Notara Privacy Policy

DRAFT: needs attorney review before publishing. Written from what the code does today. A lawyer must check it for your jurisdiction (GDPR/UK GDPR, CCPA/CPRA, COPPA, FERPA if schools are targeted) and fill in the bracketed items.

_Last updated: 13 October 2026 (AI consent, processors, ads and diagnostics)_

[COMPANY LEGAL NAME] ("we") operates Notara (the app and getnotara.app). Contact: [privacy@getnotara.app], [POSTAL ADDRESS].

What we collect

• Account:
• Email address and password (stored hashed by our auth provider).
• If you use Sign in with Apple or Google: the name and email they share. Apple may give us a private relay address.
• Your content:
• Audio and video recordings you make or upload.
• Transcripts, speaker names and edits, AI notes, summaries and answers.
• Typed notes, handwriting, imported PDFs, bookmarks, and vocabulary terms you enter.
• Purchases: plan, subscription status and transaction ids from Stripe (web), Apple or Google (through RevenueCat). We never see full card numbers.
• Usage:
• Transcription minutes used and AI feature counts, so we can enforce plan limits.
• Technical logs (IP address, request times, errors), kept [30] days.
• Advertising (Free plan, optional): when you choose to watch a rewarded ad for extra minutes or an AI action, Google AdMob shows the ad. We request non-personalised ads only, we don't track you across other companies' apps or websites, and we never sell personal information. Paid plans have no ads.
• Diagnostics (if enabled): crash and error reports (Sentry) and product usage events (PostHog, EU hosting), with names, emails, IP addresses and recording/transcript content removed before sending. See "Analytics and crash reports".

AI processing and your consent

Before Notara sends anything to an AI or speech service, the app shows a consent screen that names each service and what it receives. Nothing is sent until you tap Agree and continue. We store when you agreed and which version you agreed to.

You can withdraw consent any time in Settings → Privacy. Transcription and AI features then stop until you agree again. Features that run on your device (typed notes, handwriting, planner, focus timer and on-device transcription where available) keep working. If we add a service or change what is sent, we ask again.

How we use it

• To provide the service: transcription, live captions in accessibility mode, notes, search, Ask, export and sharing links you create.
• For billing and plan limits, security and abuse prevention (rate limits), support, and legally required records.
• We do not use your content to train AI models. Our processors are bound not to train on it ([confirm in each vendor's terms]).

Processors (service providers)

• Supabase: database, file storage, authentication. Region: [us-east-1].
• Deepgram: live captions, and speech-to-text for recordings when AssemblyAI fails or when you choose "Always use best quality" (English). Audio is sent for processing.
• AssemblyAI: speech-to-text for uploaded and recorded files, including Spanish and Spanish + English recordings. Your custom vocabulary is sent with the audio. We delete the transcript at AssemblyAI right after we receive it. With "Always use best quality" on, English recordings stay on Deepgram.
• DeepSeek: AI notes, summaries, study tools, transcript correction and Ask. Transcript text and notes are sent. [Confirm region and data-retention terms of the DeepSeek API contract.]
• Google AdMob: rewarded ads on the Free plan, only when you choose to watch one; non-personalised.
• Stripe: web payments.
• RevenueCat, Apple and Google: in-app purchases.
• [Resend/Postmark]: account emails.
• Sentry (if enabled): crash and error reports, PII-scrubbed.
• PostHog (if enabled, EU cloud or self-hosted): product usage events, no content and no IP address.
• Vercel/[HOST]: website hosting.
• Expo, Apple (APNs) and Google (FCM): push notifications for study groups, if you allow them. They receive your device's push token and the notification text (group name, sender's display name and a short preview of the message).

Analytics and crash reports

These are off unless configured, and are limited to:

• Crash/error reports: the error, stack trace, app version, device model and OS. Emails, names, tokens, IP addresses and any recording, transcript or note text are removed before sending.
• Usage events: a small fixed list (for example "signed up", "first recording finished", "viewed plans", "purchased"), tied to a random ID rather than your email, with no content.

You can opt out in Settings → Privacy.

Retention and deletion

• Your content is kept until you delete it, with one exception: on the free plan, audio files are deleted 12 months after recording. Transcripts and notes are kept, and the app warns you 30 days ahead. Paid plans keep audio.
• Deleting a recording removes its audio and transcript. Deleting a note removes its files after a short grace period of about 10 minutes.
• Delete account (Settings, in the app and on the web) permanently removes your account, recordings, notes and files. Cancel any active subscription first.
• Backups roll off within [7] days.
• Billing records are kept as required by law.

Sharing

• We share content only when you create a share link, which anyone with the link can open until you revoke it, share a class folder, join a study group, or when required by law.

Study groups

• Who sees what: members of a group see your display name (never your email), your role, the messages and images you post, your reactions, and the recordings, notes and decks you file in the group's class folder. Invite links work only for signed-in accounts.
• Messages and images are stored in Supabase. Images are private to members and served by short-lived links. Edited messages keep only the latest text. Deleted messages are removed from the chat and their images are deleted.
• Moderation: when you report a message, a copy of its text and the author are kept for the group's owner and admins to review, even if the message is later deleted. Owners and admins can remove, ban and mute members and delete messages.
• Blocks are private: the person isn't told. You stop seeing their messages and notifications in every group.
• Leaving or deletion: if you leave or are removed, your filed items become unfiled and stay in your account; your past messages stay in the chat under your display name until you delete them. Deleting your account deletes your messages, images, reactions and push tokens; reports you filed stay with moderators without your name, and copies kept in reports about your messages stay until the group is deleted. When an owner deletes a group, its chat, images, invites and reports are deleted.
• Notifications: you choose all messages, mentions and replies only, or off, for each group. Push tokens are removed when you sign out or when the device stops accepting them.
• [Attorney review: minimum age for group chat, and school/FERPA context.]

Your rights

Depending on where you live, you can:

• Access, correct, export or delete your data.
• Object to or restrict processing.
• Complain to a regulator.

Email [privacy@getnotara.app]. We respond within [30] days.

Recording other people

You are responsible for getting consent where the law requires it before recording others (for example in two-party consent states and countries).

Children

Notara is not directed at children under [13/16]. [If marketed to students: describe the school/FERPA posture.]

International transfers

[Standard Contractual Clauses / DPF statement.]

Changes

We'll notify you in the app or by email about material changes.