App Privacy Policy
This Privacy Policy explains how noteself processes personal data when you use the noteself iOS app, contact support or visit noteself.co.
1. Controller
The controller responsible for the processing described in this Privacy Policy is:
Email:
2. What noteself does
noteself lets you write a note and send it by email to your own verified inbox.
Depending on your plan and settings, noteself also provides sent-note history, synchronization across devices, additional verified inboxes and customization options.
To provide these features, noteself processes information including email addresses, note content, account information and sending activity.
noteself does not sell personal data, use personal data for targeted advertising or track users across apps or websites.
The noteself app does not contain third-party advertising or marketing-tracking SDKs.
3. Account and authentication
To use the sending service, you provide and verify an email address.
noteself processes:
- your email address
- an internal account identifier
- authentication and verification information
- authentication events required to operate and secure your account
Email verification uses a six-digit code sent to the address you provide.
Your verified email address is required because it is the destination for notes you send through noteself.
Authentication and backend account services are provided through Supabase.
The legal basis for this processing is Article 6(1)(b) GDPR because the processing is necessary to create and operate your account and provide the service you requested.
Security-related processing may additionally be based on Article 6(1)(f) GDPR. Our legitimate interest is protecting accounts, preventing abuse and maintaining service security.
4. Notes you send
When you send a note, noteself processes:
- the text of your note
- your verified destination email address
- any additional verified inboxes selected for that note
- the email subject
- the time of the send
- an identifier associated with the send
- information required to process delivery
The note content is transmitted to the noteself backend so that an email can be created and delivered to the verified inboxes you selected.
For Free users, noteself does not provide server-synchronized note history. Notes remain stored locally on your device, apart from processing required for sending and any temporary delivery processing.
Information transmitted for email delivery can continue to be retained by the email-delivery provider as described below.
The legal basis is Article 6(1)(b) GDPR because this processing is necessary to provide the sending service you requested.
5. History and sync
Pro provides sent-note history and synchronization across devices.
When server-side history or sync is active, noteself stores information necessary to provide those features.
This can include:
- note content
- date and time
- verified destination addresses
- send and delivery information
- identifiers connecting notes to your account
Server-side note history is used to display your sent notes and synchronize them across devices associated with your account.
The legal basis is Article 6(1)(b) GDPR because this processing is necessary to provide the requested Pro features.
6. Additional verified inboxes
Pro allows you to add additional email addresses that you control.
Each additional address must be verified before it can receive notes.
noteself processes:
- the additional email address
- verification status and related information
- default destination information
- the To and CC selection for individual notes
Confirmed additional inboxes can receive copies through CC.
You can change the selected To and CC addresses for an individual note.
The legal basis is Article 6(1)(b) GDPR.
7. Email delivery
noteself uses Resend, operated by Plus Five Five, Inc., to deliver transactional email.
This includes verification emails and emails containing notes sent through noteself.
For this purpose, Resend receives information including:
- destination email addresses
- email subjects
- note content
- technical delivery information and logs
Resend stores customer email and log data in the United States.
On Resend's standard plans, email and log data is retained for 30 days. Resend states that backups persist for an additional seven days.
Resend processes personal data on our behalf under its Data Processing Addendum.
Transfers of personal data to the United States are protected through the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.
Resend uses subprocessors to operate and secure its service. Resend states that a small sample of email content may be processed on dedicated infrastructure for trust and safety purposes.
Resend states that ordinary email content sent through its Emails API is not sent to Anthropic and that customer content is not used to train or fine-tune AI models.
8. Free allowance and sending information
The Free plan includes 10 sends in total.
The Free allowance does not reset monthly.
noteself processes limited sending information to operate this allowance, monitor delivery status and protect the service against abuse.
Depending on the final backend implementation, this information can include:
- internal account and send identifiers
- sending status
- timestamps
- information needed to count Free sends
- security and abuse-prevention information
The legal basis for providing and administering the service is Article 6(1)(b) GDPR.
Security and abuse-prevention processing may additionally be based on Article 6(1)(f) GDPR.
9. Data stored on your iPhone
noteself stores information locally on your iPhone.
Depending on how you use the app, this can include:
- drafts and notes
- locally available history
- notes waiting to be sent
- verified inbox information
- sound and theme settings
- confirmation preferences
- onboarding and app state
A note can remain stored locally when it cannot currently be sent, for example because your iPhone is offline.
Locally stored information is transmitted to the noteself backend when required to provide a feature you request, such as sending a note or synchronizing history.
Removing the app deletes information stored in the app's local container according to iOS behavior.
Information previously synchronized to the server or delivered by email is not necessarily removed by uninstalling the app.
10. Pro subscriptions
Pro subscriptions are purchased and managed through Apple's App Store.
Apple handles billing and payment information. noteself does not receive your full payment-card details.
noteself uses RevenueCat to manage subscription entitlements.
