TapToNote — Privacy Policy

Effective date: 22 October 2026

TapToNote is provided by Serhii Onenko, an individual in Ukraine. Privacy contact: support@taptonote.app. The full App Store name is “TapToNote: Speak & Keep for AI”.

What the app handles

TapToNote creates a local record containing the text you type or dictate, a random entry ID, and creation and last-edit times. You may enter any kind of text, including sensitive information or information about other people. The app uses these records to display, edit, re-dictate, delete, export and, if you opt in, synchronise your log with connected copies. Local use needs no account. There is no advertising SDK. Usage statistics are off unless you turn them on, and problem reports are sent only when you tap Send (see “Problem reports and optional usage statistics”). If you explicitly enable optional cloud sync, we receive and store the text entries you synchronize, as described below.

On-device dictation

TapToNote uses Whisper through WhisperKit to transcribe speech entirely on your iPhone, including when offline. The multilingual model and tokenizer are included in the app installation; there is no separate model download, Apple Speech recognizer, or server-based transcription fallback. Your recordings, transcripts and learned vocabulary are not sent to Apple, OpenAI, Argmax, Hugging Face or us for dictation. Including Whisper in the app does not connect it to an OpenAI service. The model files are bundled in the app; the app does not download them.

When you dictate, the app records audio into a temporary file and saves the resulting text, not the recording. It attempts to delete temporary audio after processing finishes or fails. If the app stops unexpectedly, a temporary file may remain in the app's temporary storage. On a later launch, TapToNote removes its own UUID-named temporary audio files; iOS may also remove temporary files. Microphone permission is required; Apple Speech Recognition permission is not. You can revoke microphone access in iPhone Settings and continue typing.

If you use the optional Apple Watch app, it records your voice note on the watch and sends the audio to your paired iPhone, where the same on-device Whisper model transcribes it. The watch keeps the audio only until the iPhone has received it; the iPhone keeps it only until it is transcribed or discarded (a note that cannot be transcribed is retried a few times when the app is opened, then deleted). This audio never leaves your watch and iPhone, is not uploaded or synchronized to the cloud, and the app does not keep an audio library. Microphone permission is requested on the watch.

The model may need preparation on this iPhone before recording can begin, especially after installation or an iOS update. This preparation runs locally. The app shows a waiting status and the elapsed preparation time; it does not record while the model is preparing. Speech recognition can still be inaccurate or fail. It does not identify speakers or guarantee separation of voices in a noisy environment.

When you correct a short word or phrase in an entry, TapToNote may store the corrected wording and the original misheard wording in a small, language-specific vocabulary on your iPhone. It uses the corrected wording as a local Whisper hint and can replace the same misheard wording in a later transcript locally. This does not train a remote model. Corrections are not included in exports. Account → Delete… → Delete all entries also clears them. Open-source licenses are available in Account → Terms & Privacy.

This section describes TapToNote's microphone feature. If you use iOS keyboard Dictation to fill a text field, that separate system feature is governed by your Apple settings and Apple's Siri, Dictation & Privacy notice; it may use Apple servers. TapToNote does not control that system feature.

Storage, backups and exports

The app stores entries in an on-device SwiftData database shared with its own app components through an iOS App Group. It does not use CloudKit. Without an enabled cloud connection, local capture does not upload entries. Optional cloud sync requires sign-in and TapToNote Plus. Subscribing, after the consent text on the purchase screen, starts copying your entries to our server; signing out stops it. Your iPhone's iCloud Backup or a computer backup may nevertheless include app data, depending on your device settings. Backup copies are managed by Apple or the backup destination, not by TapToNote. You can manage iCloud Backup in iPhone Settings.

TapToNote keeps no backups of its own on the phone. Export your log to a file when you want a copy.

You can export a copy as a JSON file and choose where to save or share it through the iOS share sheet. The temporary export file is removed when sharing ends or on a later app start; a saved, mailed or shared copy remains wherever you sent it. Other apps and recipients handle those copies under their own terms and privacy practices.

Using an AI tool to read or change entries can send selected entry text to that AI provider under its own terms and privacy policy; TapToNote does not send your entire log to ChatGPT, Codex or Claude automatically.

Optional cloud connection

Local capture and dictation work without an account. Sign-in uses Sign in with Apple through Clerk, which handles account sign-in, your email and account identifier; Apple may give us your real email or a private-relay address. TapToNote does not receive your Apple password. See Clerk's privacy policy. Tokens are stored in this iPhone's Keychain, available only on this unlocked device. Signing in alone does not upload entries.

After you subscribe to TapToNote Plus and confirm on the purchase screen, all local text entries and streams, their identifiers, timestamps, revisions and deletion metadata are synchronized to our server on Oracle infrastructure in Tokyo, Japan. Audio and learned dictation vocabulary stay on the iPhone. While the app is open and online it coalesces changes and checks for remote updates; iOS may suspend it in the background. Offline changes remain local until a successful sync. Conflicts require your choice.

