ClamNotes Privacy Policy

Version 1.9, effective [LAUNCH DATE]

Last updated: 21 October 2026

This Privacy Policy explains what personal data the ClamNotes app for iPhone, iPad and Mac ("ClamNotes" or the "app") processes, why, who receives it, how long it is kept and what rights you have. It applies to everyone who uses ClamNotes. It also applies to people whose voices are recorded, such as teachers and classmates, because their voices and words can be personal data too.

The short version

This summary helps you find your way around. It does not replace the full policy below.

ClamNotes has no user accounts, no advertising, and no third-party analytics or tracking tools. Our server, a relay, passes requests on to the AI providers without keeping their content; of your content it keeps only the notes you share as a link, encrypted. It counts what each copy of the app spends and, for each note, what it cost and how it was made, so that we can set fair prices. We do not sell your data.
The audio of a recording is not saved, and neither is the sound or picture of an audio or video file you add: only its transcript. Your transcripts, notes, study sets, photos of the board and the documents and images you add are stored on your device and, if iCloud is on for ClamNotes, in your private iCloud storage. We cannot see them.
To write notes, ClamNotes sends your transcripts to Anthropic in the United States, whose Claude model writes them, with what is read from the files you add, and with Visuals, the photos of the board you take. In Study (Pro), it sends the written notes you choose to make a study set, and, if you ask for it, your answers in a practice test to mark them. At the Max quality level, the audio, or parts of it, goes to OpenRouter, which passes it on to OpenAI's transcription model. We ask for your permission before any of this, and you can withdraw it in Settings.
When you share notes with Share ClamNote, they go as a link: our relay keeps them for 30 days, encrypted on your device. The key is only in the link, so we cannot read them. You can stop sharing a link at any time in Settings, and anyone who has a link can report it to us.
To let your iPhone and Mac share one allowance, our relay keeps a code made from your iCloud account's identifier for ClamNotes. It cannot be turned back into the identifier, and it does not tell us who you are.
If you allow it, when ClamNotes crashes, freezes or is stopped by the system, the app sends Apple's technical report of it to our relay, so that we can fix the error. It is off unless you turn it on. A report contains none of your recordings, transcripts, notes or photos.
After some updates, the app may ask you a few short questions about ClamNotes. Answering is optional. If you answer, our relay keeps your answers for 12 months, so that we can improve ClamNotes and set its prices.
If you buy a plan on our website, Lemon Squeezy sells it to you, handles the payment and gives us your order details. Our relay keeps only a one-way hash of your licence key and the plan it gives your devices.
ClamNotes comes with a speech model inside it. Any other speech model your class language needs is downloaded from Apple or Hugging Face, which see your IP address.
ClamNotes is for adults aged 18 and over.
You can delete notes at any time, and what our relay keeps about you, with Delete My Data on the Server in Settings. You have rights under data protection law, including the right to complain to a data protection authority.

1. Who is responsible for your data

The controller responsible for processing personal data in connection with ClamNotes is:

[COMPANY LEGAL NAME]
Registered address: [REGISTERED ADDRESS]
Company registration number: [COMPANY REGISTRATION NUMBER]
Email: [CONTACT EMAIL]

Data protection officer: [DPO NAME AND CONTACT, if appointed; otherwise delete this line].

Representative in the United Kingdom under the UK GDPR: [UK REPRESENTATIVE NAME AND ADDRESS, if appointed; otherwise delete this line]. We are established in the EU, so we do not need a separate EU representative.

In this policy, "we" and "us" mean [COMPANY LEGAL NAME].

2. How ClamNotes is built

ClamNotes is designed to keep as much as possible on your device:

There is no ClamNotes account. We do not ask for your name, email address or phone number to use the app. Your iPhone and Mac recognise each other only through your own iCloud account. (If you buy a plan on our website, our reseller asks for your email address for the purchase: see section 4.9.)
We do not run servers that store your recordings, transcripts, files or notes, except the notes you share as a link, which our relay keeps for 30 days, encrypted so that we cannot read them (section 4.15). Requests to the AI services pass through our relay, a small server run on Cloudflare, which adds our access key and passes them on. It does not keep their content or your IP address. It keeps usage records: a random identifier of your copy of the app, a code made from your iCloud account's identifier, what each request cost, and the length, settings and sizes of each recording and note, with the kinds and sizes of the files you add, never what was said, what the files contain or what the note says (see section 4.12). If you allow it, it also keeps technical reports of crashes and errors, which contain none of your content (see section 4.11), and if you answer a short survey after an update, your answers (section 4.20). Our website, also run on Cloudflare, only counts downloads (section 4.16). You can delete what the relay keeps about you at any time (section 9).
The app contains no advertising, analytics, tracking or crash-reporting tools from third parties. We do not track you across apps or websites. The reports of crashes and errors that the app sends, if you allow it, come from Apple's operating system and go only to our relay (section 4.11).
The audio from the microphone is processed in the device's memory while you record. ClamNotes does not save audio files. Of an audio or video file you add, it keeps only the transcript it makes on your device.
The programs in a note's visuals run only on your device, inside the app, without access to the internet or to your files.
So that you can find your notes with Spotlight and ask Siri about them, ClamNotes adds their titles, summaries, text and transcripts to your device's search index. The index stays on your device and is managed by Apple's operating system; ClamNotes does not send it anywhere. When you ask Siri about your notes, Apple handles the request under its own privacy policy (see section 6). If you use the timetable, ClamNotes chooses the subject at class time from it and, on iPhone and iPad if you allow it, reminds you with a notification from your device 5 minutes before each class. You can add a screenshot of your timetable from any app, or type it in your own words, and Anthropic's Claude reads its lessons (their times, subjects and rooms, and the teachers' names if it shows them; see section 3); you can add lessons by hand; and ClamNotes learns your classes on your device from the start times and subjects of your recordings. Your timetable is kept on your device and, if iCloud sync is on, in your private iCloud storage (section 4.7); the classes ClamNotes learns stay on your device. You can see your timetable in Settings, See timetable, and turn it off there with Use timetable.

