Privacy Policy

Last updated: 28 October 2026

Micnoteai is an iOS app that records or imports audio, PDFs and YouTube links, turns them into transcripts and AI-generated summaries, and lets you ask questions about your own notes in a chat. To do that, the content you give the app is uploaded to our backend server, processed there, and stored in your account so it can be synced back to your devices. We do not sell your personal information and the app contains no advertising or ad-tracking SDKs. To measure our own App Store ads, the app uses Apple's privacy-preserving ad attribution, which does not use advertising identifiers or track you across other apps (see section 3). This policy explains exactly what is collected, why, how long it is kept, and what rights you have over it.

1. Who we are

Micnoteai is developed and operated by Hamid Manafov, an individual developer based in Azerbaijan. Hamid Manafov is responsible for the personal data described in this policy (the data controller).

For privacy requests and app support, email support@micnoteai.com. A postal contact address is available on request.

Privacy requests are handled directly by the developer. No separate Data Protection Officer or EU/UK representative is currently appointed. This does not limit your privacy rights or our obligations under applicable law.

2. Scope of this policy

This policy applies to the Micnoteai iOS app, the servers used to provide it, and the Micnoteai website.

It does not apply to:

• Apple. Your App Store account, App Store purchases, Sign in with Apple, iCloud and push notification delivery are governed by Apple's own privacy policy. We receive only what Apple passes to us, described in section 3.
• Google. If you choose Google Sign-In, Google's handling of your Google Account is governed by Google's privacy policy.
• Third-party content you point the app at. If you submit a YouTube link, the video is fetched and processed on our side; YouTube's own terms and privacy policy still apply to your use of YouTube.
• Other websites that this policy or the app may link to.

The app is intended for people aged 13 or over, and 16 or over in the EEA, the UK and Switzerland. A higher minimum age applies where required by local law. These are the service eligibility requirements described in our Terms of Use; see section 13 for how we handle children’s information.

3. Information we collect

The table below describes the categories of personal data the app handles, where it comes from, why we need it, and — for users in the EU/UK — the legal basis under Article 6 GDPR. The app has no email/password sign-up: you can only sign in with Apple or Google, so we never receive or store a password.

Special-category data. We do not ask for and do not intentionally collect sensitive data (health, biometric, religious, political or sexual-orientation data). However, a recording is whatever you recorded — if you record a medical appointment or a personal conversation, that content may contain sensitive information about you or others. Please only record where you are legally allowed to (see section 5).

Using the app without an account. The app lets you browse onboarding as a guest, but no account is created and the app returns you to the sign-in screen. Practically, an account is required to create and process notes.

What we do not collect. We do not collect passwords, precise or background location, contacts, photos beyond the file you explicitly import, advertising identifiers (IDFA), or any data for ad targeting or cross-app tracking. The app contains no advertising SDKs and shows no ads. The only advertising-related data we handle is the ad campaign attribution described above, which we use solely to measure our own Apple Ads campaigns.

4. How we use your information

We use the data described above only for the following purposes:

• To provide the core service — receiving your audio, PDF or YouTube link, transcribing it, generating a summary, and storing the resulting note in your account.
• To sync and display your notes across your devices, including keeping an offline copy on the device so your notes are readable without a connection.
• To run the AI chat so you can ask questions about a specific note.
• To manage your account — signing you in, keeping the session alive with refresh tokens, letting you sign out of one or all devices, and deleting your account when you ask.
• To handle subscriptions — checking whether you have premium, applying free-tier usage limits, and restoring purchases.
• To notify you when a note has finished processing or failed, if you allowed notifications.
• To keep the service secure and reliable — preventing replay attacks on sign-in, rate-limiting abuse, retrying failed uploads, and diagnosing errors.
• To improve the app — reviewing pseudonymous product analytics to see which features are used and where flows break.
• To measure our own advertising — seeing which of our Apple Ads campaigns and keywords lead to installs and subscriptions. This is not used to show you ads or to profile you.
• To comply with the law — meeting tax, accounting and consumer-protection obligations, and responding to valid legal requests.

We do not:

• sell or share your personal information for money or for cross-context behavioural advertising;
• use your recordings, transcripts, notes or chats to build advertising or marketing profiles;
• make decisions about you that produce legal or similarly significant effects using solely automated processing.

