Privacy Policy

Effective date: 23 August 2026

This privacy policy applies to the My AI Notes app ("the app", "we", "us") for iOS, together with any related services. It explains what data the app collects, where it is stored, when it leaves your device, and the rights you have. We wrote it to match what the app actually does. If anything here is unclear, email us at gregory.timofeev@linked-robot.com.

1. Data Controller Information

The Data Controller responsible for processing your personal data is Grigorii Timofeev preduzetnik Beograd, Makenzijeva 37, 11000 Belgrade, Serbia. The Data Controller can be contacted at gregory.timofeev@linked-robot.com.

For data protection inquiries and to exercise your rights, please contact the Data Controller at this address.

2. What information the app obtains and how it is used

Most of what the app holds never leaves your phone. By default, everything your notes contain stays on your device in a local database: audio recordings, transcripts, AI summaries, extracted action items, on-device search embeddings, tags, and note ratings. In this version of the app we do not upload this content to our servers for storage, and there is no cross-device sync — the one exception is the optional feedback snapshot in Section 10, which you actively choose to share. If you delete the app, this local data is removed with it.

To use the app you sign in with Sign in with Apple or Sign in with Google, handled by Firebase Authentication. We store a small profile document for your account in Google Cloud Firestore, keyed to your user id. It contains:

• your account email (when your sign-in provider shares it) and display name,
• a user id and which provider you used to sign in,
• your subscription status and plan metadata,
• created and updated timestamps.

Access to this document is restricted so that only you (your signed-in account) can read or write it. We use this information to run the app, keep your account signed in, apply your subscription, respond to support requests, and keep the service secure.

3. Legal basis for processing your personal data

Where the GDPR (or the UK GDPR) applies, we rely on one or more lawful bases to process your personal data:

• Contract performance: processing needed to provide the app and its features to you — for example, running your account, transcribing and summarizing your recordings when you ask, and managing your subscription.
• Consent: where you have given explicit consent — for example, sharing a thumbs-down note snapshot. You may withdraw consent at any time without affecting processing that happened before withdrawal.
• Legitimate interests: where processing is necessary for our legitimate interests, such as keeping the service secure, preventing fraud and abuse, fixing crashes, and understanding how the app is used at a high level, provided those interests are not overridden by your rights. We also rely on this basis to measure, in a privacy-preserving way, whether our ads lead to installs (see Section 8). You can object to this processing at any time (see Section 22).
• Legal obligation: to comply with laws or valid government requests.

4. Cookies and similar technologies

My AI Notes is a mobile app, not a website, so it does not use browser cookies or advertising cookies. It relies on third-party SDKs (Firebase for authentication, Firestore, Crashlytics, and Analytics) to provide its features. For analytics and for privacy-preserving ad measurement (Apple's SKAdNetwork and Firebase's on-device conversion measurement, described in Section 8), the app uses device identifiers and similar technologies rather than advertising cookies. You can object to this non-essential measurement at any time (see Section 22).

5. Automated decision-making and profiling

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The AI in the app generates transcripts, summaries, and action items from the content you record — it does not make decisions about you, score you, or build a profile of you.

6. Information the app collects automatically

Beyond your account data, the app collects a limited amount of technical information automatically through Firebase:

• Crash reporting (Firebase Crashlytics): crash logs, non-fatal error reports, and technical details about the device and operating system (for example, device model and OS version). It does not collect your note content.
• Analytics (Firebase Analytics): high-level usage events — for example, when a recording starts or completes, when the paywall is shown, and when a subscription starts. Events carry only identifiers, category labels, counts, and durations.

Your note content is never sent to analytics. Note titles, transcripts, summaries, action-item text, tag names, and any free-text feedback are not included in analytics events.

7. Precise location

This app does not collect precise real-time location information about your device. It does not request location permission.

8. Advertising and attribution

To measure whether our ads lead to installs, we use Apple's SKAdNetwork and Firebase on-device conversion measurement. With on-device conversion measurement, your account email is hashed on your device by the SDK — the plain email is never sent for this purpose.

We do not use the Identifier for Advertisers (IDFA), we do not show the App Tracking Transparency prompt, and we do not track you across other companies' apps or websites. This measurement is on by default; we rely on our legitimate interest in measuring our advertising in a privacy-preserving way. You can object at any time by emailing us at gregory.timofeev@linked-robot.com, and we will then stop the on-device conversion measurement tied to your account (see Section 22). Apple's SKAdNetwork reports are operated by Apple, are aggregated, and do not identify you.

9. Artificial Intelligence (AI) technologies

This is the part to read carefully. The app uses AI to turn your recordings into transcripts and summaries. To do that, it sends content directly from your device to third-party AI providers. This is the main case where your note content leaves the device; the other is the optional feedback snapshot in Section 10.

• Transcription: your audio recording is sent to xAI Speech-to-Text to transcribe it into text. If no xAI key is configured, the app falls back to OpenAI Whisper for transcription instead.
• Summary and action items: the resulting transcript text is sent to Google Gemini to generate the summary and extract action items.
• On-device only: the search embeddings used to find your notes are generated on your device with a bundled model and are not sent to any AI provider.

The AI generates content from what you record; it does not make automated decisions about you (see Section 5). Your use of these AI features is subject to the providers' own privacy policies, linked in Section 12.

