, “Trust is at the heart of our service. That means we need to be transparent, admit our missteps, and commit to making the Evernote experience the best it can be, from the way the app functions across platforms to the way we communicate with the people who use it.”

Evernote will continue to work on its current privacy policy, and as it begins experimenting with machine learning, users must opt in to be included.

“We announced a change to our privacy policy that made it seem like we didn’t care about the privacy of our customers or their notes. This was not our intent, and our customers let us know that we messed up, in no uncertain terms. We heard them, and we’re taking immediate action to fix it,” said O’Neill.

“We are excited about what we can offer Evernote customers thanks to the use of machine learning, but we must ask for permission, not assume we have it. We’re sorry we disappointed our customers, and we are reviewing our entire privacy policy because of this.”

Evernote followed up with an email to users on Saturday explaining that it was revising privacy policy changes.

“The main thing to know is this: your notes remain private, just as they’ve always been,” it said. “Evernote employees have not read, and do not read, your note content. We only access notes under strictly limited circumstances: where we have your permission, or to comply with our legal obligations.”

Insider Take:

We would not want to be Evernote right now. The backlash from users – free users and premium subscribers – was ugly. While Evernote retracted its privacy policy within days of publishing it, the damage will linger, and they are likely to lose some customers as a result. Transparency and protection of customer data are paramount, and customers feel betrayed.

To move forward successfully, Evernote needs to follow through on its three laws of data protection, last updated in June 2014, and it needs to re-examine its current privacy policy to ensure that users have the option to opt-in of any sharing of data or machine learning done on user data. This may not be enough to prevent some users from leaving, however. It might be helpful for Evernote to implement a marketing campaign to retain those users, perhaps by offering a special promotion as an incentive to stay.