Skip to content
Noota
Sign inGet the app

Noota

Language: English

Privacy Policy

Last updated:

1. Who we are

Noota ("Noota", "we", "us" or "our") turns your recordings, documents, photos and YouTube videos into notes, summaries and study material. The Noota apps for iPhone, iPad, Mac and Apple Watch and the website and web app at noota.app (together, the "Service") are provided by the developer identified as the seller of Noota on the Apple App Store. That developer is the controller of your personal data under this Privacy Policy. You can contact us at any time at support@noota.app.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it and what rights you have. Third-party services that you use with Noota, such as Sign in with Apple or Google Sign-In, are governed by their own privacy policies.

2. How Noota handles your content

  • Transcription happens on your device. When you record or import audio, speech is converted to text on your device, either by Apple's speech recognition or by WhisperKit speech models that run locally. Your recordings are never sent to an AI provider for transcription. If speech models need to be downloaded to your device, they are downloaded from Hugging Face; this download does not include any of your content. Dictating a question in Ask works differently; see Section 5.
  • Your notes are stored in your Noota account. To sync your notes across your devices and keep them backed up, we store your notes and the content you add on our servers. This includes audio recordings and imported files (such as PDFs, documents and photos) up to the size limits shown in the app, currently 50 MB for audio and PDFs, 25 MB for other documents and 10 MB per photo. Larger audio files stay only on your device, and only their transcript is sent to us. A copy of your recordings also remains on your device until you delete it.
  • AI features use Apple Intelligence where it is available, and our servers otherwise. On supported Apple devices, the summary of a note may be written by Apple Intelligence, on your device or on Apple's Private Cloud Compute. Otherwise, and for quizzes, flashcards and answers, we send the relevant content to our AI providers, Anthropic and Google. Section 5 describes both. We do not sell your data, we do not use it for advertising and we do not use your content to train AI models.

3. Personal data we collect

Account information

  • Sign in with Apple or Google Sign-In: your email address (with Sign in with Apple, this may be a private relay address), your name (with Sign in with Apple, only if you choose to share it) and an account identifier provided by Apple or Google.
  • Guest accounts: when you start using Noota, we create an account with a random identifier, without asking for your email address, so that your notes can be synced and restored. You can later link it to Apple or Google.
  • Email accounts: if you created an account with an email address and password in an earlier version of the app, we keep your email address, your name and your password, which is stored only in hashed form.

Your content

  • Audio recordings, including recordings made with Apple Watch and transferred to your iPhone.
  • Transcripts, notes, titles, tags, summaries, action items, quizzes, flashcards, custom summary instructions, and the questions and answers in Ask.
  • Files you import (PDFs, documents, photos and scanned pages) and the YouTube links you add, together with the transcripts we retrieve for them.

Your content may include personal data about you or about other people, such as the voices, names or opinions of meeting participants. Please do not record or import sensitive information about other people, such as health information, unless you are allowed to do so.

Purchase information

Purchases are processed by Apple, and we never receive your payment card details. Through RevenueCat, our subscription management provider, we receive information about your purchases, such as the product purchased, transaction identifiers, purchase and expiration dates, renewal status and the country of your App Store account. RevenueCat may also receive Apple's privacy-preserving attribution data (AdServices), which indicates whether the app was installed from an Apple Search Ads campaign.

Usage, device and diagnostic data

  • In the app: we use Google Firebase services (Analytics, Crashlytics, Remote Config, Cloud Messaging and In-App Messaging) to understand how the app is used, fix crashes, configure and test features, and deliver the notifications you allow. This includes events such as the screens and features used, paywall and purchase steps, the app version, device model, operating system version, language, approximate location derived from your IP address (country or region), crash reports and Firebase identifiers. We do not send your recordings, transcripts or notes to Firebase, and we do not link analytics data to your Noota account. We do not use your device's advertising identifier (IDFA) and we do not track you across apps and websites owned by other companies.
  • On our servers: technical information such as your IP address, the time of each request, the app version and error details, which we use to run and secure the Service. When a request fails, our error-monitoring provider may receive technical details about the error, which can occasionally include a fragment of the content involved. Our servers also record which platform each request comes from (the web app or the Noota app) and count, for each day, how many accounts used each platform and plan. We use these counts only in aggregate, to decide where to improve Noota.
  • On our website and web app: we use only the cookies needed to keep you signed in and to remember the language and the appearance (light or dark) you choose. We do not use advertising or analytics cookies. The web app keeps a few things in your browser so that it works, such as which flashcards you marked as known and a page to show when you are offline. Signing out deletes them. To count how the website and web app are used, our server records anonymous events, such as a page being opened, a study session finished or an import that failed, together with the family of your browser and operating system (for example "Chrome" and "Windows"), whether the device is a phone or a computer, and the page language. These events use no cookie or other storage on your device, and carry no identifier for you or your device, no IP address and none of your content, so they cannot be linked to you or your account. The sign-in page loads Sign in with Apple and Google Sign-In, so Apple and Google receive technical data such as your IP address when it opens. A YouTube note shows the video's thumbnail, loaded from YouTube, and plays the video in YouTube's player, loaded from youtube-nocookie.com only when you start it; each time, Google receives technical data such as your IP address. Our hosting provider, Cloudflare, processes technical data such as your IP address to deliver the website and web app and to protect them against abuse.