3. What leaves your device, by quality level

You choose a quality level in Settings: Recommended (the default), Low, Medium, High or Max. Recommended sends the same as High. Settings changed one by one in earlier versions are kept as Custom, which sends what is described below for the features it has on. This is what leaves your iPhone or Mac at each level:

Low. Speech is transcribed on your device. The transcript text is sent to Anthropic's Claude Haiku 5.5 model while you record, to repair misheard words, and when you stop, to write the note. In slow mode the misheard words are repaired when you stop, together with the note.
Medium. As Low. In addition, the note writer checks the facts in the class, using the same transcript. No web search.
High. As Medium. In addition, the note writer may search the web to check facts. The search questions it writes are based on the class content. Anthropic runs them, only on a fixed list of reliable websites, such as encyclopedias, official and scientific sites.
Max. As High, but speech is transcribed by an online service: all of it, or, on a device that runs two speech models, the pieces they hear differently. Those pieces of audio, of up to about 28 seconds each, are sent to OpenRouter, which passes them to OpenAI's GPT Transcribe model, run by OpenAI. A short piece of the text heard just before goes with each piece, to keep names and terms consistent.
Exam mode (any level, if you turn it on). In addition, the app downloads from our relay the official requirements of the school-leaving exam you chose, for the subject of the class: copies of the exam boards' public documents, which we keep on the relay where the exam board allows it. The note writer reads the parts that cover the class with the transcript. The app's request for them names only the exam and the subject. For the other exams, the note writer reads the requirements on the exam board's own websites through Anthropic. Only public documents and web pages are read.
Slow mode (any level, if you turn it on). The same requests go to Anthropic, which answers them later, within a day, from a queue (its Message Batches API). The fact check does not search the web. While a request waits, Anthropic keeps it and then its answer until our relay fetches the answer for the app; our relay then asks Anthropic to delete them.
Continuing a note. When you continue an earlier note, the existing note is sent along with the new transcript, so that the AI can extend it.
Visuals (Plus and Pro, if you turn them on). The photos of the board you take while recording are sent with the transcript to write the note. After the note is written, the note, its transcript and the photos are sent once more to Anthropic's Claude, to make the visuals. When you continue a note, its visuals are sent too.
Files (any level, if you add them). When you add files to a recording, or make a note from files, the app reads their text on your device, and transcribes audio and video files on your device. What is read from them, the text and some pages and images as pictures, is sent to Anthropic's Claude with the files' names, the transcript if there is one, and the instructions you write, to write the note and, with Visuals, its visuals. The files themselves are not sent. The screenshot or text of your timetable that you add is sent to Anthropic's Claude in the same way, to read its lessons (section 2).
Study (Pro). To make a study set, the written notes you choose (not their transcripts), what is read from the files you add and your instructions about the test are sent to Anthropic's Claude, which writes one note from them, with its visuals, flashcards, a quiz and a practice test. If you ask the AI to mark the open answers of a practice test, the questions, their model answers and your answers are sent to Anthropic too. The app also gives a short answer its points itself when it matches the model answer exactly; such an answer is not sent to the AI.

At every level, the requests also include the subject, the class language, your note settings and the instructions for the AI. The requests that reach Anthropic and OpenRouter do not include your name, your Apple Account, your device identifiers or your location. Our relay receives them with the random identifier of your copy of the app, and, when the app connects to it, the code made from your iCloud account's identifier (see section 4.12). Your device connects to our relay, not to Anthropic or OpenRouter, so they do not receive your IP address. Cloudflare, which runs the relay, processes it to deliver the connection.

If you have not given permission for AI processing, or you withdraw it, ClamNotes sends nothing to these services, and nothing to our relay except what you start yourself that needs it: making a link to share notes, or opening one (section 4.15), and on a Mac, activating a licence key (section 4.9). Making a link registers your copy of the app with the relay if it is not registered yet (section 4.12); without the permission, the app sends no reports of recordings or notes.

4. What data we process, and why

Each item below says what the data is, where it is and who receives it, why it is processed, the legal basis under the EU General Data Protection Regulation (GDPR), and how long it is kept.

4.1 Audio from the microphone

What: the sound picked up by the microphone while you record, including the voices of anyone speaking.
Where and who: processed in your device's memory; not saved. At the Max quality level, sent in pieces to OpenRouter and OpenAI for transcription.
Why: to turn speech into text.
Legal basis: for your own data, your consent (Article 6(1)(a) GDPR, and Article 9(2)(a) GDPR if a recording contains sensitive data about you). For other people's voices, our and your legitimate interest in making study notes of a class you are allowed to record (Article 6(1)(f) GDPR). If sensitive data about other people, such as their health or religious beliefs, comes up in a class, we do not seek it out, single it out or use it for anything other than the user's study notes, and our Terms of Use ask users not to record conversations where such data is shared. See section 5.
How long: ClamNotes does not store audio. On the providers' side, see section 7.

