Privacy Policy
Effective 30 October 2026 · Version 2.0
This policy explains what information Notely collects, why, and what you can do about it. It applies to the Notely apps for iPhone, iPad, Mac and Android, the Notely keyboards, the Notely browser extension and this website. If anything is unclear, write to [email protected].
The short version: what leaves your device depends on how you transcribe. With cloud transcription, the default, your audio and text pass through our servers to AI providers. We do not store the content of your AI requests or your audio on our servers. In Privacy Mode, recordings and files transcribed with a local model never leave your device for transcription, and AI runs on your device, with the exceptions listed under “Privacy Mode”. We do not sell your data or show ads, and your notes are not end-to-end encrypted when they sync to our cloud database.
1. Who we are
Notely is developed and operated by State Creative, based in Stockholm, Sweden (“Notely”, “we”). We are the data controller for the personal data described in this policy.
Contact for privacy matters: [email protected]. General support: [email protected].
2. What lives where
What we process depends on the transcription method you choose and whether you are signed in.
| Cloud transcription (default) | On-device transcription | Privacy Mode | |
|---|---|---|---|
| Your audio | Sent through our servers to an AI provider for transcription | Stays on your device with a local model. Device speech recognition may use Apple or Google | Stays on your device with a local model. Device speech recognition may use Apple or Google |
| Summaries, chat and other AI text | Sent through our servers to an AI provider | Sent through our servers to an AI provider | Generated on your device |
| Notes in our cloud database (signed in) | Yes | Yes | No. New notes are not written to it |
| iCloud sync on Apple devices | On by default, can be turned off | On by default, can be turned off | On by default, can be turned off |
On-device transcription uses your device's speech recognition or a local model such as Whisper or Parakeet. Speaker labels are computed on your device.
3. Privacy Mode
In Privacy Mode, audio you record or import and transcribe with a local model (Whisper or Parakeet) is not sent anywhere for transcription. Summaries and chat run on your device, the app blocks its cloud transcription and AI requests, and new notes are not written to our cloud database. Notely's servers and AI providers do not receive this content.
Some things can still leave your device:
- Keyboard dictation. The Notely keyboards and the Android floating button always send your speech to our servers and AI providers. Privacy Mode does not apply to them.
- Device speech recognition. If you choose this method instead of a local model, your phone's speech service does the work and may send audio to Apple or Google.
- iCloud sync. It stays on by default and copies your notes, but not your audio, to your own iCloud account. You can turn it off in the app.
- iCloud Drive copy. If you turn on this Premium option, audio and transcripts are copied to your iCloud Drive.
- Device backups. Your iCloud or Android backup may include the app's files, depending on your device settings.
Encryption. Privacy Mode does not add end-to-end encryption. Data kept only on your device is not transmitted at all. Data synced to iCloud is encrypted by Apple and is end-to-end encrypted only if you turn on Advanced Data Protection for your Apple account; even then the note's file name, duration, language and custom prompt are not.
4. What we collect
- Account details: if you sign in with Apple or Google, your name, email address and account identifier. We never receive your Apple or Google password. You can use the app without signing in.
- Audio you transcribe: recordings, uploaded files, audio from links you submit, when you use cloud transcription, and speech dictated through the keyboards, which always use the cloud. Recordings may contain personal data about you and other people.
- Notes and text: transcripts, summaries, meeting notes, notebook pages, chat messages, custom prompts and file names. Signed-in notes outside Privacy Mode are stored in our cloud database.
- Keyboard text: the keyboards send your dictated audio and, when you use the edit feature, the text you selected and your instruction. They do not send what you type by hand.
- Android floating button: if you turn it on, the Accessibility Service is used to show the button and insert dictated text into the focused text field.
- Purchases: subscription plan, status and expiry dates, purchased minutes, and promo code redemptions. Apple, Google or Stripe handles the payment and we do not see your card details.
- Usage data: minutes and requests used per day and month, and which modes and models you used.
- Technical data: a random device identifier created by the app, IP address, approximate location derived from it (country, city, timezone), device model, operating system, app version and request details.
- Crash reports: Firebase Crashlytics collects stack traces, device and app details and error context when something fails.
- Messages you send us: feedback, survey answers, support emails and your email address if you provide it.
