Privacy Policy

Last updated: 26 October 2026

About this policy

This policy explains what personal data Teapot Notes ("we", "us") collects, why, who receives it, how long it is kept, and what control you ("you") have over it.

It covers the Teapot Notes apps for iPhone and iPad, Android and Mac, the website teapotnotes.com (including its waitlist form) and the Teapot Notes online service the apps use for sign-in, Premium, settings, downloads, crash reports, Share for Improvement and the buy-for-desktop link (together, the "Services"). It does not cover services run by others, such as Google Drive or the app stores, which have their own privacy policies.

Your notes stay on your device and, if you turn on sync, in your own Google Drive. They are not stored on our servers and we can't read them, except a notebook you choose to send us with "Share for Improvement".

Who we are

The Services are provided by Teapot Notes, Antalya, Türkiye. You can reach us at [email protected].

Data we collect

You can use the free features, the free trial and Google Drive sync without an account. What we collect depends on what you use:

Account. An account is optional and is needed only to buy Premium. Sign-in works with a one-time code sent to your email address; there is no password. We keep your email address, the language you chose, and your sign-in sessions, each with the IP address and user agent of the device that signed in. If you change your email address, we keep a hash of the previous address with the time of the change.
Sign-in codes. Each time a code is requested, for any address including a mistyped one, we keep that address with the pending code and its expiry time, and a hash of the address with the time the code was sent.
Purchases. The product you bought, the dates, the subscription status and the store transaction ids, and the purchase events the app stores report through our subscription management provider (including prices and country). We never see your card or payment details.
Devices. When you sign in on a device: a hashed device key, the platform, the model, and when the device was last seen.
Free trial. The trial belongs to the device. We keep the hashed device key, the platform and model of the device, and the trial dates. On iPhone, iPad and Android, flags held by Apple or Google for the device record that a trial was used.
Shared notebooks. A notebook you send with "Share for Improvement" (see Feature notices).
Crash reports. Technical data about errors, unless you turn crash reports off (see Feature notices).
Server logs. When the apps or the website contact our servers, our hosting provider records the IP address and the requested address (URL). A sample of requests is also logged with the route, status and timing.
Waitlist. If you join the waitlist on the website: your email address, the time, and the page you came from.

Giving us an email address is optional; without it you can't sign in or buy Premium.

Data from other sources

App stores, through our subscription management provider: purchase and subscription events, transaction ids, product, status and dates.
Google Play Integrity: a check that the app runs on a genuine device, and two flags per device.
Apple DeviceCheck: two flags per device (trial used, had a device slot).
Google Sign-In, if you turn on Drive sync: access to your Drive app folder, your Google account email and name. These stay on your device and are never sent to us.

How we use data

To sign you in and run your account.
To sell and deliver Premium, restore purchases and keep tax records.
To give each device one free trial, manage device slots and recognise a device after a reset.
To prevent abuse, by limiting how often codes, shared notebooks and crash reports can be sent from one IP address or email address.
To find and fix crashes and errors.
To improve handwriting recognition, using notebooks you choose to share.
To tell you when your email address changes, and to let you buy Premium for the Mac from your phone.
To keep a record of deleted accounts for fraud prevention, security and legal reasons.
To tell waitlist members when the app launches.

Automated decisions and AI

Handwriting recognition, audio transcription and speaker separation, and shape correction run on your device. For these features, the apps don't send your ink or audio to us or to an AI service.

We review notebooks you share with "Share for Improvement" by hand and use them to evaluate and improve handwriting recognition.

We make no decisions with legal or similarly significant effects about you by automated means. The trial and device checks only decide whether a device gets a free trial or a device slot.

Who we share data with

We do not sell your personal data.

We give personal data only to service providers who process it for us, and only for the purposes above:

Hosting: our servers, database, storage, website and server logs.
Email delivery: sign-in codes and account notices.
Crash reporting: crash and error reports.
Subscription management: purchases and subscription status.
App stores: purchases, and the device checks described above.

We may also disclose personal data when the law requires it, or when we believe in good faith that it is needed to enforce our terms, prevent fraud or abuse, or protect the rights, safety or property of Teapot Notes, our users or others. If Teapot Notes or the apps pass to a new owner, personal data passes with them, and the new owner must keep to this policy.

Advertising

We show no ads, do not use your data for targeted advertising, and do not sell or share it for that purpose. The apps don't use an advertising identifier.

Third-party services

If you turn on sync, your library (notes, imported documents, images, recordings, transcripts and folders) goes to a hidden app folder in your own Google Drive and comes back from there. Google stores it under your agreement with Google and its privacy policy. You can stop sync at any time, delete the app data in Google Drive, or revoke the app's access at myaccount.google.com/permissions.