If we ever want to use your data for a genuinely new purpose that is not compatible with the purposes above, we will update this policy and, where the law requires it, ask for your consent first.

5. Audio recordings and transcription

Because audio is the most sensitive thing the app handles, here is precisely what happens to it.

Recording

Recording only starts when you tap record, and iOS requires you to grant microphone permission before the app can access the microphone. You can withdraw that permission at any time in iOS Settings → Privacy & Security → Microphone; without it, recording stops working but the rest of the app still functions. The app does not record in the background without your knowledge and does not listen when you are not recording.

Storage on your device

Each recording is written to disk as an .m4a file inside the app's own Documents area, in a private folder associated with your account. These files are protected by iOS app sandboxing and the device's file-level encryption while the device is locked. The app does not add a second layer of its own encryption on top.

Backup. Once a recording has been uploaded successfully and is kept on the device, the app marks the file as excluded from backup, so it is not copied into your iCloud backup or an iTunes/Finder backup — the copy on our server is the one that survives a device restore. A recording that has not yet been uploaded (for example one still waiting in the offline queue) is not excluded, and is therefore included in your backups according to your own iOS backup settings. The offline note cache is likewise excluded from backup.

Keeping recordings on your device

By default, recordings stay on your device after they have been uploaded. This is deliberate: it lets the app play the original audio back to you instantly, without re-downloading it, and lets you check the transcript against what was actually said. You are in control of it — the app has a "keep local audio" switch in Settings. Turn it off and each recording is deleted from the device as soon as its upload has completed successfully; the note and its transcript are unaffected, and playback then streams from our server instead, which needs a connection. Turning the setting off also clears the local playback references for your account. The setting belongs to the device, not to the account, so it applies to whoever is signed in on that device. The app never deletes a local recording before its upload has succeeded.

Upload and processing

To transcribe a recording, the app uploads it to our servers over an encrypted connection, together with its title, duration and language. A connection is needed for processing. If an upload fails or you are offline, the app keeps a pending copy and can retry later. PDFs are uploaded for text extraction; submitted YouTube links are processed on our servers.

Retention of audio

On the server, the audio file is retained after processing so that the note can offer audio playback alongside the transcript. It is not deleted immediately after transcription. It is stored in Amazon S3 in Frankfurt, Germany, and there is no automatic age-based deletion — the file is kept for as long as the note exists. Deleting the note or your account also requests removal of its stored file; background cleanup and retries can take time (see section 8). Playback links handed to your app are signed CloudFront URLs that expire after one hour, so a link cannot be shared or reused indefinitely.

On your device, unless you turn the "keep local audio" setting off, the app keeps a local copy of the recording and a mapping of which file belongs to which note, as described above. Deleting a note deletes its server-side record; deleting your account deletes all local recordings in the background as part of the cleanup described in section 10.

Who can hear your recordings

Your recordings and transcripts are tied to your account and are not shared with other users. They are accessible to our processing pipeline and to the transcription provider used to convert speech to text, and to the developer only where strictly necessary to investigate a fault you have reported. The transcription providers we may use are listed in section 6.

Recording other people

Laws about recording conversations differ by country and by US state — some require every participant's consent. You are responsible for making sure you have the right to record, and for telling the other participants when the law requires it. If someone else's voice ends up in your recording, you are acting as the person who decided to record them.

6. AI features

Micnoteai uses AI models for speech transcription, processing imported PDFs and submitted YouTube links, generating note summaries and titles, translation, and answering questions about a note.

Your choice before sharing

Before this version of the app sends new content for AI processing, it shows an in-app explanation of the data and recipients and asks you to choose Agree and continue or Not now. Completing onboarding or granting microphone permission does not grant AI-sharing permission. The app stores your choice, the disclosure version and the decision time on this device for your signed-in account. A different account or an updated disclosure requires its own decision.

You can decline and continue viewing existing notes. Features that require new AI processing remain unavailable until you agree. You can change your choice in Settings → AI processing and select Stop AI sharing. This blocks new AI requests from this installation, including upload retries. It does not recall content already transmitted, cancel processing already accepted by our servers, or delete existing notes. To delete content, use the note or account deletion controls described in this policy.

How content reaches the AI

The app sends content to our servers over an encrypted connection. Our servers pass the content needed for the requested task to an AI provider. We do not intentionally send your profile name or email address, but the content itself may identify you or other people. File names or temporary file links may also contain a note or account identifier.