Communications

If you contact us, we receive your email address and the content of your message, and we keep our correspondence with you.

4. How we use your data and our legal bases

We use your personal data for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) requires a legal basis for each purpose; we indicate it for each one. Where other laws apply, such as the Brazilian LGPD, we rely on the equivalent legal bases under those laws.

  • To provide the Service: create and manage your account; transcribe, store and sync your notes; generate the AI content you request; restore your purchases; and provide support. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
  • To manage subscriptions and purchases: verify your Noota Pro access and keep purchase records. Legal bases: performance of our contract with you, and compliance with our legal obligations, such as accounting and tax obligations (Art. 6(1)(c) GDPR).
  • To understand and improve the Service: analytics, crash reports and testing of new features. Legal basis: our legitimate interest in understanding how Noota is used and improving it (Art. 6(1)(f) GDPR).
  • To keep the Service secure: prevent fraud and abuse, fix problems and enforce our Terms of Use. Legal basis: our legitimate interest in protecting the Service, our users and ourselves (Art. 6(1)(f) GDPR).
  • To handle reports about shared pages: keep the reason and explanation given in a report, and the name and email address of the person reporting only if they give them, so that we can review the report, confirm we received it and tell them our decision, as the EU Digital Services Act requires. Legal bases: compliance with our legal obligations (Art. 6(1)(c) GDPR), and our legitimate interest in keeping shared pages lawful (Art. 6(1)(f) GDPR).
  • To send you the notifications you have enabled, for example when a summary is ready. Legal basis: your consent, given through your device's notification permission, which you can withdraw at any time in your device settings (Art. 6(1)(a) GDPR).
  • To comply with the law: respond to lawful requests from authorities and establish, exercise or defend legal claims. Legal bases: compliance with our legal obligations, and our legitimate interest in protecting our rights.

Where we rely on our legitimate interests, you can object at any time (see Section 10). We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. AI processing

Apple Intelligence: on your device and Private Cloud Compute

On supported Apple devices running iOS, iPadOS or macOS 27 or later where Apple Intelligence is available, Noota may create the summary of a note with Apple's Foundation Models instead of Anthropic or Google, in one of two ways:

  • On your device: the model runs on your iPhone, iPad or Mac, so the text of the note does not leave your device to be summarized.
  • On Private Cloud Compute: your device sends the text of the note directly to Apple's Private Cloud Compute. According to Apple, Private Cloud Compute uses this data only to fulfill the request, without storing it or making it accessible to Apple.

In both cases, the resulting summary is then saved to your Noota account like any other note.

Anthropic and Google

Every other AI feature, and every summary that Apple Intelligence does not write, is generated by the models of two providers, which we access from our servers through their APIs:

  • Anthropic (Anthropic, PBC), whose Claude models may write some summaries, with their titles and action items, and some quizzes and flashcards, depending on the model we use at the time;
  • Google (Google LLC), whose Gemini models write the other summaries, quizzes and flashcards, read PDFs and scanned or photographed pages, answer your questions in Ask, and link the lines of summaries, answers, flashcards and quiz questions to the passages of your note they come from.

Depending on the feature, we send the provider:

  • the text of your note, such as the transcript of a recording, the text of a document or the transcript of a YouTube video;
  • for PDFs and scanned or photographed pages, the files themselves (the PDF or the page images), so that Gemini can read them directly and produce both a summary and a text version;
  • for Ask, your question together with the relevant parts of your note and your earlier messages in the same conversation; to find the relevant parts, we also create numerical representations (embeddings) of your note's text with the Gemini API;
  • any custom summary instructions you write.

