Security and where your data is stored
Last reviewed 9 November 2026
This page answers one question as plainly as we can: where does your data go, who can see it, and how long is it kept? It covers the Notely apps, keyboards and our servers. The legal details are in our Privacy Policy.
The short version: in Privacy Mode with a local model, your recordings, transcripts and summaries stay on your device. Otherwise your audio and text pass through our servers in Sweden to AI providers in the United States. Most of them have zero data retention turned on for Notely and keep nothing. The exceptions are listed below. Synced notes live in Google's EU data centres and, on Apple devices, in your own iCloud. Our servers don't keep your audio, except as described below.
1. Where each kind of data is stored
| Data | Stored where | Run by | Region |
|---|---|---|---|
| Notes, audio and transcripts | On your device | You | Your device |
| iCloud sync (Apple devices, on by default, can be turned off) | Your own iCloud account | Apple | Per Apple |
| Synced notes when signed in (not in Privacy Mode) | Google Cloud Firestore | EU: Belgium and the Netherlands (multi-region eur3) | |
| Sign-in account (name, email, account ID) | Firebase Authentication | United States | |
| Crash reports | Firebase Crashlytics | Google's global infrastructure | |
| Uploaded audio | Not stored. Held in memory on our servers while it is processed | – | Sweden |
| Screen frames (Mac, if you turn on screen reading) | On your Mac, deleted with the note. Sent once to be read, never stored or logged on our servers | You | Your device |
All traffic between the apps and our servers passes through Cloudflare's network, which sees it in transit but does not store it for us.
2. What each AI provider receives and keeps
Our servers forward your audio or text to one of these providers and pass the result back. We have turned on zero data retention with each of them: they process the request and do not store it. The one exception is AssemblyAI, which does not offer zero retention for uploaded files.
| Provider | Receives | How long they keep it | Used for training? | Location | Security reports |
|---|---|---|---|---|---|
| OpenAI | Audio for transcription, text for AI features | Not retained (zero data retention) | No | United States | SOC 2 Type II, ISO 27001: trust.openai.com |
| Groq | Audio for transcription, text for AI features and transcript polishing | Not retained (zero data retention) | No, nothing is stored | United States | trust.groq.com |
| Anthropic | Text for AI features and chat. Screen images, if you turn on screen reading on a Mac | Not retained (zero data retention) | No, by default | United States | SOC 2 Type II, ISO 27001: trust.anthropic.com |
| AssemblyAI (only if you pick an AssemblyAI model) | Audio | Audio: deleted after 24–48 hours. Transcript: 30 days | No, we have opted out | United States | SOC 2 Type II: AssemblyAI trust center |
| TypeSafe AI | Short transcript excerpts | "As long as reasonably necessary", per its privacy policy | No, per its privacy policy | United States | None published |
Retention and training terms are the providers' own and can change. Their linked pages are the authoritative source. We last checked them on the date at the top of this page.
3. Hosting and other services
| Provider | What it does for Notely | Location | Security reports |
|---|---|---|---|
| GleSYS | Hosts our servers | Sweden | ISO/IEC 27001: glesys.se |
| Cloudflare | Routes and protects all traffic to our servers and website | Global network | Compliance resources |
| Google Firebase | Cloud database, sign-in, crash reports | See the table above | ISO 27001, SOC 1, 2 and 3: Firebase privacy and security |
| Apple | iCloud sync, Sign in with Apple, App Store purchases | Per Apple | iCloud data security overview |
| Google Play | Purchases on Android | Per Google | Google's privacy policy |
| Stripe | Payments for the browser extension. We never see card details | Per Stripe | PCI DSS Level 1, SOC 2 Type II: Stripe security |
| Google Workspace | Email to and from us | Per Google | Google Workspace compliance |
Most SOC 2 reports are confidential and are shared by each provider with its own customers or under NDA. The links go to where each provider publishes its certifications.
4. What our own servers keep
- Audio is held in memory while it is processed and then discarded, except the most recent 50 files that a provider rejected as unreadable, which we keep for debugging.
- Screen images are never stored or logged on our servers. Only the text read from them goes back to your Mac.
5. Keeping everything on your device
Turn on Privacy Mode and pick a local model (Whisper or Parakeet). Recording, transcription, speaker labels, summaries and chat then run on your device. On a Mac, screen reading also runs locally with Gemma. The app blocks its cloud requests, and new notes are not written to our cloud database.
Exceptions: the Notely keyboards and the Android floating button always use the cloud. iCloud sync stays on unless you turn it off, and device backups may include the app's files.
6. Encryption
- All traffic between the apps, the website and our servers uses TLS.
- Notes in our cloud database are encrypted at rest by Google and protected by access rules so only your account can read them.
- iCloud data is encrypted by Apple. It is end-to-end encrypted only if you turn on Advanced Data Protection for your Apple account.
7. Certifications
Notely itself does not hold a SOC 2 report or ISO 27001 certification. We are a small company and rely on providers that do, as listed above. If your organisation needs a security questionnaire answered, write to us and we will answer it honestly.
8. Reporting a security issue
If you find a vulnerability, email [email protected]. Please give us a reasonable chance to fix it before you publish it. If a breach affects your personal data, we will tell you and the Swedish data protection authority (IMY) as GDPR requires, normally within 72 hours.