Privacy Policy

This policy explains what SonaNote does with your information and what rights you have. There is no account and no sign-in. It is also published at https://sonanote.app/privacy.

Who we are

MB Daivina (Mažoji bendrija Daivina), established in Lithuania, makes SonaNote and is the controller of the personal data described here.

MB Daivina (Mažoji bendrija Daivina)
Lauko g. 6, Kvetkai, LT-41212, Lithuania

Write to support@sonanote.app with any privacy question. We have not appointed a data protection officer, as we are not required to.

What stays on your device

Your notes, pictures, flashcards, schedules and settings live in SonaNote's private storage, which your operating system keeps apart from other apps and encrypts at rest. Reading a photograph or a PDF, transcribing a recording, and every map and count you see happen there.

What leaves your device, and when

Most of these you start yourself. Two happen on their own when the app opens.

Opening the app. SonaNote asks our subscription-management provider whether a subscription is active here, and asks your device's platform to prepare the signed statement described below. Neither carries a note.
Distilling, or asking a question. Distill sends that note's title, text and up to four of its pictures to our service, which passes them to our AI provider in the European Union and streams the study kit back. Ask sends the title and text with your question, without pictures. Our service holds either in memory only while it is answered, and writes none of it to storage.
Reporting something the app wrote. Report sends the text SonaNote wrote, which is drawn from your note and may quote it; what it was asked for; anything you type; the category; the app version; and your installation identifier. It sends no other note. We read it, change how the feature behaves, and use it for nothing else.
Backups, exports and mail. Your device's system backup copies the app's database and pictures, note content included, to the cloud account signed in there; you can switch it off for this app in your backup settings. Anything you export, share, print or mail to us goes where you send it.
Dictation. SonaNote asks your device for on-device recognition and uses it where your device provides it. Where your device has none, dictating opens your device's own recogniser, which may send the audio to its vendor under that vendor's policy. No audio reaches us, and an imported recording is transcribed on the device.
Text recognition. The component that reads a photograph or a PDF runs on your device: no picture and no text from it reaches us or anyone else. The component does report on itself to the company that makes it, which we can neither read nor switch off, and which carries no note content. Because we chose to include it, we declare what it sends as collected through SonaNote.

Where the GDPR applies, distilling, asking and dictation perform our contract with you. The rest rests on our legitimate interests: metering the free plan, keeping the service available and free of abuse, keeping what the app writes accurate and safe, and shipping a text reader that keeps working.

Nothing obliges you to give us any of this. There is no account to fill in and no field that asks who you are; a note, a question or a report travels only because you pressed Distill, Ask or Report. If you never press them, nothing of yours leaves the device except the two checks that run when the app opens, and neither of those carries a note.

We seek out information about nobody, and we usually cannot identify a person named in a note, so please keep other people's details out of what you send. SonaNote is also not built for notes about health, beliefs, politics or sex life. A note is whatever you wrote, so if you distil one of those it goes with it, and we ask you to think before you do.

What travels beside the note

Your installation identifier goes with every distill, question and report: a random value made at first run, tied to nothing about you, which meters the free plan and paces requests.
Your subscriber identifier goes with every distill and question, whether or not you subscribe, because it is how our service asks whether a subscription is active and it needs the answer no as much as yes. It names no person, but it is not anonymous to us: our service records the first installation to present it, so that one subscription cannot be spread across many phones. If you are paying and SonaNote stops recognising you, write to us.
A signed statement your device's platform makes about the request: that this is an unmodified copy of SonaNote running on a genuine device. Your device's platform builds it, partly from your app-store account and that device's recent activity, under its own privacy policy. We cannot read it ourselves, so our service hands it back to that platform to be read, and keeps no copy.

Our service also sees the network address a request comes from. It keeps counts so the allowances work, and writes one log line per request carrying a few characters of the installation identifier and how the checks came out — never note text, never a question, never a report. Of all of this, only the installation identifier is something the service cannot work without.

We build no profile of you and make no decision about you as a person. Our service does judge automatically how fast and how many requests arrive from one installation, and may delay or refuse them for a time; it never reads your notes to decide. Write to us if it stops you wrongly and a person will look.

Who else is involved

A few companies handle information for us. This policy describes them by what they do rather than by name, which the law allows. If you would rather know exactly who they are, write to support@sonanote.app and we will tell you: when you ask, you are entitled to their identities and not merely to these descriptions. That applies to every company named on this page, including the two that are not our processors.

Our AI provider writes your study kits and the answers to your questions, on servers in the European Union. It does not use your notes to train its models. It may keep a copy briefly, readable by a person there, solely to detect abuse of its own service, after which it is deleted.
The provider that runs our relay carries a note to the AI provider and the result back, keeping no copy of its own; the counts, the log and your reports sit on that provider's network for us.
Our subscription-management provider records your purchase so that a subscription survives a new device, and answers whether one is active. It receives no notes.
Our email provider carries messages you send to support@sonanote.app.

Each of those acts as our processor under a written data processing agreement: to act only on our documented instructions, to keep your data confidential and secure, to use it for nothing of its own and never for advertising, to add no one else without our authority, and to delete or return what it holds when the work ends.