Your audio recordings are never sent to an AI provider.

Under the API terms that apply to our use as a paid customer, Anthropic and Google process this content as our service providers, do not use it to train their models, and may keep it for a limited period solely to detect abuse and comply with legal obligations. Files we send through Gemini's file service are deleted after processing or expire automatically within 48 hours.

Translation and dictation

  • Translation: when you translate a summary, Noota uses Apple's built-in translation feature. Noota does not send the text to its servers for translation; Apple's handling of it is governed by Apple's Privacy Policy.
  • Dictation in Ask: if you dictate a question in Ask using the microphone, your speech is converted to text by Apple's speech recognition service, which may process the audio on Apple's servers under Apple's Privacy Policy. You can type your question instead to avoid this.

YouTube

When you add a YouTube video, our servers retrieve its transcript from YouTube through a network proxy provider. Only the video's identifier is sent, not your account information.

Why this processing is necessary

Turning your content into notes is the core purpose of Noota, so this processing is necessary to provide the Service. If you do not want certain content to be processed by AI, do not create a note from it, or delete the note.

6. Who we share your data with

We share personal data only in the following cases:

  • Service providers that process data on our behalf and under our instructions:
    • hosting and infrastructure: Hetzner (servers) and Cloudflare (website and web app hosting, file storage and delivery);
    • AI: Apple (Private Cloud Compute), Anthropic (Claude API) and Google (Gemini API), as described in Section 5;
    • app services: Google (Firebase) and RevenueCat (subscription management);
    • error monitoring and logging (Sentry and Better Stack) and the network proxy provider we use to retrieve YouTube transcripts.
  • Apple and Google services you use: when you sign in with Apple or Google, make a purchase on the App Store, receive push notifications or use Siri or Apple's translation, Apple or Google receives the data needed for that service and processes it under its own terms and privacy policy.
  • Legal reasons: when required by law or by a valid request from public authorities, or when necessary to protect the rights, safety or property of our users, the public or ourselves, including to prevent fraud and abuse.
  • Business transfers: if we are involved in a reorganization, merger, acquisition or sale of assets, your data may be transferred as part of that transaction and will remain protected by this Privacy Policy. We will inform you before your data becomes subject to a different privacy policy.
  • At your request: when you choose to share or export a note, for example as Markdown or PDF.
  • People you give a share link to: anyone who has a link you created can see the parts of a note you chose, as described under "Share links" below.

We do not sell your personal data and we do not share it for cross-context behavioral advertising.

Access to your content on our systems is limited to people we authorize, and only when needed to provide support, maintain security, investigate abuse or comply with the law.

Share links

You can create a link to a note, its flashcards or one of its quizzes. A link exists only if you create it.

  • What people with the link see: only the parts you choose: the summary, the flashcards, a quiz, and your name if you choose to show it. They never see the full transcript, the recording, your memo, your tags, your other notes or your email address.
  • Not listed: shared pages are marked so that search engines do not index them, and their address is not passed on to other websites.
  • Your control: you can change what a link shows, make it expire, give it a new address or turn it off at any time. Deleting the note turns its links off.
  • Copies: someone signed in to Noota can save a copy of a shared page to their own library. The copy is theirs and is not changed or deleted when you change or turn off your link.
  • Counting views: we count how many times a link is opened. To count each person once, we keep a keyed hash of their IP address in our cache for 30 minutes; we do not store IP addresses.
  • Reports: anyone can report a shared page. A report holds the reason and the explanation given, and the name and email address of the person reporting only if they choose to give them, so that we can confirm we received it and tell them our decision; we do not store their IP address. A page reported from several networks within a day is taken down until we review it, within 7 days, and we may remove pages that break the law or our Terms of Use. We then tell the page's owner why, but not who reported it.

7. International transfers

We and our service providers process personal data in several countries, including Vietnam, the United States and member states of the European Union, which may be outside your country of residence. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that does not offer an adequate level of protection, we rely on appropriate safeguards, such as the standard contractual clauses adopted by the European Commission that are included in our service providers' data processing terms, or the provider's certification under the EU-U.S. Data Privacy Framework. You can contact us for more information about these safeguards.