Subscription-related processing can include:
- an internal app user identifier
- subscription and entitlement status
- transaction identifiers
- product and purchase information provided by Apple
- technical information necessary to verify subscription access
The legal basis is Article 6(1)(b) GDPR.
Apple processes App Store purchases and Apple Account information under Apple's own privacy terms.
RevenueCat processes subscription-related information under its applicable data-processing terms.
11. Support
If you contact our support by email, we process your email address and the information contained in your message to answer your request.
The legal basis is Article 6(1)(b) GDPR when the communication relates to providing the service you requested.
For general support, security and service administration, processing may be based on Article 6(1)(f) GDPR.
Our legitimate interest is providing support, resolving technical issues and protecting the service.
Support correspondence is retained for as long as necessary to handle the request and document its resolution.
Where correspondence is relevant to legal claims or statutory obligations, it may be retained for the applicable period.
12. Service providers and international transfers
Supabase
noteself uses Supabase for authentication, database services and backend functions.
The noteself project is configured in the Central EU region in Frankfurt, Germany.
Supabase processes data under its Data Processing Addendum.
Supabase may use personnel and subprocessors outside the European Economic Area for security, support and operational purposes. Appropriate transfer safeguards apply where required.
Resend
noteself uses Resend for transactional email delivery.
Resend processes recipient addresses, message content and delivery information in the United States as described in Section 7.
RevenueCat
noteself uses RevenueCat to manage Pro subscription entitlements.
RevenueCat processes identifiers and subscription-related information required to provide this service, subject to the applicable contractual and privacy arrangements.
Apple
Apple provides the App Store, StoreKit, subscription billing and related platform services.
Apple processes personal data under its own terms and privacy policy.
Vercel
noteself.co is hosted by Vercel Inc.
When you visit noteself.co, Vercel processes technical information necessary to deliver and secure the website.
This can include your IP address, browser and device information, requested URLs, timestamps, referrer information and technical logs.
The legal basis for this website processing is Article 6(1)(f) GDPR.
Our legitimate interest is providing a secure and technically functional website.
Support email provider
Support correspondence is processed through the email infrastructure used for our support address.
13. Website cookies and analytics
noteself.co does not use advertising tools, marketing trackers or analytics scripts.
The website does not set non-essential cookies for advertising or analytics.
Technical storage or access strictly necessary to deliver and secure the website may be used by its hosting infrastructure.
If non-essential cookies or similar tracking technologies are introduced in the future, the relevant consent and transparency requirements must be assessed before activation.
14. Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or where a longer period is required by law.
In particular:
- account information and verified addresses are retained while needed to operate your account
- synchronized note history is retained while required to provide the history and sync features, subject to the final deletion and subscription rules
- quota and send information is retained for the period required to administer the allowance and protect the service
- Resend retains email and log data for 30 days on its standard plans
- Resend states that backups persist for seven days
- subscription records are retained for the applicable subscription-administration and legal requirements
- local data remains on your device until removed through app functionality or iOS behavior
- support correspondence is retained for the necessary support, legal or claims-related period
- website hosting and security information is retained according to the configured hosting and security retention arrangements
Data held in protected service-provider backups may remain until those backups are overwritten or deleted according to the provider's retention schedule.
15. Account deletion
You can request account deletion directly in noteself through the account-deletion function.
Following successful completion of account deletion, noteself removes account-linked personal data from its active backend systems in accordance with the implemented deletion process, except where further retention is legally required or supported by another valid legal basis.
This includes account information and synchronized note data associated with the account, to the extent covered by that process.
Local noteself account state is reset after the backend has confirmed successful deletion.
Data already processed by service providers can remain for the applicable provider retention periods.
For example, emails and delivery logs already processed by Resend can remain until their retention periods expire.
Deleting your noteself account does not cancel an App Store subscription.
If you have an active Pro subscription and do not want future charges, cancel your subscription through your Apple Account.
16. Your rights under the GDPR
Where the GDPR applies, you have the right, subject to applicable legal requirements, to:
- request access to your personal data
- request correction of inaccurate personal data
- request deletion of your personal data
- request restriction of processing
- object to processing based on legitimate interests
- receive personal data you provided in a portable format
- withdraw consent at any time where processing is based on consent
Withdrawing consent does not affect processing that was lawful before withdrawal.
To exercise your rights, contact us using the details in the Imprint.
You also have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for the controller is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
17. United States privacy rights
Depending on the U.S. state in which you live, applicable privacy law may provide additional rights regarding your personal information.
These can include rights to request access, correction, deletion or portability and rights relating to certain uses or disclosures of personal information.
noteself does not sell personal information.
noteself does not share personal information for cross-context behavioral advertising.
noteself does not use personal information for targeted advertising.
noteself does not use personal information for profiling that produces legal or similarly significant effects.
You can submit a privacy request using the contact details in the Imprint.
We may need to verify your identity before completing a request.
18. Automated decision-making
noteself does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.
19. Changes to this Privacy Policy
We may update this Privacy Policy when the service, our providers or applicable legal requirements change.
The current version will be published on this page with its current last-updated date.