4.2 Transcripts

What: the text of what was said in the class, or in an audio or video file you add (section 4.18), with timings, and the name of the language.
Where and who: stored on your device and, if iCloud sync is on, in your private iCloud storage. Sent to Anthropic to repair misheard words and write the note.
Why: to show you what was said, to let you write the note again and to write the note.
Legal basis: as for audio (section 4.1). Storing it on your device and in your iCloud is part of the service you asked for (Article 6(1)(b) GDPR).
How long: until you delete the note. Deleting a note deletes it on all your devices that use the same iCloud account, except while it is being recorded or written on another device: there it stays, and it comes back.

4.3 Notes

What: the AI-generated note: title, summary, sections, to-dos, open questions, fact-check corrections, exam points, the visuals (the data of their graphs, formulas, figures, charts, mind maps, timelines, steps and programs), the subject, the date and length of the recording and the settings used.
Where and who: stored on your device and, if iCloud sync is on, in your private iCloud storage. While it is written, the AI provider produces it.
Why: this is what ClamNotes is for.
Legal basis: providing the service you asked for (Article 6(1)(b) GDPR); for sending content to AI providers, your consent (see section 4.1).
How long: until you delete the note.

4.4 Photos of the board

What: the photos you take with ClamNotes while you record, with Visuals on (Plus and Pro), and the time in the recording when each was taken. They can show what is on the board or screen, and anything else in the picture, such as people.
Where and who: stored on your device and, if iCloud sync is on, in your private iCloud storage. Sent to Anthropic's Claude with the transcript, to write the note and its visuals.
Why: so that the note and its visuals can use what was written or drawn on the board.
Legal basis: your consent (Article 6(1)(a) GDPR). For people who appear in a photo, our and your legitimate interest in making study notes (Article 6(1)(f) GDPR); see section 5.
How long: until you delete the note, which deletes its photos on all your devices that use the same iCloud account. Photo files that no note shows are deleted after 30 days. On the providers' side, as for transcripts (section 7).

4.5 Web searches and exam requirements

What: search questions and web addresses written by the AI from the class content; the public pages it reads. For exam mode, the app's request to our relay for the requirements of an exam and a subject, with the random identifier of your copy of the app.
Where and who: Anthropic, which runs the searches and page reads with its own search providers; our relay, which holds copies of the exam boards' public requirement documents where they allow it. Only websites on ClamNotes' fixed list, or the exam boards' own sites, can be searched or read. The AI is instructed not to put names or other personal data into search questions.
Why: to check facts, and to give the AI the official exam requirements.
Legal basis: your consent to AI processing (Article 6(1)(a) GDPR).
How long: ClamNotes keeps only the finished note. On Anthropic's side, as for transcripts (section 7).

4.6 Speech model downloads

What: your IP address and technical data of the download requests, such as the time and the files requested. No recordings or notes.
Where and who: on iPhone and iPad, Apple, which delivers most of the models with the app (Background Assets); on Mac, and where Apple's download is not available, Hugging Face, which hosts the models. Each processes this data under its own privacy policy, as an independent controller. One model, Parakeet Ultra, comes inside the app and is not downloaded.
Why: to download the on-device speech models your class language needs, beyond the one inside the app, when you first need them.
Legal basis: our legitimate interest in offering on-device transcription, which keeps your audio on your device (Article 6(1)(f) GDPR).
How long: ClamNotes keeps only the model files on your device. You can delete them by deleting the app. Apple and Hugging Face keep their logs under their own policies.

4.7 iCloud sync

What: your notes and transcripts, the photos of the board, the files you add (documents and images, and what was read from them), your study sets with your progress in them, your timetable (not the classes each device learns), what each of your devices has spent of your plan's allowance (under a random identifier of the device, kept in its Keychain and not in its backups), and, once your iPhone made one, the link that lets a Mac without App Attest use our relay (a random secret), in encrypted fields.
Where and who: your private iCloud database for ClamNotes, provided by Apple under your iCloud agreement with Apple. We cannot access the private iCloud data of any user. If you turn on Advanced Data Protection for iCloud, these fields are end-to-end encrypted.
Why: to keep your notes the same on all your iPhones and Macs signed in to your Apple Account, to count your plan's allowance across them, and to connect your Mac to our relay.
Legal basis: providing the service you asked for (Article 6(1)(b) GDPR).
How long: until you delete the notes, or turn off iCloud for ClamNotes and delete its iCloud data in the iOS Settings; the notes then stay only on your devices. If a note is changed on two devices at the same time, it may be kept as two notes. If you sign out of iCloud or switch to another account, your notes stay on the device and are never uploaded to the other account; when a different account signs in, the notes that the previous account's iCloud holds are removed from the device.
How to turn it off: in ClamNotes' Settings (iCloud sync), or in the system settings: on iPhone, your name, iCloud; on Mac, your name, iCloud.

4.8 Settings and consent records

What: your settings (quality level, subject, language, exam country and similar), and a record of the Terms and permissions you accepted: version, date and time, your confirmation that you are 18 or older, your promise about recording other people, whether you allowed sharing with AI providers, and whether you allowed crash reports, each with the time it was given or changed.
Where and who: on your device only.
Why: to make the app work as you set it, and to be able to show that we asked for and received your permission.
Legal basis: providing the service (Article 6(1)(b) GDPR); for the consent record, our legal obligation to be able to show consent (Article 6(1)(c) and Article 7(1) GDPR).
How long: until you delete the app. A withdrawal of consent is recorded too. The app sends nothing to the AI providers without your permission, so every request our relay passes on was made with it.

4.9 Purchases (when paid plans are offered)

In the app, through Apple:

What: your subscription status and transaction details, such as the product, the purchase and expiry dates and a transaction identifier. We do not receive your name, address or payment card details. What you have used of the current period's allowance is counted on your devices, from what each request cost, and on our relay (see section 4.12).
Where and who: Apple processes the purchase and payment as an independent controller under its own terms and privacy policy. The app checks your subscription with Apple on your device.
Why: to give you the features and limits of your plan.
Legal basis: performing the contract (Article 6(1)(b) GDPR).
How long: as long as needed for the subscription, and for purchase records as long as Apple keeps them.

