Privacy Policy

1. Introduction

Welcome to Noota ("we," "our," or "us"). Noota is an AI-powered note-taking application designed to help you transcribe, summarize, and organize audio, PDFs, and YouTube videos. We are committed to safeguarding your personal data and maintaining your privacy.

This Privacy Policy explains what data we collect, how it is stored, how we process it, and your choices regarding your personal data when using our iOS application, watchOS application, and website.

2. Core Architecture & On-Device Transcription

To maximize privacy, Noota uses a hybrid on-device and cloud architecture:

• On-Device Transcription: By default, transcription is performed on-device using Apple's Speech framework and local machine learning models (Apple Speech framework on iOS 26+ or CoreML-powered WhisperKit models on iOS 17–18 fallback downloaded to your local device). We do not transmit your raw audio recordings to any third-party AI API for speech-to-text conversion.
• Cloud Synchronization: To support cross-device synchronization and secure backup, Noota securely uploads your notes, metadata, text transcripts, and audio recordings under 50MB to Noota's own private, secure cloud storage. These uploads go to Noota, not to any AI provider.
• Size Limits: Audio files exceeding 50MB and PDF files exceeding 25MB are kept local-only or processed via text-only summaries on the server. They are not uploaded in their raw binary form to Noota cloud storage.

3. Data We Collect

We collect data to provide, synchronize, and improve our services:

4. Third-Party AI Processing

Noota uses third-party AI services to generate summaries, action items, quizzes, flashcards, and to support AI chat features:

• Who receives your data: Google LLC, through the Google Gemini APIs. Gemini is the only third-party AI provider Noota shares your content with. Requests are made through Noota's own servers rather than directly from your device.
• What is sent: Text only. That is the transcript of your recording, the text read out of a document, PDF, or scanned page on your device, the transcript of a YouTube link you paste, and the questions you ask in AI chat. It is used to generate summaries, action items, flashcards, quizzes, translations, and chat answers. Your audio recordings, photos, and original files are never sent to Gemini — text is extracted from them on your device first, and only that text is sent.
• Explicit in-app consent: Before any of this is sent, Noota shows you a screen that names Google Gemini, describes exactly what leaves your device, and links to this policy. You must tap "Agree & Continue" on that screen, which appears during onboarding when you first set up the app, before Noota contacts an AI provider on your behalf. Nothing is sent before you agree. Because turning your recordings into notes depends on this processing, agreeing is required to use Noota's note-taking features.
• Withdrawing consent: To withdraw your consent, stop using the AI features, delete your account under Settings → Delete Account, or email us at support@noota.app. See Section 6.
• No AI model training: We access Google Gemini through a developer API contract. Under those developer terms, the data sent from Noota is not used to train Google's commercial models.
• Equivalent protection: Under those same developer API terms, Google is contractually required to process the content only to return the result we requested, to keep it confidential, and to apply security and data-protection commitments equivalent to those described in this policy. It is not permitted to use the content for advertising or to build user profiles.

5. Storage, Security, and Data Retention

Security: We implement standard security protocols, including HTTPS encryption in transit and secure database access controls. Local tokens are stored using the iOS Keychain (using securely accessible flags that prevent access when the device is locked).

Storage Location: Synced database records are hosted on secure backend servers, and uploaded files are stored using managed cloud infrastructure providers.

Retention Policy:

• We retain your synced data for as long as you maintain an active Noota account.
• Raw audio recordings remain on your local device unless you manually delete them. We do not delete files locally upon successful upload.
• System backups are rotated and automatically expired after a standard retention cycle.

6. User Rights & Account Deletion

Depending on your jurisdiction (such as the European Union under GDPR, or California under CCPA), you have the following rights:

• The right to access, export, or correct your personal data.
• The right to request the deletion of your personal data.
• The right to withdraw your consent to AI processing. Because AI processing is what turns your recordings into notes, withdrawing it means no longer using Noota's note-taking features: stop using them, delete your account as described below, or email us at support@noota.app and we will delete your data.

How to Delete Your Account:

You can delete your account and all associated server-side notes, transcripts, and metadata:

1. In the Noota iOS App, navigate to Settings.
2. Tap Delete Account and confirm.
3. Your account details and synchronized data will be deleted from active systems without undue delay following your deletion request.

Alternatively, or if you no longer have the app installed, you may request deletion by emailing us at support@noota.app. We will process your request within 30 days.

7. International Data Transfers

Some service providers used by Noota may process data in countries outside your country of residence. Where required by applicable law, we implement appropriate safeguards for such transfers.

8. Children's Privacy

Noota is not intended for use by children under the age of 16 (or 13 depending on local jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately and we will delete it.

9. Contact Us

If you have any questions or concerns about this Privacy Policy or wish to exercise your legal rights, please contact us at: