Privacy Policy

Your creative work is stored on your device. Local writing, keyword search and on-device intelligence work with local data. Signing into a Noteworthy account does not automatically move local creative data to Firebase. Failed-save drafts are kept on device for recovery.

Protected passwords and saved sharing-link secrets are stored in Apple Keychain. Synchronizable items can be replicated through iCloud Keychain. Delete Local Work retains them by default; a separate explicit option requests deletion of this app’s protected secrets on all devices through iCloud Keychain.

When iCloud sync is enabled, eligible notes, relationships, versions and attachments are sent to your private Apple CloudKit database. Large bodies and attachments use CloudKit asset encryption; Noteworthy does not currently provide its own end-to-end encryption for those assets. Account changes and deliberate cloud-data removal require a decision before this device uploads again.

A Noteworthy account uses Firebase Authentication. We store an account ID, email and profile update time in Firestore; we do not store your password in that profile. Apple and RevenueCat handle purchase validation, entitlement status and restoration. Account deletion does not cancel Apple subscriptions; manage those in your Apple subscription settings. Apple and RevenueCat may retain transaction records for legal and accounting purposes.

Noteworthy Cloud, cloud AI and semantic search are optional online features. When used, eligible content, prompts, queries and identifiers travel through our Firebase gateway. Cloud AI and embeddings use the provider configured for that request, which can include OpenAI, Google Gemini, Claude on Google Cloud or Anthropic. User exclusions and protected-content controls limit what the gateway accepts. Cloud AI does not replace your local creative repositories. OpenAI requests set store: false; this setting alone does not establish every vendor's retention or training policy. Contractual retention, training use, regions and subprocessors depend on the provider and the applicable vendor terms for the production configuration.

Sharing and collaboration send the content you choose to share, comments and membership/presence information to the service so intended readers and collaborators can access it. Scan features process the images you select and produce drafts for you to review. Adding reference links can request metadata from the linked website. Playing embedded media connects to its provider, which can receive network metadata such as your IP address under its own policies.

Look Up and the Toolbox’s Dictionary show a dictionary entry from the Free Dictionary API (dictionaryapi.dev), a community service built on Wiktionary. When you look up an English word or phrase, the app sends that word or phrase to the service and nothing else: no note text, no account or device identifier. It’s sent only when you look something up, and the answer is kept on your device for up to 30 days. Tapping play on a pronunciation fetches the recording from the same service. Like any web request, it carries network metadata such as your IP address, which the service handles under its own policies. We can switch this off remotely.

We use operational event codes, usage counts, timing and cost data to keep online services reliable and control spending. Application log schemas exclude note text, secrets, prompts and provider response content. A pseudonymous account hash is not anonymous. Log retention and vendor diagnostic collection depend on the deployed service configuration. Crash reporting is described below and in the app manifest.

You can exclude eligible items from cloud AI and smart search, turn off smart search, remove its cloud index, delete your Noteworthy Cloud copy, manage shared access, or delete your Noteworthy account. These are different actions. Account deletion removes service-owned account/cloud/search data and memberships; it preserves local work and your private iCloud data. Delete local work only through its separate, explicit action. Some legal purchase records and service logs may remain according to verified retention policies. To block stale sessions and resume interrupted deletion, we retain a minimal server-owned record of the deleted account ID, deletion request/cloud-cleanup times and whether the subscription cancellation notice applies. It contains no email, name, creative content or credentials. Active requests or issued upload URLs can delay completion; late uploads are removed by service cleanup.

The app does not include advertising or app-code tracking. Third-party services and SDKs have their own policies; SDK privacy manifests describe their data collection. We do not sell your creative content.

Reliability diagnostics

The live app uses Firebase Crashlytics for crash and reliability diagnostics. App-owned nonfatal reports use fixed failure categories rather than note text, prompts, passwords, email addresses or original error messages. We do not set an account user identifier in Crashlytics. Diagnostic retention and operational access are governed by service settings.

The app checks a Noteworthy server setting at launch so we can switch a feature off remotely if it misbehaves. This request contains no account information or content.

Delete Local Work removes device-owned creative stores after a fresh launch, preserves remote creative copies and account/purchase identity, and keeps syncing and cloud indexing paused until you explicitly allow downloads and restart again. This action does not delete remote CloudKit zones or send creative-content deletion requests to Noteworthy Cloud.