The server stores a random installation identifier and last contact/successful-sync times to report freshness. An old time means potentially stale data, not proof the phone is offline. We do not use this identifier for advertising or cross-app tracking.

HTTPS protects transport. The cloud copy is not end-to-end encrypted. The server processes readable text; the operator and hosting administrators may have technical access. Clerk receives authentication information, not log text. Oracle hosts the server; see Oracle's privacy information. Providers receive network/security information such as IP addresses. Our application diagnostics use fixed error categories and do not intentionally log entries, audio, emails, passwords or tokens.

You separately choose whether to authorize ChatGPT, Codex, Claude or another MCP-compatible assistant. Tools can read, search, add and edit your cloud entries. Entry deletion requires a separate user-confirmation form; clients without that confirmation support cannot delete. AI tools cannot delete your TapToNote account. Text returned to an assistant is handled under its provider's own privacy terms, including OpenAI's and Anthropic's privacy policies. We do not control or retract those copies. TapToNote itself does not analyze entries with AI. Use the same TapToNote account on iPhone and in the assistant; your assistant's sign-in email can be different.

Where EU/EEA rules apply, we process account and sync data to provide the service you request (GDPR Article 6(1)(b)); security and minimal deletion records serve our legitimate interest in preventing unauthorized access and restoration (Article 6(1)(f)). Optional cloud transfer requires your affirmative choice. If you choose to include your health or other special-category data, the purchase screen states that you explicitly consent to this by subscribing (Article 9(2)(a), where applicable). Do not upload another person's sensitive data without a valid legal basis. You can stop future uploads by signing out (Account → Sign out) or delete the account (Account → Delete… → Delete account and all entries). Withdrawal does not undo earlier lawful processing or retract third-party copies. No cloud choice is required for local use.

Account deletion and server retention

Open Account → Delete… and choose Delete account and all entries (Delete account, entries and cloud data with Plus). The app identifies the signed-in email and asks you to confirm permanent deletion of the account, its cloud data and all entries, streams and learned words on this iPhone. Export anything you want to retain first. Cancellation deletes nothing. A failed or unconfirmed request keeps local data and pauses sync until its outcome is checked.

Once accepted, the server durably blocks that account's sync and AI access, removes active cloud entries, streams and device metadata, and requests deletion of the Clerk identity and revocation of the app's Sign in with Apple authorization. A temporary Apple token is kept with the pending record only until Apple revocation finishes or is abandoned. If the provider is unavailable, deletion stays blocked and is retried automatically; the app reports a pending operation and lets you check its status. Completion is shown only after the identity deletion succeeds or the provider confirms that the identity no longer exists. The phone removes its local log, conflicts, sync checkpoints, vocabulary and connection credentials, and removes any pairing secret left by an older version.

Server database backups are taken daily with a seven-day maximum retention policy; an hourly operation expires old snapshots. A minimal separate deletion ledger prevents deleted accounts from reappearing after restoration. Pending operations retain the provider account ID until completion. Completed ledger entries retain only hashed account/receipt identifiers and deletion times for access blocking, safe restoration and completion verification, not entry text or email. This security ledger is kept outside the database backups, so it is not an old data snapshot. These backups currently reside on the same VPS; offsite disaster recovery is not configured.

Deleting the account does not remotely erase another phone's offline copy, a copy on another computer, previous exports, AI-provider conversations, support correspondence or iCloud/computer backups. Manage those separately. Account deletion prevents those devices from using the deleted cloud account. Underlying device or infrastructure storage may retain remnants; active-database deletion is not a promise of forensic erasure.

Cloud data is processed outside your country, including in Japan. We do not claim an adequacy decision or a specific contractual mechanism for these transfers. Do not use the cloud for regulated information.

Problem reports and optional usage statistics

Report a problem. Nothing is sent until you tap Send in the Report a problem form. A report contains the type you choose (Bug, Idea or Feedback), the message you type, a rating if you give one for Feedback, a trail of the screens you opened in the last five minutes (fixed screen names only, never any text), and technical details: app version, build configuration, iOS version, device model, a few fixed labels about the app (plan, sync state, theme and language) and a random installation identifier. It never contains your log entries, stream names, your account email or your account identifier. Please do not write sensitive information in the message. If delivery fails, nothing is queued or sent later; you can retry from the open form. If you are not using optional usage statistics, a report uses a one-off random identifier, so separate reports cannot be linked to each other. We use reports to understand and fix problems. Where EU/EEA law applies, the legal basis is our legitimate interest in maintaining the app. We keep reports only as long as needed to resolve them and never longer than the event retention of our PostHog plan.