10. Do third parties see or access your information?

We do not sell your information, and we do not share it for advertising. We share data only with the service providers listed below (our sub-processors), who process it on our behalf to provide the app's features, and only as described in this policy. In addition, if you send feedback from the app, we receive the message you write so we can respond and improve the app. When you give a note a thumbs-down rating, you can choose — with an explicit consent toggle — to share a text-only snapshot of that note to help us diagnose the problem. Only if you turn that consent on do we upload the snapshot to Firestore under your account; it is removed when you delete your account.

11. International data transfers

The Data Controller named in Section 1 is established in Serbia, which is outside the European Economic Area (EEA) and the UK and is not covered by a European Commission adequacy decision. Account data, support correspondence and requests you make under Section 22 are therefore handled outside the EEA and the UK. Separately, the sub-processors below are based in the United States, so using AI features and the Firebase services transfers some personal data there. Countries outside the EEA and UK may not provide the same level of data protection. Where such transfers occur, we rely on an appropriate transfer mechanism, such as:

• adequacy decisions by the European Commission (or the UK equivalent), where they apply;
• Standard Contractual Clauses (SCCs) approved by the European Commission, with the UK addendum where applicable;
• other safeguards or derogations recognized under GDPR Chapter V, including your consent where legally permitted.

12. Third-party sub-processors

The app uses the third-party services below. Each has its own privacy policy that governs how it handles the data it receives.

13. Disclosure

We may disclose your information:

• as required by law, such as to comply with a subpoena or similar legal process;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• to the trusted service providers listed in Section 12, who work on our behalf, do not have independent use of the information we disclose to them, and have agreed to the protections described in this policy.

14. Data Processing Agreements

Where the GDPR applies, we enter into Data Processing Agreements (DPAs) with the third-party service providers that process personal data on our behalf, as required by Article 28 of the GDPR. These agreements impose data protection obligations consistent with this policy.

15. Your opt-out rights

Recording is on-device, and content is only sent for AI processing when you choose to process a note. You can stop further collection of information by uninstalling the app; uninstalling stops the app from collecting data from your device, but it does not automatically delete information already transmitted to us or to the providers in Section 12. To delete your data, use the in-app account deletion described in Section 17, or contact us at gregory.timofeev@linked-robot.com.

16. Data retention

We keep data only as long as needed for the purposes described in this policy:

• Notes, audio, transcripts, and summaries: stored on your device and kept until you delete them or uninstall the app. Deleted notes are soft-deleted first and automatically purged from the on-device database after 30 days.
• Account profile and subscription metadata (Firestore): kept while your account exists and deleted when you delete your account.
• Consent-gated feedback snapshots (Firestore): kept until you delete your account; deleting your account removes them.
• Crash and analytics data (Firebase): retained per Firebase's standard retention for these services.

Data already sent to the AI providers in Section 12 is governed by their own retention policies, linked there.

17. Data deletion

You can delete your account from inside the app: Settings → Account → Delete Account. Deletion removes:

• the on-device data container for your account (notes, audio, transcripts, and the rest),
• your Firestore profile document and your feedback-snapshot subcollection,
• your authentication account.

For step-by-step instructions, see Delete Account. If you cannot use the in-app option, email gregory.timofeev@linked-robot.com and we will process your request within the time required by applicable law.

18. Children

My AI Notes is not intended for children under 13 (or under 16, or a higher age, where a higher age of digital consent applies under local law). We do not knowingly collect personal data from children. If you believe a child has provided personal information, contact us at gregory.timofeev@linked-robot.com and we will remove it.

19. Security

Your notes are stored on your device in a local database. For the limited data we hold in the cloud, access is restricted to your signed-in account, and we apply standard technical and organizational safeguards. No security system can prevent all possible breaches, but we work to protect the information we process and maintain.

20. Data breach notification

If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, with information about the nature of the breach, the data affected, and the steps taken to address it.

21. Changes to this policy

We may update this policy as the app changes. When we do, we update the effective date at the top. Material changes will be reflected here before they take effect, and where required by law we will seek your consent. This policy is effective as of the date shown at the top of this page.

22. Your GDPR data protection rights

If the GDPR or UK GDPR applies to you, you have the following rights:

• Access: request access to your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data (the "right to be forgotten").
• Restriction: request that we limit how we use your data.
• Portability: request a copy of your data in a structured, commonly used, machine-readable format.
• Object: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where processing is based on consent, withdraw it at any time — for example, by leaving the feedback-snapshot toggle off.
• Automated decision-making: we do not carry out automated decisions with legal or similarly significant effects (see Section 5).

You also have the right to lodge a complaint with your local Data Protection Authority. If you are in the UK, you can contact the Information Commissioner's Office at ico.org.uk.

23. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the CCPA and CPRA give you additional rights over your personal information:

• Right to know: request the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of personal information we collected from you, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at gregory.timofeev@linked-robot.com. You may designate an authorized agent to make a request on your behalf.

24. How you give your consent

Where processing is based on consent, you provide it by affirmatively opting in to the relevant feature or action — for example, turning on the feedback-snapshot toggle. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases (contract, legitimate interests, or legal obligation) is carried out as described above.

25. Contact the Data Controller

The Data Controller for the app is Grigorii Timofeev preduzetnik Beograd, Makenzijeva 37, 11000 Belgrade, Serbia. For any privacy question, or to exercise your rights, email gregory.timofeev@linked-robot.com. We will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.