On our website, through Lemon Squeezy:

What: Lemon Squeezy collects your name, email address, billing address and payment details, processes the payment, charges taxes, and sends you the receipt with a licence key. It gives us the order details: your name, email address and country, what you bought, the price and taxes, and the status of the subscription. We do not receive your payment card details. When you activate the licence key, our relay asks Lemon Squeezy whether the key is valid and what it gives, and keeps a one-way hash of the key (never the key itself), Lemon Squeezy's identifier of the key, the plan and billing period, its status and end date, and the code made from your iCloud account's identifier (or, without one, the identifier of the copy of the app) that it is activated for. While it is activated, the relay asks Lemon Squeezy about it again every day. The key itself is kept only in your Mac's Keychain.
Where and who: Lemon Squeezy, LLC is the merchant of record and processes the purchase and payment as an independent controller under its own terms and privacy policy. We see the order details in our Lemon Squeezy account. The licence record is kept by our relay, run by Cloudflare as our processor (section 6).
Why: to give your devices the plan you bought, to answer your questions and handle withdrawals, refunds and complaints, and to keep the accounting and tax records the law requires.
Legal basis: performing the contract (Article 6(1)(b) GDPR); for accounting and tax records, our legal obligation (Article 6(1)(c) GDPR).
How long: the licence record while the licence is activated, and for 13 months after it is deactivated or ends; then it is deleted automatically. The order details as long as accounting and tax law requires (in Hungary, 8 years).

4.10 When you contact us

What: your email address, your message and anything you choose to send us, such as a note or screenshot.
Where and who: our email provider, [EMAIL PROVIDER].
Why: to answer you and to handle complaints and requests.
Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR); for complaints and data protection requests, our legal obligations (Article 6(1)(c) GDPR).
How long: consumer complaints and our answers are kept for 3 years, as Hungarian consumer protection law requires. Other messages are kept until the matter is closed, and for at most 5 years after that (the general limitation period in Hungary) if they may be needed for a legal claim.

4.11 Crash reports and diagnostics

What: when ClamNotes crashes, stops responding, uses too much processor time, writes too much to storage, starts slowly, or is ended by the system (for example for using too much memory), Apple's operating system (MetricKit) gives the app a technical report of it, and once a day statistics about how the app ran, such as how long starting it, loading a speech model and writing a note took, and how often and why it was ended. The app sends these to our relay with the kind of device (iPhone, iPad or Mac), its model identifier (for example iPhone17,1) and the versions of its operating system and of the app. A report shows which parts of the app's program were running when the problem happened (call stacks: positions in the program's files), with technical codes, counts and times. It never contains your recordings, transcripts, notes or photos, your name, your Apple Account or the code made from your iCloud identifier. Before sending, the app removes the device's region setting and the text of error messages.
Where and who: our relay and its database, run by Cloudflare as our processor (section 6). Each report is kept with the random identifier of your copy of the app (section 4.12). The app sends reports only if you have allowed crash reports, on the terms page or later in Settings, About, Privacy & data, Send crash reports, and only if you have also allowed AI processing, because only then does the app use our relay. Until then, reports wait on your device, 20 at most and for 30 days at most; a report our relay did not take is tried once more at the next launch. Turning crash reports off deletes the reports waiting on your device.
Why: to find and fix crashes, freezes and other errors, also on the Mac, where ClamNotes downloaded from our website has no other way to report them.
Legal basis: your consent (Article 6(1)(a) GDPR). Crash reports are off unless you turn them on, and you can withdraw your consent at any time by turning them off in Settings, without affecting the reports sent before.
How long: 90 days, then deleted automatically, or at once if you delete your data on the server (section 9).

If you have allowed it in iOS (Settings, Privacy & Security, Analytics & Improvements, Share With App Developers), Apple may give us crash reports and statistics about app use. Apple collects these, not ClamNotes. They do not contain your recordings, transcripts or notes, and we cannot link them to you. We use them to fix errors (legitimate interest, Article 6(1)(f) GDPR). You can turn this off at any time in iOS. This setting concerns only Apple's own reports, not the reports described above that the app sends to our relay.

