Privacy Policy
Kinotes records what you say and turns it into a written note. That means we handle recordings of your voice — some of the most personal data there is. This policy explains exactly what we collect, what leaves your phone, who processes it, and how to get rid of it. It is written to be read, not to be survived.
The short version
- You can use the app without giving us an email address or creating an account.
- Your recordings are kept on your phone. To transcribe and structure a note, audio and text are sent to our servers and to the AI providers listed below. You can turn on on-device transcription instead, and then your audio does not leave the device.
- We do not use your recordings or notes to train AI models, we do not sell your data, and we do not share it with advertisers or data brokers.
- You can export everything or delete everything, permanently, from inside the app.
This summary is for orientation only — the sections below are the actual terms.
1Who we are
Kinotes is operated by SOFTUPPER LLC, a company registered at 2108 N St Ste N, Sacramento, CA 95816, United States ("we", "us"). For the purposes of the EU GDPR — and the UK GDPR where it applies to users in the United Kingdom — we are the data controller for the personal data described in this policy.
This policy covers the Kinotes app for iPhone and Android and the https://www.kinotes.ai website. It does not cover third-party services you choose to connect, which are governed by their own policies.
2What we collect
Information you give us
You can start using the app as a guest, in which case we hold no contact details for you at all. If you choose to create or link an account, we collect the identifiers that come with your sign-in method:
- Sign in with Apple — your Apple user identifier and the email address you choose to share (including Apple's private relay address, if you use it).
- Sign in with Google — your Google account identifier, email address, and, where provided, your name and profile picture.
- Email sign-in — your email address, used to send you a one-time sign-in code.
Content you create
This is the substance of the service, and the most sensitive category we handle. It includes your audio recordings; the transcripts produced from them; the notes, summaries, titles and action items generated from those transcripts; and anything you add or edit yourself — folders, highlights, comments, due dates, custom styles, and custom vocabulary terms.
Please be aware that a recording captures whatever was audible, including other people and background conversation. You are responsible for having the right to record — see the recording clause in our Terms of Use.
Information we collect automatically
- Device and app data — device model, operating system version, app version, language and region, and a generated installation identifier.
- Usage events — which screens you open and which actions you take (for example: a recording was started, a note was exported), so we can see which parts of the app work and which do not.
- Diagnostics — crash reports and performance traces.
- Network data — your IP address, which our servers necessarily receive, and from which approximate country may be inferred.
On iOS, if you decline the App Tracking Transparency prompt, we do not access your device's advertising identifier. We do not run advertising in the app and we do not build advertising profiles from your content in either case.
Purchase information
Subscriptions are sold through the Apple App Store and Google Play. They tell us — via our subscriptions provider — whether you have an active entitlement and when it renews or expires. We never receive your card number or billing address.
3How we use it
| Purpose | Data used | Legal basis (UK/EU) |
|---|---|---|
| Transcribing, summarising and extracting tasks from your recordings | Audio, transcripts, notes | Performance of our contract with you |
| Storing your notes and syncing them between your devices | Content you create, account identifiers | Performance of our contract |
| Search and answering questions across your notes | Transcripts, notes, derived embeddings | Performance of our contract |
| Sending reminders, processing notifications and digests you enable | Task due dates, notification token | Performance of our contract |
| Managing subscriptions and entitlements | Purchase status, account identifiers | Performance of our contract |
| Keeping the service secure and preventing abuse | Device data, IP address, usage events | Our legitimate interest in a secure service |
| Fixing crashes and improving the product | Diagnostics, aggregated usage events | Our legitimate interest in improving the app |
| Meeting legal and tax obligations | Transaction records | Legal obligation |
We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under US state privacy laws.
4How AI processing works
This is the part worth reading closely, because it is the part where your voice leaves your phone.
By default, when you finish a recording:
- The audio file is uploaded to our servers over an encrypted connection and passed to a speech-to-text provider, which returns a transcript.
- The transcript is passed to a large language model provider, which returns the summary, the title, and the action items.
- Text from your notes is converted into numerical representations (embeddings) so that search and the "ask across your notes" feature can find relevant passages. These are stored alongside your notes.
Your content is not used to train AI models — not ours, and not our providers'. We use these providers under commercial API terms that prohibit training on data submitted through them, and we do not operate any training pipeline of our own.
AI output can be wrong. A summary may misstate what you said, and an extracted task may be one you never committed to. Every action item links back to the moment in the recording it came from so you can check it. Do not rely on AI output for medical, legal, financial or other consequential decisions.