Optional anonymous usage statistics. These are off by default. They are sent only if you answer yes to the question "Share anonymous usage statistics?" shown once at the start of the first launch, or turn them on later in Account. You can answer no and use the app the same way. When on, the app sends only these fixed event names: onboarding_started, mic_permission_granted, mic_permission_denied, model_ready, action_button_set, app_opened, terms_accepted, sign_in_started, sign_in_completed, cloud_consent_granted, cloud_consent_declined, first_entry_saved, connect_ai_opened, assistant_link_copied, subscription_opened, purchase_started, purchase_completed, purchase_cancelled, export_used. The only properties beyond the event name are the assistant name (assistant_link_copied) and the export file format (export_used), plus the same technical details as above (app version, build configuration, iOS version, device model) and a random installation identifier. Events never contain entry text, transcriptions, stream names, search text, your account email or identifier, tokens or file contents. Events are sent anonymously: no person profile is created, IP-address geolocation is disabled, no advertising identifier (IDFA) is used and there is no tracking across other companies’ apps or websites. We use them to see where people stop in the app and to improve it; where EU/EEA law applies, the legal basis is your consent.

Processor and location. Reports and usage events are sent over HTTPS to PostHog (PostHog, Inc.), our analytics processor, through its host eu.i.posthog.com. PostHog’s EU cloud host stores this data in the European Union; PostHog acts as our processor under its data processing agreement. The network request necessarily reveals your IP address to PostHog’s servers; geolocation from it is disabled on every event. See PostHog’s privacy policy.

Withdraw consent. Turn off Account → Share anonymous usage statistics. Sending stops immediately and the stored installation identifier is deleted from this iPhone. Because events are anonymous and not tied to your identity, we cannot find and delete the events already sent earlier; they contain no entry text. Turning the switch on again creates a new random identifier. Reports you already sent can be corrected or deleted on request at support@taptonote.app if you include the email address you gave in the report.

Retention, deletion and your choices

Entries remain in the app's local database until you delete individual entries, use Account → Delete… → Delete all entries, or remove the app. Deletion removes entries from the active app database; iOS controls underlying storage reclamation. Deleting from the app does not delete earlier exports, messages, recipients' copies or device backups. Manage those separately with the relevant service or backup settings. With cloud sync active, deleting an entry or all entries (Delete all entries and cloud data with Plus) also deletes the cloud copy once your iPhone is online; only a deletion marker without text remains. You can review your entries in the app and export them before deletion.

You can revoke microphone access in iPhone Settings. This affects future dictation and does not delete existing text entries. If you used Apple speech recognition in an earlier version of TapToNote, use Apple’s privacy controls for any data already processed by Apple; this update cannot retract it.

Support email

If you choose to email us for support, Serhii Onenko receives your email address, message and any files you include. Please avoid sending sensitive log entries unless they are needed to explain your request. Providing support information is optional, but without a return address we cannot reply. We use it to answer and follow up on your request; where EU/EEA data-protection law applies, our legal basis is our legitimate interest in providing support. We do not use support messages for advertising.

Our Gmail service (Google) and your email provider handle the correspondence. Email providers may process data in other countries; see Google's privacy information and transfer information. We keep support correspondence while needed to resolve and follow up on your request, or for an applicable legal obligation or active dispute, and delete it when those reasons no longer apply. Support email contains only the information you choose to send. Entries separately uploaded through an enabled cloud connection are handled as described in the cloud-sync section.

For information we hold through support email, you may request access, correction, deletion or restriction, or object to our legitimate-interest processing, at support@taptonote.app, subject to applicable law. Where applicable, you may also have a right to portability. For your account and cloud data, you can request access, a copy, correction or deletion at the same address; we reply within one month, and you may complain to your data-protection authority. We cannot retrieve or erase entries from your device, device backups or copies you shared. For the optional cloud copy we operate, account/data deletion is described in the cloud-sync section.

Children

TapToNote is not directed to children under 13 (or under the age of digital consent in your country, up to 16). We do not knowingly collect data from them; if you believe a child has given us data, write to support@taptonote.app and we will delete it.

TapToNote Plus subscription and purchase records

Apple processes App Store subscriptions. We receive the subscription product, original/current transaction identifiers, validity, refund/revocation status and a random app-account token linked to your TapToNote account to verify access. We do not receive payment-card details or your Apple account password. These account-linked purchase records remain while the cloud account exists and are removed when account deletion is accepted, subject to seven-day server backup expiry. Apple retains its own records under its terms and privacy policy. We use this data for service performance and security, not advertising.

Expiry stops sync and authorized AI access, without deleting phone data. You can still export your log or delete the account without renewing; to receive a copy of your cloud data, email support. After 365 days without an active subscription, measured from its verified coverage end, a scheduled operation revalidates inactivity and removes cloud entries, streams and device metadata. If Apple is unavailable, removal is postponed. Server snapshots expire within seven further days; restoration repeats the inactivity check. This does not erase phone entries, exports, AI copies or Apple's billing records. Signing out alone neither cancels billing nor immediately deletes the cloud journal.

Changes

We may revise this policy as the app changes. The effective date identifies the current text. We will make a revised policy available before a material change in data handling takes effect and give any notice required by law. Questions: support@taptonote.app.