What is sent

• Transcription: the audio you recorded or imported.
• PDF processing: the PDF you selected and its contents.
• YouTube processing: the link you submitted and video content or transcripts used to produce the note.
• Summarisation: the transcript or extracted document text of that one note.
• Translation and reprocessing: the relevant source content, existing note text and your chosen language.
• Note chat: the message you typed, the earlier messages in that conversation, and the content of the note you are asking about. Only the note you have open is included — the AI is not given your whole library.

AI services we use

Micnoteai uses OpenAI and Google Gemini for AI-powered features. Content needed for your request is shared through our servers for processing, as described above.

Content and file information. Providers receive the content needed for the task and its language. Audio, text or file information may contain personal information, even though we do not separately send your profile details.

Training

We do not use your recordings, transcripts, notes or chat messages to train our own AI models, and we do not sell or license them to anyone for that purpose. We use AI providers under business/API terms rather than consumer terms, which ordinarily excludes customer content from provider model training. We cannot promise on their behalf that they are contractually barred from training on the content, and each provider sets its own retention period for abuse monitoring. If this matters to you, read the API terms of the providers listed above before submitting sensitive material.

Accuracy

Transcripts and AI summaries are generated automatically and can be wrong, incomplete, or misattributed to the wrong speaker. They are not a verbatim legal record, and they are not professional advice. Please check anything important against the original recording — which is why the app keeps the audio available.

7. Sharing and disclosure

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so, and we receive no money or other valuable consideration for your data.

The following table describes service providers and the data used to deliver the stated features.

We may additionally disclose personal data:

• To comply with the law — in response to a valid court order, subpoena or other binding legal request, or to establish, exercise or defend legal claims. We will tell you about such a request unless we are legally prohibited from doing so.
• To protect people — where disclosure is necessary to prevent fraud, abuse of the service, or a serious threat to someone's safety.
• In a business transfer — if the app is ever sold or transferred, your data may pass to the acquirer, who would remain bound by this policy until you are notified of any change. You would be told before your data became subject to a different policy.

8. Data retention

We keep personal data for the purpose described below. Deletion is a process, not a promise that every copy disappears instantly. Background cleanup, retries and service-provider retention can affect when removal finishes.

Our cleanup routines can be delayed by outages or failures. A failed cleanup may need developer intervention. Email support@micnoteai.com if you need confirmation that a deletion has completed or want us to review retained records. Copies already sent to service providers are also subject to their terms and retention requirements; we cannot promise immediate removal of every provider-held copy.

Where a legal obligation requires us to retain a record, we retain only what is needed for that obligation. Retained security records are not used to restore deleted notes or build advertising profiles.

9. Data storage and international transfers

Your data is processed primarily in the European Union. Our application servers and databases are hosted by Hetzner in the EU. Uploaded audio and PDFs are stored by Amazon Web Services in Frankfurt, Germany. Product analytics use PostHog’s EU Cloud in Frankfurt. Website delivery and third-party processing may involve other locations.

Personal data nevertheless leaves the EEA in two situations. First, the developer is based in Azerbaijan, which is outside the European Economic Area and is not covered by a European Commission adequacy decision, so administrative access to the service takes place from Azerbaijan. Second, some service providers operate outside the EEA — the AI providers listed in section 6, and Apple, Google and RevenueCat, which are US companies. This means your personal data may be transferred to, stored in, or accessed from countries outside your own, including the United States, which may not offer the same level of data protection as your home country.

When we transfer personal data out of the EEA, the UK or Switzerland, we rely on a lawful transfer mechanism under Chapter V GDPR:

• Standard Contractual Clauses (Article 46(2)(c) GDPR), in the European Commission's 2021 form, together with the UK International Data Transfer Addendum where UK data is involved — this is our default basis with service providers;
• an adequacy decision (Article 45 GDPR), where the destination country has one;
• certification under the EU–US Data Privacy Framework, where the provider is certified.

We also carry out a transfer risk assessment where required and apply supplementary measures such as encryption in transit and access controls. You can ask us for a copy of the safeguards that apply to a specific transfer by writing to support@micnoteai.com.

10. Your rights under GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights over your personal data. They are free to exercise, and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you why).

