Privacy Policy

Account Information (Supabase)

You create an account to purchase NoteTalker and receive your license key, or — if you are an existing subscriber — to manage a legacy cloud plan. When you do, we collect:

• Email address — for authentication and account recovery
• Password (hashed) — stored securely by Supabase, never in plaintext
• Account creation date — for account and license management

This is only what your purchase and license delivery need. NoteTalker's AI runs entirely on your device, so an account is not required to use the app once your license is activated.

Analytics (Umami)

Our website uses Umami, a privacy-focused analytics platform that:

• Does not use cookies — no tracking cookies placed on your browser
• Does not collect personal data — no IP addresses, user agents, or fingerprinting
• Provides aggregate statistics only — page views, referrers, and country-level geography

Performance Telemetry (NoteTalker — opt-in, off by default)

NoteTalker runs AI entirely on your machine. It has one optional outbound feature: performance telemetry, which helps us answer questions like "is this model fast enough on this graphics card to be worth recommending?"

We publish the answer to that question. Aggregated figures — median and 95th-percentile generation speed and time to first token, grouped by hardware, model, and NoteTalker version — appear on our download page so people can see what to expect before they buy. Only grouped statistics are ever published — never individual records, never anything about what you asked or wrote. Your installation ID is used solely to count how many distinct machines sit behind each figure, and is never itself published. NoteTalker is new and the installed base is still small, so some published groups currently represent only a handful of machines; we show the installation count beside every figure rather than hide that. If you would rather not be part of it, leave telemetry off — it is off unless you turn it on — or ask us to delete your data at any time.

It is off unless you turn it on. A fresh install, and an upgrade from a version that didn't have it, both send nothing. While it is off, no data is collected and no queue file is even created on your disk. Turning it off again deletes anything already queued.

When you do enable it, one record is sent per AI request, batched every few minutes. Records cover three kinds of work — text generation, speech-to-text, and text-to-speech — and contain every one of the following fields and no others:

Sent with every record:

• App and system — NoteTalker version, whether it's a release or development build, operating system (Linux/macOS/Windows), processor architecture
• Hardware — graphics card model, video memory and whether it is shared with the CPU, total system RAM, processor model and core count. These are hardware classes, not serial numbers or identifiers
• Failures — a short code such as out_of_memory or timeout. Never an error message, because a message can quote a file path or part of a prompt
• Installation ID — a one-way hash of a machine identifier, plus a timestamp

For a text generation request, additionally:

• Model — which AI model and quantization you ran, the inference engine and its compiled features, the configured context size, and any draft model used for speculative decoding
• Performance — input and output token counts, how many input tokens were served from cache, generation and prefill speed, time to first token, whether this was the first request after loading a model and how long that load took, and memory in use
• Shape of the request — why generation stopped, how many tools the model called, whether reasoning mode was on, how many older messages were dropped to fit the context window, and a random per-conversation-turn ID used only to group the requests of a single turn together. That ID is random and is never derived from anything you wrote

For a speech request, additionally:

• Timing — how long processing took, how many milliseconds of audio were involved, and the resulting speed relative to realtime
• Text-to-speech only — the selected voice name (e.g. af_bella), and the number of characters of text spoken. The character count is a length; the text itself is never sent, and neither is any audio

Never included: note or vault contents, prompts, AI responses, conversation text, transcribed speech, spoken text, audio of any kind, file paths, file names, your license key, your email address, or your IP-derived location. NoteTalker has a "View exactly what gets sent" control in Settings that renders the live record — what you see there is the complete list, with no separate hidden payload.

The installation ID is a one-way hash: it cannot be reversed into your device identity, and it is not a user account. But it is the same value used to activate a license, so we treat it as pseudonymous personal data rather than anonymous — it could in principle be connected to a purchase. It is shared by everyone using the same computer, and one person on two computers produces two different IDs.

Feedback and Bug Reports

If you submit the form at talkwithyournotes.com/feedback, or send feedback from inside the NoteTalker app, we store what you typed: your message, the category you picked, which NoteTalker product you told us you use, and — only if you chose to give it — an email address for replying.

Nothing is attached automatically. We do not collect logs, prompts, screenshots, or vault contents alongside a report. Feedback and telemetry are separate systems with separate consent: submitting feedback never enables telemetry, and having telemetry on never attaches your machine to a written report. If a report offers to include your installation ID, that is its own checkbox with its own explanation.

We use the limited data we collect for:

1. Authentication — verifying your identity when you log in to your account
2. Billing — processing your one-time NoteTalker purchase via Stripe, and managing legacy cloud subscriptions for existing subscribers
3. License delivery — issuing and managing the license key tied to your account
4. Usage enforcement (legacy cloud plans) — keeping existing subscribers within their plan limits; NoteTalker itself has no usage limits
5. Support — helping you troubleshoot issues if you contact us

We do not use your data for advertising, marketing analytics, or selling to third parties. We do not train AI models on your conversations.

Account Data

Your account information (email, subscription status) is retained for as long as your account is active. If you delete your account via Settings → Account in the NoteTalker app, we permanently delete:

• Your email and authentication credentials
• All subscription and billing records
• All usage tracking data

Deletion is irreversible and typically completes within 30 days. Stripe may retain billing records for legal compliance (tax, fraud prevention).

Usage Records (Legacy Cloud Plans)

For existing subscribers on legacy cloud plans, usage data (message counts, STT/TTS minutes) is retained for the current billing period plus 12 months for auditing and dispute resolution. After 13 months, usage data is automatically purged. NoteTalker records no usage data.

Telemetry Records (NoteTalker)

If you opted into performance telemetry, individual records are kept for 90 days and then permanently deleted. Before deletion they are folded into daily totals — median and 95th-percentile speeds grouped by model, graphics card, and operating system. Those totals contain no installation ID and no per-record data, so they are genuinely anonymous, and we keep them indefinitely to track whether NoteTalker is getting faster.

You can ask us to erase every record tied to your installation ID at any time, whether or not telemetry is still enabled. See "Your Rights" below.

Feedback and Bug Reports

Reports are kept while the issue they describe is open, and for up to 24 months afterwards so we can recognise a recurring problem. Ask us and we'll delete yours sooner.

Local Data (Your Vault)

All vault data—notes, files, CRM, conversation history, memory files—lives exclusively on your local machine. To delete this data, simply delete the vault folder on your computer. We have no access to it and cannot recover it.

We take security seriously and implement industry-standard protections:

• Encryption in transit — All API calls use HTTPS/TLS 1.3
• Password hashing — Passwords are hashed using bcrypt with salt
• JWT authentication — Secure token-based authentication via Supabase
• Rate limiting — Protection against abuse and denial-of-service attacks
• Least privilege — Our backend only accesses the minimal data needed to process your request

Despite our precautions, no system is perfectly secure. If you discover a security vulnerability, please report it to info@talkwithyournotes.com.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you via email (if you have an account) and update the "Last updated" date at the top of this page.

Your continued use of NoteTalker after policy changes constitutes acceptance of the updated terms.