4.12 Our relay and usage records

What: for each copy of the app: a random identifier, whether it runs on an iPhone, an iPad or a Mac, its version, how it was installed (from the App Store, through TestFlight, downloaded from our website, or as a development build), for a Mac the copy on the iPhone it was linked from, and a code made from your iCloud account's identifier for ClamNotes (a one-way hash, so that your copies share one allowance). For each request to the AI: the copy's identifier, the time, the model, what the request cost, how many tokens it used, at Max how long the audio was, and labels the app adds: a random identifier of the note, the kind of device (iPhone, iPad or Mac), what the request was for (writing the note, repairing words, transcribing, making the visuals with the note or later, making a study set, its practice or the marks of a practice test, or reading a timetable), whether the note is made from a recording, from files or in Study, the quality level, the plan, the subject and the class language. For each recording that ends: its length, the kind of device, quality level, plan, subject, class language, note settings and the number of words in its transcript. For each note: the kind of device it was made on, what each part of its writing cost, and its settings and sizes: the subject, the class language, the note length setting, the AI's effort, the exam country if exam mode is on, the number of words in the transcript, how many searches were made, how long writing the note and making its visuals took, whether the note was written, how many blocks its visuals have and how many photos went with it, and whether it was written in slow mode. For a note made with or from files, and for a study set: how many files of each kind went with it, their sizes, pages and lengths, the number of characters read from them, how many pictures were sent, the length of your instructions, and for a study set, how many notes it was made from and how many flashcards, quiz questions and test questions it has; never the files' names or contents, or what your instructions say. For each request, also what your plan's allowance counted for it, and in slow mode the names the relay and Anthropic gave its batch and when it was sent, asked about, ended and deleted. Never what was said, what the note says, what the photos show or what the files contain. The identifier comes from Apple's App Attest, which also proves to the relay that a request comes from a genuine copy of ClamNotes on a real Apple device. A Mac where App Attest is not available registers instead with a link that a genuine copy on your iPhone made and left in your private iCloud, or with a licence key bought on our website; the relay keeps only a one-way hash of that link or key. None of this contains your name, your email address or your Apple Account, and the code made from your iCloud identifier cannot be turned back into it.
Where and who: our relay and its database, run by Cloudflare as our processor. The content of requests and answers passes through the relay but is not stored, and neither is your IP address. A copy of the app registers with the relay when it first needs it: for AI processing, or, without that permission, when you make a link to share notes or activate a licence key. The records of requests, recordings and notes are sent only with your permission for AI processing.
Why: to keep our access key out of the app and let only the genuine app use it, to count each plan's monthly allowance and stop new notes when it is used up, to give each copy, without a licence, the plan that comes with how it was installed, such as the test plan in TestFlight, to stop abuse with a daily spending limit for each person's copies of the app together and one for all users together, and to set fair plan limits from what notes really cost.
Legal basis: our legitimate interest in providing the service securely and pricing it fairly (Article 6(1)(f) GDPR); for counting a plan's allowance, performing the contract (Article 6(1)(b) GDPR).
How long: the records of requests, recordings and notes 13 months, then deleted automatically. The identifier of a copy of the app, with the code and the link or key hashes kept with it, is deleted automatically 13 months after that copy last used the relay. You can delete all of them at once with Delete My Data on the Server (section 9). Section 9 also says what is kept of your spending until the month ends.

4.13 What happens on your device only

The Lock Screen and the Dynamic Island show the last line heard while you record, also while the iPhone is locked. Anyone who sees your screen can read it, including names or anything else said in the class.
If you add ClamNotes' widgets, they show your next classes from your timetable, with their subject, time and room, and the titles of your newest notes on your Home Screen and Lock Screen. They read a copy that the app keeps for them on your device. Anyone who sees your screen can read them.
While a note is being written, the request being sent (the transcript, the photos of the board and what was read from files, if there are any) and the AI's answer can be kept in temporary files in the app's protected storage, so that the note can finish while ClamNotes is in the background. They are deleted once they are used, and after a day at the latest. Audio is never kept this way.
When you share or export a note, it goes to the app or person you choose. What happens to it then is up to them and you. A note shared as a link is kept by our relay for a while, encrypted (section 4.15).
Notes are protected by iOS data protection. They can be read after the iPhone has been unlocked once after starting, so that ClamNotes can save them while the iPhone is locked during a recording. On a Mac, they are kept in the app's own protected container.
The programs of the visuals, and any changes you make to them, run only on your device, without internet access, and are not sent anywhere.

4.14 Testing through TestFlight

What: if you test ClamNotes through Apple's TestFlight, Apple gives us your name and email address if we invited you by email (not if you joined through a public link), the feedback and screenshots you choose to send, crash reports, and technical data such as the device model, the iOS version, the build you installed and how often you opened it. During the test, the relay counts everything described in section 4.12, as in every version of ClamNotes.
Where and who: Apple runs TestFlight as an independent controller under its own terms and privacy policy. We see this data in App Store Connect.
Why: to find and fix problems, and to set the prices and limits of the plans from what notes really cost before ClamNotes is sold.
Legal basis: our legitimate interest in testing ClamNotes before it is sold (Article 6(1)(f) GDPR).
How long: TestFlight data as long as App Store Connect keeps it for the test; the usage records as in section 4.12.

4.15 Notes shared as a link

What: when you share notes with Share ClamNote, they go as a link (as a file only when no link can be made): the notes with their transcripts, visuals, photos of the board and what was read from their files (not the files themselves, which only a ClamNote file holds), and study sets with their flashcards, quiz and practice test, encrypted on your device with a key made for that link alone (AES-256-GCM). The key is only in the link, in the part after the # sign, which browsers and apps do not send to any server, so we cannot read the notes. With them, the relay keeps the identifier of the copy of the app that shared them, the time and the size.
Where and who: our relay, run by Cloudflare as our processor (section 6).
Why: so that the person you send the link to can open the notes in ClamNotes with one tap, from any app.
Legal basis: the service you ask for (Article 6(1)(b) GDPR); for the identifier, time and size, our legitimate interest in stopping abuse (Article 6(1)(f) GDPR).
How long: the encrypted notes, and the identifier, time and size kept with them, 30 days; then they are deleted automatically. You can stop sharing a link at any time in Settings, About, Privacy & data, Shared links, which deletes its notes on the relay at once.
Anyone who has the link can open the notes during those 30 days. Share it only with the people you choose. If a link went to the wrong person, stop sharing it in Settings, or contact us (section 15) and we delete the notes. Anyone who has the link can report the notes to us (section 4.17).