• Access (Art. 15) — ask whether we hold data about you and get a copy of it, together with information about how it is used.
• Rectification (Art. 16) — have inaccurate data corrected. You can edit your display name, note titles and note content directly in the app.
• Erasure (Art. 17) — have your data deleted. You can do this yourself at any time (see below).
• Restriction (Art. 18) — ask us to stop processing your data while a dispute about its accuracy or our legal basis is resolved.
• Portability (Art. 20) — receive the data you gave us, and the notes generated from it, in a structured, commonly used, machine-readable format, and have it sent to another provider where technically feasible.
• Objection (Art. 21) — object to processing based on our legitimate interests, including product analytics and ad campaign attribution. We will stop unless we can show compelling legitimate grounds that override your interests.
• Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time, without affecting processing that already happened. Withdrawing microphone or notification permission in iOS Settings has immediate effect.
• Not to be subject to automated decision-making (Art. 22) — we do not make decisions with legal or similarly significant effects about you by automated means.

Deleting your account

To delete your account, open Settings → Delete account in the app. This requests removal of your profile, notes and associated audio or documents, and clears account data and recordings on the device. Removal across services may take time and failed cleanup may require intervention. The limited records that can remain, including device usage counters, are explained in section 8.

Account deletion is permanent and cannot be undone: there is no soft delete, no recycle bin and no restore window, so please export anything you want to keep beforehand. Deleting a single note requests removal of that note and its stored audio or document; cleanup can take time. The narrow exceptions that survive deletion are listed at the end of section 8. Account deletion does not cancel an active App Store subscription — you must cancel that in iOS Settings → your name → Subscriptions, because only Apple can manage the subscription and any refund.

How to exercise your other rights

Email support@micnoteai.com from the address associated with your account and tell us what you want. We may need to ask a question or two to confirm you are the account holder — we do this to stop someone else obtaining or deleting your notes, and we will not ask for more identifying data than we need.

Complaints

If you believe we have handled your data unlawfully, we would like the chance to put it right, so please contact us first. You also have the right to lodge a complaint with a data protection supervisory authority — in the EEA, the authority in the country where you live, work, or where the alleged infringement took place; in the UK, the Information Commissioner's Office (ico.org.uk). A list of EEA authorities is published at edpb.europa.eu.

11. Your rights under CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights described below.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. We have not done so in the preceding 12 months, and we do not sell or share the personal information of consumers under 16 years of age. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" link to provide — but if this ever changes, we will update this policy and offer an opt-out before it takes effect.

Categories collected. In the past 12 months we have collected the categories described in section 3, which map to the CCPA categories of identifiers (account ID, email, device and push tokens), customer records (name, email), commercial information (subscription and purchase status, and the Apple Ads campaign that led to the install, if any), internet or network activity (in-app product analytics), audio and electronic information (your recordings, transcripts and chat content), and inferences drawn from your onboarding answers. The sources, purposes and recipients are set out in sections 3, 4 and 7.

Sensitive personal information. Your recordings and transcripts may contain whatever you chose to record. We use that content only to deliver the service you asked for — transcription, summarisation and chat — and never to infer characteristics about you. We therefore do not use or disclose sensitive personal information for purposes beyond those permitted by CPRA section 1798.121, and no right to limit its use applies.

Your rights are:

• Right to know — request the specific pieces of personal information we hold about you, and the categories collected, the sources, the business purpose, and the categories of third parties they were disclosed to.
• Right to delete — request deletion of your personal information, subject to the exceptions in the statute (for example records we must keep for tax purposes). You can exercise this immediately yourself with Settings → Delete account in the app.
• Right to correct — request correction of inaccurate personal information; most fields are editable directly in the app.
• Right to opt out of sale or sharing — available to you even though we do not sell or share.
• Right to limit the use of sensitive personal information — see the paragraph above.
• Right to non-discrimination — we will never deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right. We offer no financial incentives in exchange for personal information.

How to submit a request. Email support@micnoteai.com with "CCPA request" in the subject line, or use the in-app deletion flow for deletion. We will confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days if we tell you why. We verify requests by matching the email address on the request to the account, and by asking about account details only you would know. An authorised agent may submit a request on your behalf with written permission signed by you, and we may still contact you to confirm it.

12. Device permissions

The app does not request access to your location, contacts, calendar, camera or health data. It does not use advertising identifiers or track you across other companies’ apps for advertising.

13. Children's privacy

Micnoteai is intended for people aged 13 or over, and 16 or over in the EEA, the UK and Switzerland. A higher minimum age applies where local law requires it. Users below the age of majority must meet the parental-involvement requirements in our Terms of Use.

