Privacy Policy for Notone

Notes and Knowledge Graph

When you use Notone, we collect and store the content you create, including:

• Note content: The text of your notes, including titles, bodies, and any information you choose to write
• Tags: Labels you attach to notes for organisation and search
• Synapse links: The connections you create between notes, including their relationship type and weight
• Time fields: Due dates, schedules, and reminder times you set on notes
• Note metadata: Note type, status, lifecycle, and creation or update timestamps

Account Information

Notone uses Firebase Authentication (provided by Google) to identify your account. Depending on how you sign in, we may store:

• A unique account identifier (an anonymous account ID and a Firebase user ID)
• Your email address, if you sign up with email and password
• A provider identifier from Google or Apple, if you sign in with those services

You can start using Notone anonymously, without providing your name or email. If you sign in later, your existing notes are linked to your account so you can recover them across devices.

Analytics

We use Firebase Analytics to understand how the app is used. Firebase automatically collects:

• App open and session events
• Device model and operating system version
• App version
• General usage patterns (the content of your notes is not included)

This data is aggregated and used to improve the app. We do not include the content of your notes in analytics.

Push Notifications

If you allow notifications, we register a device push token through Apple Push Notification service (APNs) and Firebase Cloud Messaging (provided by Google). Along with the token, we may store your device name and time zone to deliver reminders at the correct time and to help you tell your devices apart. We use this information only to deliver reminders for the time fields you set on your notes.

Device Attestation

We use Firebase App Check (with Apple's App Attest) to verify that requests to our backend come from a genuine, unmodified copy of the app. This helps protect the service from abuse. App Check does not identify you personally.

Embeddings (OpenAI)

To power semantic search and associative recall, the text of your notes is sent to OpenAI to generate numerical representations called embeddings. This happens automatically whenever you create or update a note. The embeddings are then stored on our infrastructure (Cloudflare Vectorize) to enable similarity search. This processing is essential to the app's functionality and cannot be turned off while using these features.

AI Assistant

When you use the AI assistant (chat) feature, your messages and the relevant notes provided as context are sent to our backend and processed by an AI model to generate a response. By default, this processing is performed by Cloudflare Workers AI on Cloudflare's infrastructure. We only send this content to the AI assistant when you actively use the feature. Your chat history is also stored on your device so you can revisit past conversations.

Our Backend (Cloudflare)

Your notes, tags, synapse links, and reminders are stored in a per-user database (Cloudflare Durable Objects with SQLite storage). Embeddings used for search are stored in Cloudflare Vectorize. This data is hosted on Cloudflare's infrastructure.

To keep your data tied to you across sign-ins and devices, our backend stores account-linking references. Your email address and sign-in provider identifiers are stored only in hashed form on our backend — your plaintext email is handled by Firebase (Google) for authentication and is not stored in plaintext on our servers.

Cloudflare processes and stores this data in accordance with their privacy policy: cloudflare.com/privacypolicy

On-Device Storage

Notone keeps a local cache of your notes on your device for offline access and performance. Your account ID is also stored securely in the device Keychain and may sync across your own devices via iCloud Keychain so you can recover your account.

Access and Deletion

• View data: All of your notes and connections are visible within the app
• Delete notes: You can delete individual notes; their links and stored embeddings are removed as well
• Delete your account: You can request deletion of your account and all associated server-side data. When you do, your notes, tags, links, reminders, and embeddings are permanently removed from our backend
• Contact us: You may exercise any of these rights by emailing support@sbryu.com