4.16 Our website

What: when you download ClamNotes for Mac from our website, or follow its links to TestFlight for the iPhone or iPad, the website counts the download: one more for that day and that kind of device (Mac, iPhone or iPad). It keeps nothing else: no IP address, no cookie and nothing that identifies you or your device. The website sets no cookies and uses no analytics or tracking tools; it only remembers in your browser whether you chose its light or dark look.
Where and who: our website, run by Cloudflare as our processor (section 6), which processes your IP address to deliver the pages and the download, without storing it for us.
Why: to know how many people download ClamNotes, and for which devices.
Legal basis: our legitimate interest in knowing how our app is taken up (Article 6(1)(f) GDPR). The counts are not personal data.
How long: the daily counts are kept as statistics.

4.17 Reports of shared notes

What: anyone who opens notes shared as a link on our website can report them (Report this note), for example as illegal or abusive content. The relay keeps the report: the reason chosen, the message the reporter writes, if they write one, and the time. The message may include the link, and with it the key to read the notes. The relay does not keep the reporter's IP address.
Where and who: our relay, run by Cloudflare as our processor (section 6). We can read the reported notes only if the reporter put the full link in the message. We may delete the reported notes.
Why: to deal with illegal content and the abuse of shared links, as the law requires of us.
Legal basis: our legitimate interest in preventing illegal content and abuse (Article 6(1)(f) GDPR), and our legal obligations under the EU Digital Services Act (Article 6(1)(c) GDPR).
How long: until the report is dealt with, and no longer than 90 days.

4.18 Files you add

What: the files you add to a recording or make a note from: PDFs, documents (such as Word and OpenDocument), presentations (such as PowerPoint and OpenDocument), spreadsheets, text files, images, and audio and video files, with their names, kinds and sizes, their numbers of pages or lengths, and the time in the recording when each was added. They can contain anything, including other people's names, voices, faces or other personal data.
Where and who: each file is read on your device: its text, and some pages and images as pictures. Audio and video files are transcribed on your device, with the same speech models as recordings; only the transcript is kept, not the sound or the video. Documents and images, with what was read from them, are stored on your device and, if iCloud sync is on, in your private iCloud storage, end-to-end encrypted if you use Advanced Data Protection, as notes are. What is read from the files is sent through our relay to Anthropic's Claude, with their names, to write the note and its visuals, as transcripts are (section 4.2). Images you add are kept and sent like photos of the board (section 4.4). The files themselves are not sent.
Why: so that the note can use your study materials: the handouts and slides of the class beside the recording, or your files alone.
Legal basis: your consent (Article 6(1)(a) GDPR). Storing the files on your device and in your iCloud is part of the service you asked for (Article 6(1)(b) GDPR). For other people's data in a file, our and your legitimate interest in making study notes (Article 6(1)(f) GDPR); see section 5.
How long: until you delete the note, which deletes its files on all your devices that use the same iCloud account. On the providers' side, as for transcripts (section 7). Our relay keeps only figures about the files in its usage records, never their names or contents (section 4.12).

4.19 Study sets and practice tests

What: the study sets you make in Study (Pro): the notes you choose, the files you add and your instructions about the test; the study set the AI writes from them, with its visuals, flashcards, a quiz and a practice test; your answers in practice tests; and your progress: the cards you know, your quiz results and your test attempts with their marks and feedback.
Where and who: stored on your device and, if iCloud sync is on, in your private iCloud storage. Only the written notes are sent, not their transcripts: with what is read from the files you add and your instructions, they go through our relay to Anthropic's Claude to write the study set and its practice. If you ask the AI to mark the open answers of a practice test, the questions, their model answers and your answers are sent to Anthropic too, under the same rules as transcripts; the app marks multiple-choice and true-or-false answers itself. The app also gives a short answer its points itself when it matches the model answer exactly; such an answer is not sent to the AI.
Why: to help you prepare for a test with your own notes and materials. The marks and feedback are practice feedback for your own use only. They are not an assessment, grade or certification of what you have learned, and our relay does not keep them.
Legal basis: your consent to AI processing (Article 6(1)(a) GDPR). Storing study sets and your progress on your device and in your iCloud is part of the service you asked for (Article 6(1)(b) GDPR).
How long: until you delete the study set, which deletes it, its files and your progress on all your devices that use the same iCloud account. On the providers' side, as for transcripts (section 7).

4.20 Update surveys

What: after some updates, the app may ask you a few short questions: how you like ClamNotes, how good your notes are, what you would pay for it a month, which parts of it you use most, and, if you wish, what we should make better, in up to 500 characters of your own text. With your answers, the app sends the version and build of the app, the kind of device (iPhone, iPad or Mac), your plan, your main class language, and the prices the question showed, with their currency. The answers contain none of your recordings, transcripts, notes, photos or files. Please put no personal information in your own text.
Where and who: our relay and its database, run by Cloudflare as our processor (section 6). The answers are kept with the random identifier of your copy of the app (section 4.12), so that each copy gives at most one answer to each survey. Answering is optional: closing the survey sends nothing, and it is not shown again. The app sends the answers only if your copy of the app already uses our relay; until they can be sent, they wait on your device, for 30 days at most.
Why: to improve ClamNotes and to set its prices. We use the answers for nothing else.
Legal basis: your consent, which you give by sending your answers (Article 6(1)(a) GDPR). You can withdraw it at any time by deleting your data on the server (section 9), without affecting what was done before.
How long: 12 months, then deleted automatically, or at once if you delete your data on the server (section 9).

5. Teachers, classmates and other people in a recording

If your voice is in someone's recording or in an audio or video file they add, or you appear in a photo of the board they took or in another file they add, ClamNotes processes what you said, or the photo or file, to produce that person's study notes. We do not use it for anything else. We do not identify speakers, we do not create voice profiles, and we do not collect information about you. The recording itself is not stored.