We do not knowingly collect personal data from children below these minimum ages. We do not currently ask for a date of birth; Apple or Google sign-in is not proof that a user meets our age requirements. If you believe a child below the required age has provided personal data, contact support@micnoteai.com so we can investigate and arrange deletion.

14. Security

We use encrypted connections, access controls, iOS secure credential storage and app-integrity checks to protect the service. Local recordings and cached notes rely on iOS device protection and app isolation; the app does not add separate end-to-end encryption. Our servers and processing providers must be able to access the content needed for transcription, summaries and chat.

File playback uses temporary signed links. These links expire, but anyone who obtains a valid link may be able to use it before expiry. Access to account data is restricted, and the developer may access content where necessary to investigate a problem you report.

Security checks may use account identifiers, device verification information and IP-based request limits. These uses are separate from advertising, which the app does not contain. See section 8 for retention and deletion limitations.

No storage or transmission method is completely secure. Protect your device with a passcode, keep it up to date and keep your Apple or Google account secure. We handle personal-data breaches and notify affected people or regulators when applicable law requires it.

15. Purchases and subscriptions

Micnoteai offers a premium subscription through Apple's In-App Purchase system.

• Apple handles the payment. Your purchase is made with your App Store account. Card numbers, billing addresses and payment processing are entirely Apple's — the developer never receives, sees or stores your payment details.
• What reaches us. Subscription state — whether your premium entitlement is active, which product it is, and whether a purchase should be restored — reaches the app through RevenueCat, which verifies the App Store receipt. RevenueCat links this to a purchase identifier associated with your account, not to your recordings or notes.
• Free-tier limits. Our backend keeps counters of your usage against the free-tier limits so it knows what to allow. Some account-level counters and the device-level count remain after account deletion for abuse prevention, as explained in section 8.
• Managing and cancelling. Subscriptions renew automatically until cancelled. Manage or cancel yours in iOS Settings → your name → Subscriptions. We cannot cancel a subscription or issue a refund on your behalf — only Apple can, through reportaproblem.apple.com.
• Restoring purchases. "Restore purchases" asks Apple and RevenueCat to re-check your existing entitlement; no new personal data is collected.
• Records. Signing out resets the RevenueCat identity stored on the device. Purchase records that Apple and we must keep for tax and accounting purposes survive account deletion, as described in section 8.

16. Analytics and diagnostics

Micnoteai uses PostHog EU Cloud for product analytics and diagnostics. Events include screens opened, feature usage, paywall interactions and technical error information. They include app/device metadata and an analytics identifier that is linked to your account when you sign in. These are pseudonymous records, not anonymous data.

We do not intentionally include recording audio, transcripts, summaries, note titles, chat content or imported files in analytics events. Session replay is disabled. The app does not contain advertising or cross-app advertising tracking.

How to object. Email support@micnoteai.com with an analytics objection, using the email associated with your account where possible. There is currently no analytics switch in Settings. We can disable collection for your account through a remote setting; the app must connect and receive that setting for it to take effect. An objection preference is retained locally so sign-out does not silently undo it.

We rely on legitimate interests in maintaining and improving the app for this processing, subject to applicable law and your right to object. An objection stops future collection once applied; it does not automatically delete earlier events. You may also request access or deletion under section 10. Resetting the app’s analytics identifier on account deletion is not the same as deleting stored events.

17. Changes to this policy

We may update this policy when the app changes, when we add or replace a service provider, or when the law requires it. The "Last updated" date at the top always reflects the current version.

If we make a material change — for example collecting a new category of data, using your content for a genuinely new purpose, or adding a recipient that meaningfully changes where your data goes — we will give you notice inside the app before the change takes effect, and where the law requires it, we will ask for your consent. Continuing to use the app after a non-material update means the updated policy applies to you.

We will not retroactively reduce the protections that applied to data we already hold without telling you first.

18. Contact us

Privacy, data requests and app support: support@micnoteai.com

Data controller: Hamid Manafov, individual developer, Azerbaijan. A postal contact address is available on request.

You can write in English or Azerbaijani. We aim to reply within a few business days and handle formal privacy requests within the applicable statutory deadlines described above. Please describe your request without attaching private recordings or documents unless they are needed and we have agreed a suitable way to receive them.