Privacy Policy
Noteday is a note-taking app for iPhone, iPad and Android, provided by Gambit Global LTD ("we", "us"), a company registered in the United Kingdom. This policy explains what data the app handles, why, and how you can get rid of it. The short version: your notebooks live on your device, and the only note content that ever reaches us is the text you deliberately send to Noteday AI.
1. Your notebooks stay on your device
Your notebooks — handwriting, drawings, typed text, imported PDFs, images, stickers, templates and voice recordings — are stored locally on your device. We do not upload them, we do not read them, and we cannot recover them for you if you lose your device.
Handwriting recognition runs on your device. When you convert handwriting to text, or when the app gathers a notebook's text for an AI request, your ink is rendered and recognised locally — using Apple's Vision framework on iPhone and iPad, and Google's bundled ML Kit text recognition model on Android. No page image is uploaded for this.
Voice recordings stay on your device. Recordings you make with the microphone are saved inside the notebook on your device. Noteday does not transcribe them and does not upload them.
iCloud sync (iPhone and iPad only)
On iPhone and iPad, Noteday Pro can sync your notebooks through your own iCloud account, into the app's private CloudKit database. Apple handles that storage and it is governed by your iCloud settings and Apple's privacy policy. Your notebooks do not pass through our servers, and we have no access to them.
The Android app has no cloud sync. Notebooks exist only on the device, until you export them yourself.
2. Your account is optional, and only for AI
Noteday works fully without an account. Writing, pages, templates, covers, PDF import and export, audio recording and reminders all work with no sign-in.
You only need an account for Noteday AI, because AI credits are a stored balance that has to be tied to something durable. You sign in with Apple on iPhone and iPad, or with Google on Android.
- What we ask for. We request only a stable identifier and, where the provider supplies it, your email address. From Apple we request the email scope only — never your name. From Google we read only the identity token, never your profile name or picture.
- What we store. The provider's stable user identifier, your email address if one was supplied, your credit balance, and a record of your AI usage. Nothing else.
- Apple private relay. If you use Hide My Email, all we ever see is the relay address.
- Linking your accounts. If you sign in on both platforms with the same verified email address, we join them into one account so your credits and Pro status follow you.
- Sign-in tokens are kept on your device — in the system Keychain on iPhone and iPad, and in the app's private storage on Android. Signing out deletes them.
3. Data we process
| What | Why, and who handles it |
|---|---|
| Account identity Apple or Google user ID, email address (if provided) |
To hold your AI credit balance and your Pro status. Stored on our servers. Only created when you sign in. |
| Purchases Subscription and purchase status, transaction identifiers |
Handled by Apple or Google Play and managed through RevenueCat. Once you are signed in, we pass RevenueCat your Noteday account identifier so your Pro status and credits reach the right account. We never receive your payment details. |
| Analytics App interactions and a device / app-instance identifier |
Google Firebase Analytics, to see which features are worth improving. Events are things like app opened, notebook created, page added, export completed, paywall shown, AI feature used. Parameters are counts, labels and product identifiers — never your note content, note titles or file names. We also set whether you are on the free or Pro plan. |
| Ads (free tier only) Advertising identifier and ad interaction data |
Google AdMob. On iPhone and iPad we ask through Apple's App Tracking Transparency prompt before any tracking; on Android the app uses the Android advertising ID and declares the AD_ID permission. On both platforms Google's consent SDK (UMP) asks for your advertising consent where the law requires it, and passes your choice to AdMob. Noteday Pro removes all ads. |
| Noteday AI The text of the pages you send, and your question |
Only when you run an AI action. See section 4. |
| Push notifications A Firebase Cloud Messaging device token |
So we can send occasional announcements. The token is registered with our server whether or not you are signed in, together with the platform (iOS or Android) and the app version. It is not linked to your notes. |
| Reminders Nothing leaves the device |
Gentle reminders are scheduled entirely on your device by the operating system. They can mention a recent notebook's title on the lock screen, but that never reaches us. You can turn them off in Settings. |
| Crash and diagnostic reports | We do not collect these. Noteday includes no crash-reporting SDK on either platform. Apple and Google may still give us anonymous aggregate crash statistics through their own store consoles, if you have opted in with them. |
4. Noteday AI — what leaves your device
Noteday AI is off until you use it. When you run an AI action (ask, summarize, outline, flashcards, quiz, rewrite, or generate an image), this is exactly what happens:
- Text only. The app gathers the relevant pages' text on your device — the text layer of imported PDFs, plus your handwriting recognised locally — and sends that text, along with your question, to our server over HTTPS. It is trimmed to a size limit before it is sent.