The user who records is responsible for having the permission the law and their school require, and must use the notes only for personal study. Our Terms of Use require this, and ask users to photograph only the board and the teaching materials, not people. Recordings may include the voices of classmates who are children. For this reason in particular, we do not store audio and we do not use recordings for any other purpose.

This section, together with the rest of this policy, is also the information we give to people whose voices are recorded, as Article 14 GDPR requires.

We rely on legitimate interests (Article 6(1)(f) GDPR) for this processing: users have a legitimate interest in making study notes of classes they are allowed to record. We limit the effect on you by not storing the audio, by not using the content for any other purpose or for training AI, and by keeping the notes only on the user's own devices and iCloud.

Because we do not have access to the notes, we usually cannot find content about you. If you have a concern, please speak to the person who recorded, or contact us, and we will help as far as we can. You have the right to object to this processing (see section 9).

6. Who receives your data

We use the following service providers. They process data for us under contracts that require them to protect it and to use it only to provide their service:

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States: runs our relay and its database, and our website with the download of ClamNotes for Mac (section 4.16). Requests and answers pass through it; only the usage records in section 4.12, the diagnostic reports in section 4.11, the survey answers in section 4.20, the licence records in section 4.9, notes shared as links, encrypted (section 4.15), and reports of shared notes (section 4.17) are stored. It processes your IP address to deliver the connection, and to limit how often copies of the app can register from one address, which it counts for a minute without storing it. It acts as our processor under its data processing addendum.
Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, United States: its Claude Haiku 5.5 model writes and repairs notes, makes their visuals, study sets and practice tests, marks practice answers, reads timetables, and runs the web searches and page reads for them. It receives the content of the requests through our relay, not your IP address. It acts as our processor under its data processing addendum.
OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, United States: at the Max quality level, receives the audio from the app through our relay and passes it on to OpenAI. It receives the content of each request, not your IP address. It acts as our processor under a data processing agreement.
OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, United States: at the Max level, its GPT Transcribe model transcribes audio, as OpenRouter's sub-processor. It receives the audio through OpenRouter, not your IP address.

The following receive data as independent controllers, under their own privacy policies:

Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., United States): iCloud storage and sync, App Store purchases, TestFlight (see section 4.14), the download of speech models on iPhone and iPad (section 4.6), crash reports if you allow them, and Siri and Apple Intelligence when you ask them about your notes.
Hugging Face (Hugging Face SAS, France, and Hugging Face, Inc., United States): model downloads (IP address and download data).
Lemon Squeezy, LLC (United States): sells the plans on our website as merchant of record, and processes the payment (see section 4.9).

We may also disclose data if the law requires it, for example to a court or authority, or to protect rights in a legal dispute.

We do not sell your personal data, and we do not share it for advertising.

If ClamNotes lets you choose another AI model or provider, the app shows the provider's name next to it. We will add it to this policy before we offer it.

7. How long AI providers keep data

Notes (Claude Haiku 5.5). Anthropic does not use the content of API requests to train its models. It deletes requests and answers within 30 days, unless a request is flagged for breaking its usage policy, in which case it may keep it longer to enforce that policy, or a law requires longer. We have not asked for zero data retention. In slow mode, a request and its answer stay at Anthropic until our relay has fetched the answer, and our relay then asks Anthropic to delete them; Anthropic keeps them at most 29 days, and deletes them within 30 days in any case.
OpenRouter does not store the content of requests and responses, because we have not turned on logging. It deletes them promptly after the answer is generated. It does not keep audio longer than needed to pass it on, except where needed to detect abuse, for security, billing or legal compliance. It keeps metadata without content, such as the time, the model used and the number of tokens. OpenRouter does not use your data to train AI.
Transcription at Max (GPT Transcribe). This model is run only by OpenAI itself. OpenAI does not use the audio to train its models. According to OpenAI, it does not keep audio sent for transcription for abuse monitoring.

8. Transfers outside the EU

Cloudflare, Anthropic, OpenRouter, OpenAI, Lemon Squeezy and Hugging Face process data in the United States, so your data is transferred outside the European Economic Area. We protect these transfers with:

the European Commission's Standard Contractual Clauses, which are part of our data processing agreements with Anthropic and OpenRouter, together with additional measures where needed; and
the EU-US Data Privacy Framework, for providers certified under it. For users in the UK, the UK Addendum to those clauses or the UK Extension to the Data Privacy Framework applies.

You can ask us for a copy of the safeguards at [CONTACT EMAIL].

Apple may store iCloud data in data centres in various countries under its own safeguards.

9. Your rights

Under the GDPR and similar laws, you have the right to:

access the personal data we process about you and get a copy;
correct inaccurate data;
erase your data;
restrict processing in certain cases;
data portability: receive your data in a common machine-readable format;
object to processing based on legitimate interests, at any time, on grounds relating to your situation;
withdraw your consent at any time, without affecting what was done before. In ClamNotes, you can do this in Settings;
not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. ClamNotes does not make such decisions: the marks the AI gives your practice answers in Study are feedback for you alone.

Many of these rights you can use directly in the app, because your data is on your device: you can see, export (text, PDF or Word) and delete your notes and study sets with their photos and files, one by one or all at once in Settings (Delete All Notes), which also deletes them from iCloud, or, with iCloud sync off, once it is turned on again. To delete everything ClamNotes stores on your device, delete the app. To delete iCloud data, delete your notes in the app before deleting it, or remove ClamNotes' data in the system settings (on iPhone: your name, iCloud, Manage Account Storage; on Mac: your name, iCloud, Manage).