8. How long we keep your data

  • Account and content: for as long as your account exists. You can delete individual notes at any time.
  • When you delete your account: we permanently delete your account and your content (notes, transcripts, files and generated content) from our active systems without undue delay.
  • Temporary copies: caches used to speed up the Service are deleted automatically, generally within 7 days.
  • Backups: our database backups are kept for a limited period for disaster recovery and are then deleted on a rolling basis. Deleted data may remain in a backup until that backup expires.
  • Server logs: kept for a limited period, then deleted or overwritten.
  • Web sign-in cookies: deleted when you sign out, and otherwise expire 90 days after you last used the web app.
  • Web language cookie: kept for one year, or until you choose "Same as the browser" in Settings.
  • Web appearance cookie: kept for one year, or until you choose "Automatic" in Settings.
  • Guest accounts: kept until you delete them. We may delete guest accounts that have been inactive for a long time.
  • Share links: kept while the link is on. A link you turn off, or that expires, is deleted 90 days later. Reports about a shared page, with any name and email address given, are deleted 180 days after we review them.
  • Purchase records: kept for as long as necessary to meet our legal and accounting obligations. Apple and RevenueCat keep their own records of your purchases under their own policies.
  • Analytics and crash data: kept by Google Firebase according to the retention settings of those services.
  • Website usage events: kept for three months, then deleted automatically.
  • Daily platform counts: kept for 120 days.
  • Correspondence: kept for as long as necessary to handle your request and for a reasonable period afterwards.

We may keep certain data longer when the law requires it or when it is necessary to establish, exercise or defend legal claims.

9. Security

We protect your data with measures such as encryption in transit (HTTPS/TLS), access controls, hashed passwords, private file storage that can only be accessed through authorized links, and storage of sign-in tokens in your device's Keychain or, on the web, in cookies that scripts on the page cannot read. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to security incidents. Where the law requires it, we will notify you and the competent authorities of a personal data breach.

10. Your rights

Depending on where you live (for example, under the EU or UK GDPR, the Brazilian LGPD or the privacy laws of U.S. states such as California), you may have the right to:

  • access the personal data we hold about you and obtain a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict certain processing, or object to it, including processing based on our legitimate interests;
  • receive the data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another provider (data portability);
  • withdraw your consent at any time where processing is based on consent, without affecting processing carried out before the withdrawal;
  • lodge a complaint with a data protection authority, in particular in your country of residence. In France, this is the CNIL (www.cnil.fr).

If you live in France, you can also give us instructions about what should happen to your personal data after your death.

California and other U.S. states: we do not sell your personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your privacy rights.

How to exercise your rights

  • In the app, you can view, edit and delete your notes at any time, and export them one by one (for example with Share as Markdown or Share as PDF).
  • To delete your account and all your data, go to Settings → Delete Account in the app, or Settings → Delete account on the web, and confirm. Deleting your account does not cancel a subscription; cancel it in your Apple Account settings.
  • For any other request, or if you can no longer use the app, email us at support@noota.app, if possible from the email address linked to your account. We may ask for information to verify your identity. We respond within one month, which may be extended by two further months for complex requests where the law allows it. Account deletion requests sent by email are processed within 30 days.

11. Siri, Spotlight and notifications

  • Spotlight and Siri: Noota can make the titles, summaries and tags of your notes searchable in Spotlight and available to Siri suggestions. This index is stored only on your device, and you can turn it off in Settings → Spotlight & Siri → Show Notes. When you use Siri, Apple processes your request under its own privacy policy. If you ask Siri to summarize a note, answer a question about it or create a quiz or flashcards, the request is processed in the same way as the corresponding action in the app.
  • Notifications: if you allow notifications, Noota may notify you, for example when a summary is ready. Push notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging. You can turn notifications off at any time in your device settings.

12. Children

Noota is not intended for children under 13, and we do not knowingly collect personal data from them. If you are under 18, or under the age of legal majority where you live, you may use Noota only with the permission of a parent or legal guardian. Where local law requires the consent of a parent or guardian for a minor to use online services or for the processing of a minor's personal data (for example, under 15 in France), you may use Noota only with that consent. If you believe that a child under 13 has given us personal data, please contact us and we will delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the new version on this page and change the "Last updated" date. If the changes are significant, we will notify you in the app or by other appropriate means before they take effect.

14. Language

This Privacy Policy is written in English and may be translated into other languages. If there is any inconsistency between a translation and the English version, the English version prevails, to the extent permitted by applicable law.

15. Contact us

If you have any questions about this Privacy Policy or want to exercise your rights, contact us at support@noota.app or visit our Support page.