Two companies are not our processors. Your device's platform reads the signed statement as the controller of its own service, under its own policy. The company that makes the built-in text-recognition component receives that component's reports about itself under its own policy, and we never see them; we chose to include it, so we answer to you for that choice, and we are satisfied it is not used to advertise to you.

Distilling and asking are processed in the European Union. Our relay runs worldwide, so the counts, the log and your reports sit wherever on that network they were created, which may be outside the European Economic Area, and some of these companies belong to United States groups. Transfers out rest on a European Commission adequacy decision where one applies, and otherwise on standard contractual clauses — for a transfer out of the United Kingdom, on the UK Addendum to those clauses. Write to us and we will send you a copy of the safeguards that apply.

How long we keep things

Notes and everything built from them stay on your device for as long as you keep them. A note you distil or ask about, and your question, we do not keep at all.
Reports about generated content: up to 24 months, and sooner than that where newer reports crowd an old one out. Ask us and we will delete yours; say roughly when you sent it and what it was about. Messages you send us are kept up to 24 months after the matter is closed.
The counts: about a month against an installation, including which notes were distilled on the free plan, recorded by their number on your device and never by their text; about a day against a network address; a subscription's own period against a subscription. They expire by themselves. The log is kept briefly.
Which installation a subscriber identifier was first seen on: kept for as long as that identifier exists, with no expiry, because a pairing that lapsed would let one subscription spread across devices. Ask us and we will erase yours.
Purchase records: for the life of the subscription, and then for as long as tax law requires, which in Lithuania is generally ten years. We hold no invoice and no payment card details.

Your rights

Over your notes you exercise most rights yourself: you can read, edit, export and delete any of them without asking us. Over the personal data we hold you have the right of access and to a copy, including the identities of the companies it has been disclosed to; to correction; to erasure where the law allows; to restriction; to portability; and to withdraw consent where consent is the basis.

You also have the right to object. Where we rely on our legitimate interests — that is the identifiers, the counts and the log, the signed statement, your reports, and the text component's own reports — you may object at any time, and we will stop unless we can show compelling grounds that override your objection.

Write to support@sonanote.app to exercise any of them. We answer within one month, and we will say so if we need longer or cannot comply. Because there is no account, what we hold is tied to a random identifier rather than to you; where we genuinely cannot work out which data is yours these rights do not apply until we can, so tell us anything that would help us find it.

There is no account to delete. If you want everything gone: remove the app, remove any copy your device's backup service holds in your own cloud account, and write to us about any report you sent. If you believe we have handled your data wrongly you may complain to your data protection authority. Ours is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt. We would appreciate the chance to put it right first.

Security

Everything that leaves your device for us travels over an encrypted connection, and access to the little we hold is limited to those who need it. No system is perfectly secure, and a device you have rooted, lost or shared is outside what any app can protect. Nothing in this section limits our liability or takes away a right the law gives you.

If you are in the United States

This is our notice at collection. We collect identifiers (your installation and subscriber identifiers, and your network address); your own content (a note you distil or ask about, its pictures, your question, and what a report carries); commercial information (a subscription's plan, status and dates); device and internet activity (the counts and the log); and whatever you write to us. All of it comes from you or from your device, and each is kept for the period set out above, for the purposes set out above.

We never ask for sensitive information and nothing here is built to collect it, but a note is whatever you wrote: distil one about your health, your beliefs or your private life and that goes with it. We use it only to produce the kit or the answer, and we keep no copy.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we have done neither in the preceding twelve months. We do not sell or share the personal information of anyone under 16, we offer no financial incentive for your data, and we will not treat you differently for exercising a right. The one flow we do not control is the text-recognition component described above, which is declared as diagnostics shared with the company that makes it.

Because there is nothing here to opt out of, there is no Do Not Sell or Share link and no link to limit the use of sensitive personal information. SonaNote has no browser, so a Do Not Track or Global Privacy Control signal has nothing to act on, and no other party collects information about your activity across other websites or apps through SonaNote. To exercise a right, write to support@sonanote.app, or have an authorised agent write on your behalf with your authority.

Children

SonaNote is for people aged 16 and over. It is a general-audience study app, it is not directed at children, and we do not ask anyone's age. We do not knowingly collect personal data from a child under 13. If you are a parent or guardian and believe a child has sent us something, write to us and we will delete it.

Written by AI

Study kits, mindmaps and the answers you get when you ask a note a question are written by an AI model, in most cases from your own note at the moment you ask. The kits on the sample notes SonaNote starts you with were written the same way before the app shipped. Nothing in any of them was checked by a person first.

A model can be wrong while sounding certain. Treat what it writes as a study aid, check anything that matters against a source you trust, and do not lean on it for a medical, legal, financial or safety decision. That is advice about using SonaNote, not a limit on what we owe you.

If a kit, a mindmap or an answer is wrong, offensive or otherwise bad, tap Report on it; it reaches us without your leaving the app. We read every report and use them to change how the feature behaves.

Changes to this policy

If SonaNote begins doing something this policy does not describe, the policy changes with it and so does the date at the top. We change it only for a reason we can state: a new or altered feature, a change at a provider we rely on, or a legal or security requirement.

Where a change would mean more of your information leaving your device, or a paid feature working differently, we will tell you at least 30 days beforehand, in the app and at https://sonanote.app/privacy, in a dated version you can keep. If the change is more than minor and you have a subscription, you may end it free of charge within 30 days.