Privacy Policy

Who we are

NotePal (“NotePal,” “we,” “us,” or “our”) provides an application and website that turn lectures, audio, PDFs, YouTube links, and text into structured study notes, mind maps, quizzes, and flashcards. This policy applies to our iOS app, our web app, and our website at notepal.net.

This policy is written to satisfy the Apple App Store and Google Play disclosure requirements as well as the GDPR, UK GDPR, and CCPA/CPRA. The data practices described here match the privacy labels shown on our App Store and Google Play store listings.

Data we collect

We collect only what we need to run the service. Specifically:

Account & contact data

• Email address and name — to create your account, sign you in, and send service messages. We support sign-in with Google and Apple; when you use them we receive your email and basic profile from that provider.
• Authentication identifiers — a user ID and session tokens managed through Firebase Authentication.

Content you provide

• Sources you upload or link — audio recordings, audio/PDF files, YouTube URLs, and pasted text that you submit to generate notes.
• Generated study material — the notes, transcripts, mind maps, quizzes, and flashcards produced from your sources, plus edits and study progress (e.g. flashcard review state).

Usage & diagnostic data

• Product analytics — events such as features used, screens viewed, and actions taken, collected through PostHog to understand and improve the product.
• Device & technical data — approximate region, device/browser type, app version, and crash or error logs.

Payment data

• Subscription & billing — when you upgrade to Pro, payments are processed by our payment provider. We receive your subscription status; we never see or store your full card number.

How we use your data

• Provide the service — transcribe your sources, generate notes and study tools, sync them across your devices, and keep you signed in.
• Maintain & improve — fix bugs, monitor performance, and understand which features help students learn.
• Communicate — send account, security, and service notices, and respond to your support requests.
• Billing — manage your subscription and prevent payment fraud.
• Safety & compliance — enforce our Terms, prevent abuse, and meet legal obligations.

To generate your study material we send the content of your sources to AI processing providers strictly to produce your output. That content is processed under contract and is not used to train their general models.

Data linked to you & tracking

Consistent with Apple’s App Tracking Transparency framework, NotePal does not track you across other companies’ apps and websites, and does not share your data with data brokers. The account, content, usage, and diagnostic data above are linked to your identity because they belong to your account; they are used only to operate and improve NotePal.

Legal bases for processing (GDPR / UK GDPR)

• Contract — to deliver the service you sign up for.
• Legitimate interests — to secure, maintain, and improve the product.
• Consent — where required, e.g. certain analytics; you can withdraw it at any time.
• Legal obligation — to comply with applicable law.

How we share data

We share data only with the service providers that help us run NotePal, when required by law, or in a business transfer. We never sell it. Categories of recipients:

Service providers (sub-processors)

• Firebase (Google) — authentication and account management.
• AI processing providers — transcription and generation of your notes, mind maps, quizzes, and flashcards.
• PostHog — product analytics.
• Payment processor — subscription billing.
• Cloud hosting & storage — to run the service and store your content.

Each provider is bound by contract to protect your data and use it only to provide their service to us.

Data retention

We keep your account and content for as long as your account is active. When you delete a source or note, it is removed from your library and purged from active systems shortly after, subject to short-lived backups. When you delete your account, we delete your personal data within 30 days, except where we must retain limited records to meet legal, tax, or fraud-prevention obligations.

Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted and authenticated. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a breach as required by law.

Your rights & choices

Depending on where you live, you may have the right to:

• access, correct, or export your personal data;
• delete your data (“right to be forgotten”);
• object to or restrict certain processing;
• withdraw consent at any time; and
• not be discriminated against for exercising these rights (CCPA/CPRA).

To exercise any right, email privacy@notepal.net. You also have the right to complain to your local data protection authority.

Account & data deletion

You can delete your account at any time from Account → Delete accountin the app, or by emailing privacy@notepal.net. Deleting your account permanently removes your sources, notes, and study material as described under Data retention. For step-by-step instructions and exactly what is removed, see Delete your account & data.

Children’s privacy

NotePal is intended for students aged 13 and older (16 in some regions). We do not knowingly collect personal data from children below that age. If you believe a child has provided us data, contact us and we will delete it.

International data transfers

We may process and store data in countries other than yours, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Automated access & fair use

NotePal is a personal study tool. To keep it fast, fair, and affordable for students, automated access is not permitted. You may not use bots, scrapers, crawlers, headless browsers, or any automated means to access, create accounts on, or extract data from the service, and you may not share or resell access. We may rate-limit, throttle, suspend, or terminate accounts that we reasonably believe are operated by bots or used to scrape or abuse the service. See our Terms of Service for the full Acceptable Use policy.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the app or by email. Continued use after changes take effect means you accept the updated policy.

Contact us

Questions about this policy or your data? Email us at privacy@notepal.net. We’re the data controller for the personal data described here.