Privacy policy

Scope

This policy covers the Little Notes iPhone/iPad app and keyboard extension, version 0.13.0. Effective and last updated October 9, 2026. See our support page for public help; use the in-app support channel for requests involving personal information.

Information on your device

Text, files, identity keys and contact cards are processed on device. There is no messaging server, advertising, analytics SDK or tracking. The app does not automatically send input, keys, files or contacts to the developer. Retention of identity keys, outgoing records and incoming records is separately optional and off by default. Retained data is encrypted locally; protection keys use a device-only, non-synchronizing Keychain. Preferences remain local.

Keyboard and Full Access

Sharing public cards is separate from authorizing private-key decryption. If you enable sharing, identity names and verified friends’ public cards enter the local shared container. This public configuration is not vault-encrypted; system file protection applies. You must explicitly grant a 15-minute session in the main app to place the current identity key in a dedicated local Keychain group. Keyboard records are staged encrypted and imported according to retention choices when you return to the app. Ciphertext is read only after you press the system Paste control, without automatic clipboard polling. Full Access enables local sharing and also grants network capability through iOS. Neither the app nor keyboard uses it to upload content.

Local phrase learning

Learning is off by default. If enabled, only short phrases you confirm in the keyboard’s writing area are learned. Up to 500 entries are encrypted on device and can be disabled or cleared. Received plaintext, passwords and text in other apps are not learned.

Camera, files and images

Camera access is requested only for the contact-card QR scanner. Frames are processed locally and are not saved or uploaded. The app does not access system contacts, location, microphone, motion data or advertising identifiers. You choose files through system pickers. Image and video carrier processing is local. Temporary output PNGs are not vault-encrypted and are removed on leaving the relevant page, clearing data or restarting. Apple Vision text comparison runs on device and keeps results only in the page’s memory.

App passwords and deletion

Password verification values, failure counters and replacement conversation presets use a local non-synchronizing Keychain; the original password is not stored. Destructive passwords or an enabled failure threshold clear the original workspace and create the configured replacement preset. Verification rules and presets may remain. Manual Clear all sensitive information also deletes these settings. Clearing does not remove external exports, recipients’ copies or system backups, and does not promise physical flash erasure. There is no server account to delete.

Sharing you choose

When you export, copy or share through another app, the selected service handles the data under its own policy. Little Notes has no in-app iCloud sync; services you select in system pickers may use a network. We cannot recall or delete external copies.

Support email and this website

This website is hosted on GitHub Pages. Our pages embed no analytics, ads, external fonts, forms or tracking scripts. GitHub may process IP addresses, request times and access logs to provide and protect hosting. See the GitHub Privacy Statement below for processing, retention and international transfers. GitHub Issues submissions are public and handled by GitHub under its policy; do not include personal information. If you voluntarily contact support through the in-app channel, the developer uses the information you provide to answer your request, not for advertising. Support information is retained as needed for the request and deleted when no longer needed, unless law requires retention. Website browsing is distinct from the app’s offline processing.

GitHub Privacy Statement

Limits and contact

While your device is unlocked, content may exist in memory or temporary files. Encryption cannot protect a compromised device. Without the original key and backup, the developer cannot recover messages. Contact the in-app support channel for privacy requests. Material policy changes will be dated here.

Your privacy rights

We process voluntarily supplied support information as needed to answer requests, maintain the product and meet applicable obligations; where law requires consent, we rely on that consent. Use the in-app support channel to exercise applicable access, correction, deletion, restriction, objection or consent-withdrawal rights. You may complain to a competent authority. Do not put personal information in public issues. We do not sell support information or use it for cross-app advertising tracking. The app does not request children’s real names, dates of birth or identification documents.

Contact-specific schemes

A contact-specific scheme that you create or confirm for import contains the algorithm order, a dedicated secret and participating identities. It is stored in encrypted local data. Export encrypts the scheme to the selected friend’s public key for sharing that you initiate; the developer does not receive it. When you authorize a keyboard session, relevant schemes are included in the dedicated local Keychain authorization and are available to the keyboard while that session is valid. Identity-key backups do not include these scheme secrets; both participants need to retain their schemes. Clearing local data does not delete copies already shared with the other participant.

Groups and local history (0.13.0)

Group names, member public keys, group-key versions and message history remain on device. Invitations are encrypted to the selected member’s public key for sharing you initiate; the developer receives no group information. An explicitly authorized keyboard session can access permitted group keys through the dedicated local Keychain. Removing a member and rotating keys protects subsequent messages under the new version, but cannot recall keys or content already received. History has no fixed record-count limit, is constrained by available device storage and supports selective deletion. Local deletion does not remove external copies. Identity-key backups are not group-key backups; retain the relevant materials separately.

Ordinary typing and offline operation

The keyboard starts in Input mode and supports ordinary typing without contact cards or Full Access. Text you commit is passed to the current app, which handles it under its own policy. Switching modes does not insert a private Write draft into another app. Neither the app nor keyboard initiates network requests. System file providers and external sharing apps you select may use a network.