Privacy
Notations (notations.app)
Notations is a personal markdown notes app. The short version: your notes are yours, each account’s data is isolated from every other account at the database level, and nothing you write is sent to another company unless you switch on a feature that needs it and supply your own API key for it. There is no advertising, and no third-party analytics or tracking inside the app. The public marketing pages use Google Analytics, described under “Usage data” below.
Signing in
You sign in with Google or with Apple. Notations runs that sign-in itself and issues its own session cookie; there is no third-party login provider holding a session for you. From Google we receive your email address and basic profile (name and avatar). From Apple we receive your email address — or, if you chose “Hide My Email,” a private relay address Apple forwards to you — and, the first time only, the name you let Apple share. We also store any display name and handle you choose. Your handle appears in the public URL of any note you publish or share.
The sign-in requests only basic scopes — your email address and basic profile (and your name, from Apple). Notations asks for no access to Google Drive or any other Google or Apple service. You can review or revoke the sign-in at any time from your Google account permissions or, for Apple, under Settings → your name → Sign in with Apple on an Apple device or at account.apple.com.
If you sign in with Apple, we also keep the token Apple issues for that sign-in, encrypted. It is used for one thing: when you delete your account, we hand it back to Apple to revoke Notations’ access to your Apple ID.
Where your notes live
- Notes, folders, tags and metadata— a Postgres database on Notations’ own server, hosted by Hetzner in Helsinki, Finland.
- Images you upload, and audio generated by text-to-speech — Cloudflare R2 object storage.
- A copy on your device— with offline mode on (the default), a full copy of your notes is kept in your browser’s IndexedDB so the app works without a connection. It never leaves your browser, and turning offline mode off in Settings erases it.
Features that send your notes to another company
These are all off until you turn them on, and each one requires you to paste in your own API key for the provider you pick. The keys are encrypted before they are stored, and are decrypted only to make the request you asked for. If you never add a key, none of these features run and none of your text is sent anywhere.
- Cloud text-to-speech — the text of whatever you press play on is sent to Google Cloud Text-to-Speech or OpenAI, whichever you configured.
- Semantic search — your note text is sent to OpenAI to compute the embeddings that make meaning-based search work.
- The chat assistant — the notes in scope for your question are sent to the provider you chose: Anthropic, OpenAI, Google Gemini, or Groq.
- AI titles — when a voice note, scan, or Siri note arrives in the iOS app without a title, the start of its text is sent to the provider whose key you added (Google, Anthropic, OpenAI, or Groq) to write one. Off unless you turn on Settings → Notes → AI titles; off, the title is written on your iPhone.
The on-device voice is the exception: it runs entirely in your browser and no text is transmitted. The first time you use it, your browser downloads the voice model from the jsDelivr CDN, which will see your IP address the way any file download does.
If you connect the optional Plaudintegration, Notations fetches your recordings’ transcripts and summaries from Plaud on your behalf and saves them as notes.
Usage data
Notations records usage events linked to your account — which pages you open, which buttons you tap, and counts such as how many results a search returned — in its own first-party database, to find breakage and slow pages. Your search terms and the names of the notes, folders and tags you click are not recorded, though a page’s address (which can contain a note’s or folder’s name) is. This data is not sold or shared, and there are no third-party analytics scripts, advertising, or tracking pixels anywhere in the app.
The public marketing pages — the home page for signed-out visitors, and the guides, comparison and pricing pages — use Google Analytics to count visits and see which pages people read. Google Analytics sets cookies and receives your IP address, browser details and the pages you view on those marketing pages; see how Google uses this information. It is not loaded on your notes, settings, public note links, or in the iOS app, and nothing you write is ever sent to it.
The iOS app
- Voice notes and scansare transcribed and read on your iPhone. Voice audio is never uploaded; only the text is saved as a note. A scan’s page images are uploaded only if you turn on “Attach page images” for that scan.
- Notifications— if you allow them, we store your device’s push token and a device name so we can send you reminders and alerts about your notes. Signing out removes them.
- iPhone Search, widgets and Siri — titles and excerpts of your notes are indexed on your device by iOS so they can appear in Search, widgets and Shortcuts. That index stays on the device.
- Error reports — if a page fails, in the app or on the web, a short report (what failed, where, and an error ID) is sent to Notations itself, never to a third party, so we can fix it.
Children
Notations is not directed at children. You must be at least 13, or the minimum age in your country if that is higher, to create an account (see the Terms of Use). We don’t knowingly collect personal information from children under 13; if you believe a child has created an account, contact us and we’ll delete it.
Notations Capture (Chrome extension)
The Notations Capture extension lets you save the page you are looking at (and any selected text) into a Notations “Clips” folder. It does the following:
- Reads the title, URL, and any text you have selected on the currently active tab when you click the toolbar icon, choose a right-click menu item, or use the keyboard shortcut.
- Opens a new tab to
https://notations.app/composewith the captured text pre-filled in the URL querystring. You then choose to save (or discard) the note in the Notations app.
Data collection. The extension does not collect, store, sell, or transmit any personal data to anywhere other than Notations itself. There is no telemetry, no analytics, no third parties. The only outbound network request the extension makes is the new-tab navigation to notations.app.
Permissions.
activeTab+scripting— read the title, URL, and current text selection of the tab you are on, only when you invoke the extension.contextMenus— register the “Save selection to Notations” and “Save page to Notations” entries in the right-click menu.host_permissions: https://notations.app/*— required so Chrome lets the extension navigate to the compose page.
Data retention & deletion
To delete a note, use the Delete button on the post page. To delete your entire account, use Settings → Danger zone → Delete account; this removes your account and cascades to every note, folder, image, audio file, and stored credential you own, and revokes Notations’ access to your Apple ID if you signed in with Apple. You can export everything as a zip of markdown files from Settings → Export at any time, including before deleting.
What may be published or shared, and how reports and blocking work, is covered in the Terms of Use.
Contact
Questions or requests: stefan.klocek@gmail.com.