The app stores handle purchases under their own terms and privacy policies. Links to other websites are governed by their owners' policies. We are not responsible for how Google, the app stores or other websites handle your data.

Feature notices

Notes and imports. Handwriting, typed text, imported PDFs, photos and files stay on your device until you delete them. The app receives only the photos and files you choose or take.

Google Drive sync. Optional, off by default, free and needs no account. The app uses only its own hidden folder in your Drive (scope drive.appdata), not your other files. When the same note changes on two devices, the older version is kept in Drive for 30 days. Our servers never store your notes.

Audio recording and transcription. Recordings and transcripts are notes: they stay on your device, and in your Drive if sync is on. Speaker separation compares voices within one recording on your device to tell speakers apart; it identifies no one. Speech models download from our servers.

Share for Improvement. Optional, Premium, and per notebook: a notebook reaches us only when you tap "Share for Improvement" on it and confirm. We receive the whole notebook: its title, every page's strokes with pressure and tilt, the recognised text and the corrections you make on the review screen, together with the app version and build, platform, system language, recognition language, engine version and consent version, and a random installation id. The notebook is not linked to your account or email address. You can reset the installation id in Settings. Shared notebooks are kept in private storage until you delete them in the app (Settings) or ask us to by email at [email protected].

Crash reports. On by default; you can turn them off in Settings > Send crash reports. A report holds the error type and stack trace, steps leading to the error (without note titles), the device model and system version, the app version, an anonymous installation id and app session data. Reports pass through our server, which removes your IP address and keeps only these fields. They are built to leave out your notes, titles and text, and are not linked to your account. They are kept for 30 days.

Buy for desktop (Mac). The Mac app shows a QR code with your account id and email address in the link. When your phone opens it, the link, including your email address, appears in our server logs.

Free trial and devices. See Data we collect. The DeviceCheck and Play Integrity flags are stored by Apple or Google for the device, not by us.

Settings, downloads and updates. To fetch settings, language packs, speech models, the guide note and Mac updates, the app sends its version, build and platform. Your IP address reaches our servers in transit and appears only in server logs. Mac updates do not send a system profile.

Google user data

Teapot Notes' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The app requests only the drive.appdata scope, uses it only to sync your library to your own Drive, and keeps your Google account email and name on your device.

International transfers

We and our service providers may process your data in the European Union and the United States. Regional notices below describe the safeguards.

How long we keep data

Account, purchases and devices: while your account exists.
Free trial records: they belong to the device, not to an account, and are kept so that each device gets one trial. Deleting your account does not delete them.
After you delete your account: a record of the account (with the email address and id in changed form), purchases, devices and your language setting, for as long as needed for fraud prevention, security and legal reasons, or until you ask us to erase it.
Sign-in codes: expire after 10 minutes. Code-request records: 24 hours.
Sessions: until you sign out, delete your account, or after 365 days without use.
Shared notebooks: until you delete them.
Crash reports: 30 days.
Server logs: a short, rolling period set by our hosting provider.
Waitlist: until we send the launch notice or you ask to be removed.

In-app account deletion takes effect immediately. We answer erasure requests sent by email within the period the law sets, normally 30 days.

How we protect data

All connections to our servers, the website and Google Drive are encrypted. Sign-in codes are stored hashed, expire after 10 minutes and allow five attempts, and code requests are rate-limited. Device keys are stored only as hashes. Deleting an account needs a fresh emailed code. Drive access tokens are kept in your device's secure storage. No system is completely secure, so we cannot guarantee the security of your data, but we work to protect it.

Your rights and choices

You can:

Delete your account in the app: Settings > Account & Premium > Delete account, confirmed with an emailed code. Or email [email protected]. Your notes and Drive sync are not affected.
Ask us to erase the records kept after deletion by emailing [email protected] from your account's address. We erase them unless the law requires us to keep them or we need them to establish, exercise or defend legal claims.
Delete your notes and synced data: delete them in the app; in Google Drive go to Settings > Manage apps > Delete hidden app data; revoke access at myaccount.google.com/permissions; or uninstall the app.
Delete a shared notebook in the app (Settings), or by email to [email protected].
Correct your email address in the app: Account > Change email.
Remove a device in the app: Account, in the devices list.
Stop crash reports in Settings > Send crash reports.
Reset the installation id used for shared notebooks in Settings > Reset installation id.
Ask for a copy of your data or ask any other question at [email protected]. For account and subscription help, write to [email protected].

Depending on where you live, you may have further rights, including the right to complain to a data protection authority; see Regional notices.

Children

The Services are not meant for children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, email [email protected] and we will take steps to delete it.

Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you in the app or on this page before it applies.