- For image generation, only your typed prompt is sent. The generated image comes back in the response and is saved on your device.
- No page images, no ink strokes, no PDFs, no audio and no attachments are ever uploaded. There is no upload endpoint in the app at all.
- We pass the text to a model provider to produce the result. Today that provider is Google (Gemini for text, Imagen for images). We may change providers as models improve, and we will update this page when we do.
- We do not store what you send. The text is held in memory only for as long as it takes to stream the answer back to you. What we keep afterwards is a usage record: which feature you used, which model, how many tokens, what it cost, how many credits it used, and when. No prompt text and no note content is written to our database.
- We never use your content to train any model. The model provider processes it under its own terms, linked below.
5. Who else is involved
These are the only third parties that receive any data from Noteday. Each has its own privacy policy:
- Apple — sign-in, purchases, iCloud sync, push delivery (iPhone and iPad)
- Google — sign-in (Android), Google Play purchases, Firebase Analytics, Firebase Cloud Messaging, AdMob, and the Gemini/Imagen models behind Noteday AI
- RevenueCat — subscription and purchase status
We do not sell your data, and we do not share it with anyone else.
6. Children
Noteday is not directed to children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
7. How long we keep things, and how to delete them
Your notebooks stay on your device until you delete them, or until you delete the app. On iPhone and iPad, anything you synced also stays in your own iCloud account until you remove it there.
Your Noteday account data — your identifier, email address, credit balance and AI usage records — is kept for as long as your account exists. There is no automatic expiry; deleting the account is what removes it.
Deleting your account
You can delete your Noteday account and its server-side data in three ways:
- In the app: Settings → Noteday account → Delete account. Same path on iPhone, iPad and Android.
- On the web: follow the steps at getnoteday.com/support.
- By email: write to info@gambitgg.com from the address attached to your Apple or Google sign-in.
What gets deleted. Your user record (identifier and email address), your entire credit ledger and balance, your AI usage records, your purchase records held by us, and your push notification tokens. This is permanent and immediate — it is a single database transaction, not a scheduled job, and there is no recovery period.
What does not get deleted. Your notebooks, because they are on your device and in your own iCloud account, not on our servers — delete those yourself if you want them gone. We also keep a small record of processed purchase events, containing an internal identifier and a product ID and no personal content, so that the same purchase cannot be credited twice. And your purchase history at Apple, Google and RevenueCat stays with them, because they need it for billing, refunds and restoring purchases.
Deleting data without deleting your account
The app does not currently offer partial deletion — for example, clearing your AI usage history while keeping your credits. Email info@gambitgg.com and we will do it by hand. The same goes for removing a push notification token from a device you no longer use.
You can also reduce what is collected without contacting anyone: turn off Share usage analytics in Settings → Privacy on Android, decline the tracking prompt on iPhone and iPad (or change it later in iOS Settings → Privacy & Security → Tracking), turn reminders off in Settings, or subscribe to Noteday Pro, which removes ads entirely.
8. Your rights
If you are in the UK or the EU, the UK GDPR and GDPR give you the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy of it in a portable form, and to object to or restrict how we use it. Our lawful bases are performing our contract with you (your account, credits and purchases) and our legitimate interests (keeping the service working, secure and improving).
If you are in California, the CCPA gives you the right to know what we collect and to ask us to delete it. We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the advertising consent you give in the app.
To exercise any of these, email info@gambitgg.com. We will reply within 30 days. You can also complain to your local data protection authority; in the UK that is the Information Commissioner's Office.
9. Security
All traffic between the app and our servers is encrypted with HTTPS/TLS, as is all traffic to our providers. Sign-in tokens are kept in the device's secure storage and expire. Our servers hold no note content, no payment details and no passwords, and sign-in and AI endpoints are rate-limited against abuse.
No system is perfect. Please keep your own backups of anything you cannot afford to lose — use the app's export features.
10. International transfers
Noteday is run from the United Kingdom. Our servers and our providers — Apple, Google and RevenueCat — operate globally, so your data may be processed outside your country, including in the United States. Where that happens we rely on the providers' own transfer safeguards, such as Standard Contractual Clauses and the applicable data privacy frameworks.
11. Changes to this policy
We may update this policy; the "last updated" date above will change. If a change materially affects how we handle your data, we will tell you in the app.
12. Contact
Gambit Global LTD — info@gambitgg.com