Our server logs can contain your content. For cloud AI features we store the text you submit, the AI's response, chat history and translations, linked to the request's IP address and device identifier. Application logs can contain excerpts of transcripts. An uploaded audio file that a provider rejects as unreadable may be saved for debugging; we keep only the most recent 50 such files. Other audio is held in memory during processing and is not saved on our servers. The operator can access these logs to run and improve the service.
This website uses Google Analytics, which sets cookies and records the pages you visit, your IP address and device details, and loads fonts from Google Fonts, which sends your IP address to Google. It also stores preferences in your browser. If you open a campaign link, we record the click with your IP address and browser details.
5. What we do not do
- We do not sell personal data and we do not show advertising.
- We do not train our own AI models on your content. See “Who we share data with” for how our providers treat it.
- The app does not request your location, contacts or calendar. Location is only approximated from your IP address.
- The app does not listen in the background unless you have started a recording or dictation.
6. Why we use your data and on what legal basis
Under the EU General Data Protection Regulation (GDPR) we need a legal basis for each use of personal data:
| Purpose | Data | Legal basis |
|---|---|---|
| Transcribing, summarising, chatting and syncing your notes | Audio, notes and text, account details | Performance of a contract (Art. 6(1)(b)) |
| Selling subscriptions and applying usage limits | Purchases, usage data, device identifier | Performance of a contract (Art. 6(1)(b)) |
| Keeping the service secure, preventing abuse, debugging and improving quality | Technical data, server logs, crash reports | Legitimate interest (Art. 6(1)(f)) |
| Answering support requests and feedback | Whatever you send us | Legitimate interest (Art. 6(1)(f)) |
| Emailing subscribers for feedback or about a cancelled plan | Email address, name, plan | Legitimate interest (Art. 6(1)(f)); you can opt out at any time |
| Inviting you to user tests and interviews | Email address, survey answers | Consent (Art. 6(1)(a)) |
| Website statistics | Analytics data | Legitimate interest (Art. 6(1)(f)) |
| Accounting and complying with law | Purchases and as required | Legal obligation (Art. 6(1)(c)) |
8. International transfers
Our servers are in Sweden. Where a provider processes data outside the EU/EEA, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.
9. How long we keep data
| Data | Retention |
|---|---|
| Notes on your device and in your iCloud | Under your control, until you delete them |
| Notes in our cloud database | Until you delete them or we delete your account at your request |
| Uploaded audio | Only while it is being processed. Rejected files saved for debugging are replaced as new ones arrive |
| Purchase records | Accounting records are kept for 7 years, as Swedish law requires |
| Support emails and feedback | As long as needed to handle your request |
| Website analytics | According to our Google Analytics retention settings |
To delete your account and the data linked to it, email [email protected].
10. Security
- Traffic between the apps, this website and our servers is encrypted with TLS.
- Notes in our cloud database are protected by Firebase access rules and encrypted at rest by Google, but they are not end-to-end encrypted.
- iCloud sync is encrypted by Apple. It is end-to-end encrypted only if you turn on Advanced Data Protection for your Apple account, and even then the note's file name, duration, language and custom prompt are not.
- Access to our servers and logs is restricted to the operator.
- If we learn of a breach that affects your personal data, we will notify you and the supervisory authority as required by GDPR, normally within 72 hours.
11. Your rights
If you are in the EU/EEA or the UK you have the following rights, and we extend them to everyone:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data. Email us; you can also delete individual notes in the app.
- Export your data. Notes can be exported from the app, and on request we provide a machine-readable copy of your account data.
- Object to or restrict processing based on legitimate interests.
- Withdraw consent where processing is based on consent.
- Complain to a supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY), imy.se. You may also complain to the authority where you live.
California residents also have the right to know, delete and correct their personal information and not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in California law.
To exercise a right, email [email protected]. Because you can use Notely without an account, include your device identifier or the email address on your account so we can find your data. We respond within one month, free of charge unless a request is manifestly unfounded or excessive.
12. Children
Notely is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as Notely changes. The effective date at the top shows the current version. For material changes, we will notify you in the app or by email before they take effect. Earlier versions are available on request.
14. Contact
Privacy questions and requests: [email protected]
General support: [email protected]
State Creative, Stockholm, Sweden