Contact us

Teapot Notes, Antalya, Türkiye [email protected]

Regional notices

European Union

Controller. Teapot Notes, Antalya, Türkiye ([email protected]) is the controller of your personal data.

Legal bases. We process personal data on these bases under the GDPR:

Performance of a contract: sign-in and the account; selling and delivering Premium; the free trial and device slots; notifying you of an email change; buy for desktop.
Legal obligation: tax records of purchases; account records kept after deletion where the law requires them.
Legitimate interests: preventing trial abuse and other abuse through rate limits (our interest in the security of the Services); fixing crashes and errors (our interest in a working app; you can turn crash reports off); keeping account records after deletion for fraud prevention and security.
Consent: notebooks you share with "Share for Improvement"; the website waitlist. You can withdraw consent at any time by deleting the notebook or asking to leave the waitlist; this does not affect processing before the withdrawal.

Your rights. You have the right to access, rectify and erase your personal data, to restrict or object to its processing, in particular processing based on legitimate interests, and to data portability. Use the routes in Your rights and choices or write to [email protected]. You also have the right to lodge a complaint with the supervisory authority in the EU member state where you live or work, or where an alleged infringement took place.

Transfers. Where personal data is transferred outside the EEA, including to the United States, we rely on the standard contractual clauses offered by our service providers, or on the EU-U.S. Data Privacy Framework where a US provider is certified under it. You can ask for a copy of these safeguards at [email protected].

Türkiye

This section is the notice under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK").

Data controller. Teapot Notes, Antalya, Türkiye, [email protected].

Purposes. We process your personal data for the purposes listed in How we use data.

Method and legal basis of collection. We collect personal data electronically, through the apps, the website and our servers, from you, from your device and from the app stores, as described in Data we collect and Data from other sources. We rely on these grounds under Article 5 of the KVKK:

the processing is necessary for the establishment or performance of a contract with you (account, Premium, free trial and device slots, email-change notice, buy for desktop);
the processing is necessary for us to comply with a legal obligation (tax records; account records kept after deletion where the law requires them);
the processing is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms (abuse prevention, crash reports, account records kept after deletion);
your explicit consent (Share for Improvement, the website waitlist).

To whom and why data is transferred. We transfer personal data to our service providers in the categories listed in Who we share data with (hosting, email delivery, crash reporting, subscription management, app stores), so they can provide those services to us, and to authorised public institutions where the law requires.

Transfers abroad. Our service providers process personal data in the European Union and the United States, so your personal data is transferred abroad for the purposes above.

Your rights (Article 11). You have the right to learn whether your personal data is processed; to request information about it if so; to learn the purpose of the processing and whether data is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request its rectification if it is incomplete or inaccurate; to request its erasure or destruction under the conditions of Article 7; to request that rectification, erasure or destruction be notified to the third parties to whom it was transferred; to object to a result against you that arises from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.

Applications (Article 13). Send your request to [email protected]. We will answer it as soon as possible and within 30 days at the latest.

United Kingdom

Controller. Teapot Notes, Antalya, Türkiye ([email protected]) is the controller of your personal data.

Legal bases. We process personal data on these bases under the UK GDPR:

Performance of a contract: sign-in and the account; selling and delivering Premium; the free trial and device slots; notifying you of an email change; buy for desktop.
Legal obligation: tax records of purchases; account records kept after deletion where the law requires them.
Legitimate interests: preventing trial abuse and other abuse through rate limits; fixing crashes and errors (you can turn crash reports off); keeping account records after deletion for fraud prevention and security.
Consent: notebooks you share with "Share for Improvement"; the website waitlist. Withdrawing consent does not affect processing before the withdrawal.

Your rights. You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Use the routes in Your rights and choices or write to [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Transfers. Where personal data is transferred outside the UK, including to the United States, we rely on our service providers' standard contractual clauses with the UK Addendum, or on the UK Extension to the EU-U.S. Data Privacy Framework where a US provider is certified under it.

United States

State privacy notice. We collect these categories of personal information, as US state privacy laws define them:

Identifiers: email address, IP address, hashed device key, account id, installation ids, store transaction ids.
Commercial information: Premium purchases and subscription status.
Internet or other electronic network activity: server logs and crash reports.
Other information you choose to give us: notebooks you send with "Share for Improvement".

The sources, purposes and recipients of each are described in Data we collect, Data from other sources, How we use data and Who we share data with. We do not collect sensitive personal information as defined by these laws. We do not sell or share personal information, and we do not use it for targeted advertising.

Requests. Where a US state privacy law applies to us, you may have the right to know, access, correct and delete your personal information. Use the routes in Your rights and choices or write to [email protected]. We verify a request by confirming that you control the email address of the account concerned.