Privacy policy

1. Who we are

AtanNote is operated by AtanNote, a company registered in the United States ("we", "us"). This policy covers the AtanNote apps for iOS and Android, the web app at atannote.ai, and the Chrome extension (together, the "Service"). Your data is stored in Singapore (section 6).

2. What we collect

2.1 Your account

• Email address — from sign-up, Google Sign-In or Sign in with Apple.
• Display name and an optional profile photo. The photo is served from an unlisted link so the apps can show it; do not upload a photo you would not want seen by someone who has that link.
• Sign-in session tokens, managed by our authentication provider.

2.2 Recordings and audio

When you record or import audio, the file is uploaded to our storage and sent to our AI provider to be turned into text (section 5). We keep the audio so you can replay it and re-transcribe it. How long we keep it is in section 7.

2.3 Notes and what AI makes from them

• Transcripts, refined notes, summaries, outlines, action items and version history.
• Search vectors ("embeddings") derived from your notes, so search and Ask AI can find them.
• Ask AI conversations: your questions and the answers. Images shown in answers are web search results, not files from your device.
• Tasks, folders, tags and the writing styles you save.
• Files you import (PDF, Word, YouTube links) and photos you scan are processed and the extracted text is saved; the original document or photo is not stored. Audio you import is stored like a recording.

2.4 Preferences

Transcription language, writing style, use case chosen at onboarding, app language, theme, and reminder settings.

2.5 Devices and usage

• A device identifier we generate, the device model, app version and platform, used to enforce per-plan device limits and to send push notifications.
• Product analytics: which features are used, onboarding steps completed, session length, device type and operating system. Analytics events never contain the text of your notes; search analytics record the length of a query, not the query.
• Search queries and which notes matched are logged so we can improve search; these are deleted after 30 days (section 7).
• Diagnostics for transcriptions that failed, so we can fix the pipeline. This includes the failed audio segment, kept 14 days.

2.6 Advertising measurement

On the website we use the Meta Pixel and the TikTok Pixel to measure our own ads. In the mobile apps we use AppsFlyer to learn which ad an install came from; on iOS the advertising identifier is used only if you allow tracking in the system prompt. These tools receive events like "signed up" or "started checkout" and, on mobile, the advertising identifier. They never receive your notes. On the website you can decline all of this with one click (section 8).

2.7 Payments

Payments are processed by Apple, Google Play or Stripe. We never see or store your full card number. We keep your plan, billing dates and, for Stripe, a customer reference. If you pay by bank transfer and upload a receipt, that image is stored privately in your account. Invoices and payment records are kept for the period tax law requires, even after you delete your account, without any of your notes.

2.8 Feedback and support

Ratings, messages and the screen you sent them from, linked to your account until you delete it.

2.9 Device permissions

• Microphone — to record.
• Camera and photo library — only when you choose to scan text from an image or set a profile photo.
• Notifications — reminders, and a persistent notice while a recording runs in the background on Android.

We do not ask for your location, contacts, calendar or health data.

3. How we use it

• To transcribe, refine, summarise and search your notes, and to answer your questions about them.
• To run your account, plan, device limits and payments.
• To send reminders and service messages (for example: deletion scheduled, receipt of deletion).
• To fix bugs and improve the Service using aggregate usage and failure diagnostics.
• To measure our own advertising, with your consent where the law requires it.

We do not use your recordings, notes or conversations to train AI models, ours or anyone else's.

4. Legal basis (EEA / UK)

• Contract — providing the Service you signed up for.
• Legitimate interests — security, fraud prevention, fixing failures, aggregate analytics.
• Consent — microphone and camera access, advertising measurement, product analytics where you are asked.
• Legal obligation — tax and accounting records.

5. Who processes your data

Every company below receives only what it needs for its job. None of them may use your content for their own purposes or to train models.

We do not sell personal data. We do not share your notes with advertising networks or data brokers.

6. Where your data lives, and how it is protected

Your data is stored in Singapore on Supabase, encrypted at rest (AES-256) and in transit (TLS 1.2 or newer). Access to your own rows is enforced by the database itself; server functions run with the least access they need.

Who can see your notes: only you. No one at AtanNote can open your notes, chats or recordings; you are the only person who can access them. Our staff tools show dates, sizes and status, never the text.

On your phone, AtanNote keeps a local copy of your notes and recent recordings so the app works offline. This copy is protected by your phone's own security (screen lock, file encryption) and is excluded from Android backups. [From DATE the local copy and your sign-in tokens are additionally encrypted by the app.]

No system is perfectly secure. If we ever learn of a breach affecting your data we will tell you without undue delay.

7. How long we keep things

• Notes, chats, embeddings — as long as your account exists. You can delete any note or chat at any time.
• Audio recordings — kept until you delete the note. In Settings → Data & privacy you can choose a keep period instead (from "delete right after transcribing" to 90 days); audio older than that is then removed in a nightly clean-up and the transcript and note stay. If you never choose, nothing is removed. Voice memos still waiting to be transcribed are never deleted automatically.
• Failed transcription segments — 14 days, then deleted.
• Search logs — 30 days, then deleted.
• Product analytics — deleted with your account. Firebase keeps its aggregate copy for up to 14 months.
• Account deletion — when you delete your account you get 7 days to change your mind (signing in again keeps it). After that, everything above is removed, including your recordings and the search index, and you receive an email listing what was deleted. Database backups are purged within 7 days. Invoices and payment records are kept without your notes for as long as tax law requires.

8. Your controls

• Delete your account — from Settings → Data & privacy, or at atannote.ai/delete-account.
• Export — export any note as text, Markdown, Word or PDF, or export your whole account as one file from Settings → Data & privacy on the web (notes, chats, to-dos, and 24-hour links to your recordings). We email you each time an export is downloaded.
• Advertising and analytics on the website — the banner on your first visit lets you choose "Essential only"; "Privacy choices" in the footer lets you change your mind.
• Ad tracking on iOS — decline the system prompt and the advertising identifier is never used.
• Shared notes — a shared link works for anyone who has it; you can revoke it at any time from the note.
• Your rights — depending on where you live: access, correction, deletion, export, restriction and objection. Write to support@atannote.ai and we answer within 30 days.

9. International transfers

Your data is stored in Singapore and processed by the providers in section 5, some of which are in the United States. For users in the EEA and UK we rely on Standard Contractual Clauses with those providers.

10. Requests from authorities

AtanNote is a United States company and your data is stored in Singapore. We disclose user data only when legally required by valid process that binds a US company, and then only the minimum. Requests that do not meet that bar are declined, wherever they come from. When we are required to disclose, we tell you unless a court forbids it. If your situation needs a more specific answer, write to support@atannote.ai and a person will reply.

11. Cookies

Essential cookies keep you signed in and remember your theme. Advertising measurement cookies (Meta, TikTok) and product analytics (Firebase) are set only after you accept them on the banner, or, outside the EEA and UK, until you decline them there. Plausible uses no cookies. We do not respond to "Do Not Track" signals; the banner is the control.

12. Children

AtanNote is for people aged 13 and over (16 in the EEA). If you believe a child has given us personal data, email support@atannote.ai and we will delete it.

13. California

California residents may ask what we collect, ask for deletion, and opt out of "sharing" for cross-context advertising. We do not sell personal information. The website banner is the opt-out for advertising measurement; for anything else, email us.

14. Changes

When we change how we handle your data we update this page, note the date at the top, and, for material changes, tell you in the app or by email before they take effect.

15. Contact

Privacy questions and security reports: support@atannote.ai.