In short
- Your notes live on your iPhone. They reach our servers only if you sign in and turn sync on, or ask Notebook to build something.
- Voice is transcribed on your device by Apple’s speech recognition.
- The Vault is encrypted on your device and is never uploaded or sent to any AI model.
- We do not sell your data, show ads, or use third-party analytics or tracking. This website sets no cookies.
- You can export or delete your cloud data from inside the app at any time.
Who we are
Notebook is made by Noetic Labs (“Noetic”, “we”, “us”). This policy covers the Notebook iOS app, its share extension and widgets, and this website, notebook.noeticlabs.io. When you use Noetic services through Notebook, such as builds, the same commitments apply to the data Notebook sends.
What we collect
If you use Notebook without signing in
Notes, photos, files, recordings and transcripts are stored on your iPhone. We do not receive them. If the app crashes, a crash report may be sent (see Sentry).
If you sign in to a Noetic account
- Account data: your Noetic account identifier and the email address on that account, used to sign you in through id.noeticlabs.io.
- Synced content, only when sync is on: notes and their revisions, kinds and signals, projects, attachments (photos, files, audio) and settings you choose to sync. You can review what syncs in Settings.
- Build requests: when you approve a build, the note text and inputs needed for it, and the results (documents, sites, media, models) that come back.
- Purchases: if you buy credits in the app, Apple processes payment. We receive the transaction details needed to credit your account (product, transaction identifier, date). We never receive your card details.
- Diagnostics: crash reports and error events with the app version and device model. Personal data is excluded by default (no IP address or user identifiers are attached), and network, session and performance tracking are off.
This website
The site is static. It sets no cookies and loads no analytics or third-party scripts. Our host, Cloudflare, processes standard request logs (such as IP address and user agent) to deliver and protect the site. If you email us to join the beta, we receive your email address and what you write.
What stays on your device
- Vault. Vault items are encrypted with AES-256-GCM on your iPhone. The key is held in the iOS Keychain and released only with Face ID, Touch ID or your passcode. Vault items are never synced, uploaded to Noetic, classified, searched or sent to an AI model.
- Secret scan. Notebook checks new notes for things that look like passwords, keys or card numbers on the device, before anything is synced or sent, and offers to move them to the Vault.
- Speech. Recordings are transcribed with Apple’s on-device speech recognition. Audio is sent to us only as an attachment, when sync is on.
- Reminders are scheduled as local notifications on your device.
How we use it
We use your data to provide Notebook: to sync it between your devices and clients, to sort notes, to run builds you approve, to process purchases, to keep the service secure, and to fix crashes. We do not sell personal data, use it for advertising, or share it for cross-context behavioural advertising. We do not use your notes to train AI models.
Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (sync, sorting, builds, purchases); our legitimate interests in securing and fixing the service (diagnostics, abuse prevention); and your consent where we ask for it (for example, turning on sync). You can withdraw consent at any time in Settings.
AI processing
When sync is on, notes (never Vault items) may be sent to AI models to classify them, split brain-dumps into separate notes, find related notes, and suggest what an idea could become. When you approve a build, the inputs for it are sent to the models that do the work. We use OpenAI and Anthropic Claude through Amazon Web Services (Amazon Bedrock) for sorting and generation. Their terms with us do not allow them to train on your content.
AI output can be wrong. Check anything important before you rely on it.
Service providers
We share personal data only with providers that process it on our behalf, under contract, to run Notebook:
| Provider | Purpose | When |
|---|---|---|
| Cloudflare | Hosting, API, file storage (R2), security | Sync, builds, this website |
| Supabase | Database for accounts and synced notes | Signed in with sync on |
| Sentry | Crash and error reports | When the app crashes or hits an error |
| Apple | App distribution, TestFlight, in-app purchases (StoreKit) | Install, beta feedback, purchases |
| OpenAI | Sorting and generation | Sync on, or a build you approve |
| Amazon Web Services (Bedrock, Anthropic Claude) | Sorting and generation | Sync on, or a build you approve |
We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or acquisition, in which case this policy continues to apply.
Keys you connect
Some builds use providers through API keys you connect to your Noetic account: Replicate, Hugging Face, Runway and Meshy. These are used only when you connect a key and approve a build that needs it. The inputs for that build go to the provider under your own account with them, and their privacy policy applies. You can disconnect a key at any time.
Retention
Synced content is kept while your account is active and until you delete it. When you delete cloud data, records are removed immediately and stored originals are cleaned up shortly after; minimal records may remain briefly so that late uploads can be cleaned up too. Crash reports are kept for up to 90 days. Purchase records are kept as long as tax and accounting law requires. Beta emails are kept for the length of the beta.
Export, deletion and your rights
- Export: Settings → Cloud data → Export creates a complete, checksummed copy of your Notebook cloud data, including original files.
- Delete cloud data: Settings → Cloud data → Delete removes your Notebook cloud data. Local notes on your iPhone stay until you delete the app or the notes.
- Delete your account: email rishi@noeticlabs.io from your account email and we will delete your Noetic account and its data within 30 days.
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, to portability, and to complain to your data protection authority. California residents have the rights in the CCPA, including to know and to delete, and we do not sell or share personal information. We will not treat you differently for using these rights. Contact us to use any of them.
Security
Data is encrypted in transit (TLS) and at rest by our providers. Access to accounts uses short-lived tokens, and each request is checked against your account. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
International transfers
Noetic Labs and our providers process data in the United States and other countries. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
Children
Notebook is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it. Where local law sets a higher age for consent, you must meet it to use sync and builds.
Changes
We will update this policy as Notebook changes, and change the date above. If a change is material, we will tell you in the app before it takes effect.
Contact
Noetic Labs · rishi@noeticlabs.io