5On-device transcription
The app can transcribe entirely on your phone instead. In Settings you can download a speech recognition model to the device and switch cloud transcription off. After that, audio for transcription is not uploaded to our servers or to any speech-to-text provider.
Note the limits of this: the AI summary, the action-item extraction and the "ask across your notes" feature still send text to a language model provider, because that processing does not run on the device. If you want nothing at all to leave your phone, use on-device transcription and do not use the AI features.
6Who we share it with
We share personal data only with the service providers that operate the product on our behalf, under contracts that require them to protect it and to use it only for the purpose we specify.
| Provider | What they do | What they receive |
|---|---|---|
| Microsoft Azure | Hosting, database, audio and export storage, monitoring | All stored content and account data |
| OpenAI | Converts audio to text | Audio recordings |
| OpenAI | Produces summaries, action items and answers | Transcript and note text |
| Google (Firebase) | Analytics, crash reporting, push notification delivery | Device data, usage events, notification token |
| RevenueCat | Manages subscription entitlements | Purchase status, account identifier |
| Apple, Google | Process payments for in-app subscriptions | Payment details, which they hold — not us |
| Azure Communication Services (Microsoft) | Delivers sign-in codes and any service emails | Your email address |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If our business is acquired, data may transfer to the acquirer, who would remain bound by this policy until you are notified otherwise.
7Integrations you connect
The app can send your notes and tasks to other services — for example Notion, Apple Notes, Obsidian, Apple Reminders, Things or Todoist. Nothing is sent to any of them unless you connect the service and ask for it. Where a connection uses OAuth, we store the access token needed to keep it working, and you can disconnect at any time in Settings. Once your content reaches a third-party service, that service's own privacy policy governs it.
Sending tasks to Apple Reminders happens entirely on your device through the operating system, and that content does not pass through our servers.
8How long we keep it
- Notes, transcripts and recordings — until you delete them, or until you delete your account.
- Deleted notes — held in Trash so you can recover them, then permanently removed.
- Account records — for as long as your account exists.
- Diagnostics and usage events — kept only as long as we need them to diagnose problems and understand how the app is used, then deleted or reduced to aggregate statistics that no longer identify you.
- Transaction records — for as long as tax and accounting law requires, typically six years.
9Export and deletion
Both of these are built into the app and you do not need to email anyone to use them.
- Export — download a complete archive of your data, including your notes and transcripts, in a portable format.
- Delete your account — irreversibly deletes your account and all the content you own, including recordings and transcripts. This cannot be undone, so export first if you want a copy.
Backups are overwritten on a rolling cycle, so a residual copy may persist in encrypted backups for a short period after deletion before being permanently overwritten.
10Security
Data in transit is encrypted with TLS. Data at rest is encrypted by our cloud provider. Access to production systems is restricted to the people who need it and is authenticated. Every request to our API is scoped to your own user, so one account cannot read another's notes. On your device you can require Face ID, fingerprint or a passcode to open the app.
No system is perfectly secure, and we cannot guarantee the security of data transmitted over the internet. If a breach affects your personal data we will notify you and the relevant regulator where the law requires it.
11Your rights
Depending on where you live, you have some or all of the following rights: to access the personal data we hold about you; to correct it; to delete it; to receive a portable copy; to object to or restrict processing based on legitimate interests; and to withdraw consent where processing relies on it. You also have the right not to be discriminated against for exercising these rights.
The export and delete features above satisfy the access, portability and deletion rights immediately. For anything else, contact us at app-support@softupper.com and we will respond within the period the law allows, normally one month.
If you are in the UK or EEA and you think we have handled your data improperly, you may complain to your local data protection supervisory authority. We would appreciate the chance to resolve it first. If you are a California resident, you may also lodge a complaint with the California Privacy Protection Agency.
12International transfers
We are based in the United States, and our hosting and AI providers also operate there. Your recordings, transcripts and notes are processed in the United States. Where personal data is sent to us from the EEA — or the United Kingdom, for users there — we rely on the safeguards permitted by law, such as the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where we or a provider are certified under it, or the UK International Data Transfer Agreement.
13Children
Kinotes is not intended for anyone under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
14Changes to this policy
If we change this policy we will update the date at the top. Where a change materially affects how we handle your content — a new category of processing, or a new provider that receives your recordings — we will tell you in the app or by email before it takes effect.
15Contact us
Write to app-support@softupper.com, or by post to SOFTUPPER LLC, 2108 N St Ste N, Sacramento, CA 95816, United States.