Deleting what our relay keeps. As ClamNotes has no accounts, this is how you erase your data on our relay (Article 17 GDPR): in Settings, About, Privacy & data, Delete My Data on the Server deletes at once what the relay keeps about you and about every copy of the app in your iCloud account: the copies' registrations, the records of requests, recordings and notes, the diagnostic reports, the survey answers, the requests of slow mode, the links between your iPhone and your Mac, and the notes you shared as links, with any reports of them. Until the current month ends, the relay keeps, under the code made from your iCloud identifier, the total your account spent of its allowance in that month, including requests still under way at the deletion, when that month began, and what was spent that day, so that deleting renews neither the allowance nor the daily spending limit: new copies of the app in the same iCloud account go on with the same month, and that day's spending counts in the daily spending limit until midnight UTC (our legitimate interest, Article 6(1)(f) GDPR). Without an iCloud account, this is kept under the identifier of the deleted copy of the app, which no new copy can have, so deleting is then like reinstalling the app. The record of a licence bought on our website, which we need for the contract and for tax records, is kept too: the licence keeps working and stays activated for your iCloud account; one activated for a copy of the app without an iCloud account is let go, and you can activate it again. Your notes on your devices and in iCloud are not affected: you delete them in the app, as described above.

For other requests, write to [CONTACT EMAIL]. We answer within one month. We may extend this by up to two more months for complex requests and will tell you if so. We may need information to confirm that a request comes from you. Because we do not store your content, we usually do not hold data that we could give you, but we will forward your request to our providers where this is relevant. The records on our relay (sections 4.11, 4.12, 4.15 and 4.20) are kept under a random identifier of your copy of the app and the code made from your iCloud identifier, which we cannot connect to your name or email address, so we usually cannot find them from an email alone (Article 11 GDPR). To erase them, use Delete My Data on the Server in the app; otherwise they are deleted automatically, as those sections describe.

Complaints. You can complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you think the law was broken. In Hungary, this is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH):

Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu

In the UK, you can complain to the Information Commissioner's Office (ico.org.uk). You can also go to court. In Hungary, the regional courts (törvényszék) hear these cases, and you can choose the court where you live.

We would be grateful if you contacted us first, so that we can try to solve the problem.

10. Children and young people

ClamNotes is only for people aged 18 and over. The AI services it uses allow their use only by adults. We ask you to confirm your age before you start.

We do not knowingly process personal data of anyone under 18 as a user. Since we do not store your data, we cannot delete it from your device. If you think someone under 18 is using ClamNotes, please ask them to delete the app and its iCloud data, or contact us so we can help.

Recordings may still contain the voices of younger people, such as classmates. Section 5 explains how we protect them.

11. How we protect your data

Connections to our relay and our website, to AI providers, Hugging Face and iCloud are encrypted in transit (HTTPS/TLS). Notes shared as a link are end-to-end encrypted: they are encrypted on your device, and only the link holds the key.
Notes on your iPhone are protected by iOS data protection, on your Mac by the app's own container, and iCloud stores them in encrypted fields, end-to-end encrypted if you use Advanced Data Protection.
Our relay does not store the content of requests, so there is no central database of ClamNotes notes, transcripts, photos or files; the shared notes it keeps are encrypted with keys it never receives. Only genuine copies of the app, proved by Apple's App Attest, can use it, and Macs without App Attest linked to such a copy through the user's private iCloud or registered with a licence key bought on our website.
We choose AI model providers that commit to protecting data and do not use it to train AI, and we have turned off logging at OpenRouter.

Please protect your iPhone and Mac with a passcode. Anyone who can unlock them can read your notes.

If a data breach affecting you occurs at our providers or in the app, we will act as the law requires, including informing the authority and you where required.

12. AI transparency

Notes, repaired transcripts, fact-check corrections, exam points, the visuals of notes, study sets with their flashcards, quizzes and practice tests, and the marks and feedback on practice answers in ClamNotes are generated by AI. In the visuals, a graph, chart, figure or program that the AI chose as an example is marked as one. Under every note, and at the end of every note exported or copied as text, PDF or Word, the app shows: "Written by AI from a recording. It can contain mistakes." (for a note made from files: "Written by AI from files. It can contain mistakes."; for a study set: "Written by AI from your notes. It can contain mistakes.") Exported PDF and Word files are also marked as AI-generated in their properties, so that other software can recognise them. AI output may contain mistakes. ClamNotes does not use AI to make decisions about you, and does not profile you. The marks in Study are practice feedback for your own use, not an assessment, grade or certification of what you have learned. ClamNotes is not meant for schools or other institutions to evaluate students' learning outcomes or to make decisions about them.

13. Information for users in the United States

We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We do not use or disclose sensitive personal information to infer characteristics about you.
The categories of personal information processed are described in section 4: audio recordings and transcripts (audio and electronic information), photos of the board (visual information), files you add (documents, images, and the transcripts of audio and video files), notes and study sets you create, with your practice results, internet or network information (IP address), usage records (a random identifier of the app, a code made from the iCloud account's identifier, how it was installed, what requests cost, and the settings and sizes of recordings and notes), diagnostic data (technical reports of crashes and errors, if you allow them), survey answers, reports of shared notes, and purchase information.
Depending on the state where you live, you may have the right to know, access, correct and delete personal information, and not to be discriminated against for using these rights. To use them, contact us at [CONTACT EMAIL], or delete what our relay keeps with Delete My Data on the Server in the app's Settings.
ClamNotes is for adults only. It is not directed to children under 13, and we do not knowingly collect personal information from them.

14. Changes to this policy

We will update this policy when ClamNotes, our providers or the law change. We will tell you about significant changes in the app before they take effect, and ask for your permission again where the change requires it. Each version has a version number and an effective date at the top.

15. Contact

For any question about privacy or this policy:

[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Email: [CONTACT EMAIL]