Privacy Policy

1. Who we are

NoteCat ("NoteCat", "we", "us", or "our") is an AI note-taking application that helps you capture voice memos, import documents, PDFs, links, and typed text, and turn them into transcripts and summaries. NoteCat is operated by Tupandas. This Privacy Policy explains what data we collect when you use the NoteCat mobile app and related services (together, the "Service"), how we use it, and the choices you have.

2. Scope

This policy applies to information processed when you download, install, register for, or use NoteCat on any supported platform. It does not apply to third-party services that you choose to connect to the app, which are governed by their own privacy policies.

3. Information we collect

3.1 Information you provide

• Account information. When you create an account or sign in, we collect identifiers such as your email address, display name, profile picture, and a unique user ID. If you sign in with Apple or Google, we receive only the basic profile fields you authorize.
• User content. Notes, voice recordings, transcripts, summaries, flashcards, quizzes, projects, tags, imported documents (PDFs, DOCX, etc.), photos, links, and any text you type into the app.
• Microphone audio. When you start a recording or live transcription, we capture audio from your device's microphone. Audio is processed only after you explicitly start a recording.
• Files and media. When you import a document, link, image, or file, we collect the file content and metadata (file name, size, type) so we can store, transcribe, or summarize it.
• Camera and photo library. If you choose to take a profile photo or attach an image, we access your camera or photo library only for that action.
• Communications. When you contact support, we collect the messages, attachments, and contact details you provide.

3.2 Information collected automatically

• Device & app data. Device model, operating system and version, app version, language, time zone, country, screen size, locale, install source, and a randomly generated installation identifier.
• Usage data. Events such as screens viewed, features used, recordings started, errors, crashes, session duration, and similar product analytics.
• Subscription & purchase data. Subscription status, plan, transaction identifiers, store country, and renewal/cancellation events received from the App Store, Google Play, or our subscription provider. We do not receive your full payment card number.
• Diagnostics. Crash logs, performance traces, and stack traces (with personal content stripped where reasonably possible).
• Approximate location. We may infer your country/region from your IP address. We do not collect precise GPS location.

3.3 Information from others

• Sign-in providers. If you sign in with Apple or Google, we receive the profile fields you authorize.
• Attribution & measurement partners. We may receive non-content signals (such as install attribution and campaign IDs) to understand how users discovered NoteCat.

4. How we use information

• To provide the core Service: storing your notes, syncing across devices, transcribing audio, generating summaries, flashcards and quizzes, organizing projects, and exporting content.
• To authenticate your account and keep it secure.
• To process subscriptions, manage entitlements, prevent fraud, and handle refunds.
• To debug issues, monitor performance, and improve features.
• To measure marketing campaigns and understand which channels drive new installs (where permitted).
• To communicate with you about your account, important updates, security notices, and (with your consent where required) product news.
• To comply with legal obligations and enforce our Terms of Use.

We do not sell your personal information, and we do not use the content of your notes, recordings, or transcripts to serve third-party advertising.

5. AI processing

NoteCat uses artificial intelligence and speech-recognition technology to deliver core features such as transcription, summarization, flashcards, and search. To do so, we transmit the relevant content (for example, an audio recording or imported document) from our backend to AI and speech-to-text providers acting as our processors.

Providers we currently use:

• AssemblyAI, Inc. (United States) — speech-to-text transcription and speaker diarization of voice recordings you submit. Privacy policy: assemblyai.com/legal/privacy-policy.
• OpenAI, L.L.C. (United States) — large-language-model processing for summaries, flashcards, quizzes, and search across your content. Privacy policy: openai.com/policies/privacy-policy.

We may add, change, or replace these providers as the Service evolves. When we do, we will update this section.

• Content is transmitted over encrypted connections (TLS).
• We rely on the standard data-processing terms offered by our AI providers, which today do not use API inputs to train their public foundation models by default. Where providers offer additional enterprise data-processing addenda or stricter no-training options, we may enable them where commercially feasible.
• Content is sent for the sole purpose of returning the requested result (for example, a transcript or summary) and is handled by the provider in accordance with their published retention and security terms.
• AI output may be inaccurate, incomplete, or otherwise unreliable. You are responsible for reviewing AI-generated content before relying on it.

6. Legal bases for processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Performance of a contract — to provide the Service you requested (Articles 6(1)(b) GDPR).
• Legitimate interests — to keep the Service secure, prevent abuse, debug issues, measure aggregate usage, and grow our business in a way that is balanced against your rights (Article 6(1)(f) GDPR).
• Consent — for optional analytics, advertising identifiers, and marketing messages, where required by law (Article 6(1)(a) GDPR). You can withdraw consent at any time.
• Legal obligation — to comply with applicable laws (Article 6(1)(c) GDPR).

7. How we share information

We share personal information only in these limited circumstances:

• Service providers / processors who host our infrastructure, run analytics, deliver authentication, process subscriptions, transcribe audio, run AI models, send emails, and provide customer support — all under written agreements that limit how they can use your data.
• App stores and payment processors (Apple App Store, Google Play, and our subscription provider) that complete your purchase and manage your subscription.
• Legal and safety — when we believe in good faith that disclosure is necessary to comply with the law, respond to valid legal process, protect our rights or property, or protect the safety of users or the public.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will give you notice before your information becomes subject to a different policy.
• With your direction — when you choose to share or export content (for example, sharing a note via the OS share sheet or exporting a PDF).

8. Third-party services we use

The table below lists the third-party services we currently rely on, the provider, and what we use them for. Specific providers may change over time as we improve the Service; when they do, we will update this section.

9. Analytics & advertising identifiers

On iOS, we ask for your permission through Apple's App Tracking Transparency framework before accessing the IDFA. If you decline, we do not access the IDFA and limit what we share with attribution partners. We do not use third-party advertising networks to show you ads inside the app.

You can change your tracking preference at any time in your device settings.

10. Data retention

• Account & content — kept while your account is active. If you delete a note, recording, or project, we delete it from active storage and from backups within a reasonable period.
• Account deletion — when you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to keep it for legal, tax, or security reasons.
• Diagnostics & analytics — typically retained for up to 14 months in identifiable form.
• Subscription records — retained for the period required by tax and consumer-protection law.

11. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest where supported by our providers, access controls, audit logging, and least-privilege principles. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities as required by law.

12. International transfers

NoteCat is offered globally. Your information may be processed in countries other than your own, including in the United States and the European Union. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

13. Your rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Deletion — ask us to delete your account and associated data.
• Portability — receive your data in a structured, commonly used format.
• Restriction or objection — limit or object to certain processing.
• Withdraw consent — where processing is based on consent.
• Lodge a complaint — with your local data-protection authority.

You can exercise most of these rights from inside the app (for example, by editing your profile or deleting your account) or by contacting us at [email protected]. We will respond within the time required by applicable law.

14. Children's privacy

NoteCat is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, please contact us so we can delete it.

15. California & US state rights

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of "sale" or "sharing" of personal information. We do not "sell" personal information as that term is commonly understood. Residents of other US states with comparable laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) have similar rights, which can be exercised by contacting us at the address below.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app, by email, or by updating the "Last updated" date at the top of this page. Your continued use of the Service after the change becomes effective means you accept the updated policy.

17. Contact us

If you have any questions about this Privacy Policy or our handling of your personal information, please contact us:

• Email: [email protected]