Privacy policy

Ambient Notes is a personal note surface. This policy explains exactly what leaves your device, what the service can and cannot read, and how to remove everything.

The short version

• Notes are encrypted on your device before they are sent anywhere.
• The service stores ciphertext. It has no key and cannot read a note.
• An account is optional, has no password, and cannot open a space or read a note.
• Nothing is sold, shared, or used for advertising or model training.
• You can delete the entire synced copy from inside the app at any time.

What Ambient Notes collects

Note content. Your notes stay on your device. If sync is used, each note is encrypted with a key generated on your device using AES-256-GCM, and only the resulting ciphertext, a random nonce, and a keyed content fingerprint are sent to the service. The fingerprint lets the service notice that two devices changed the same note differently, so an edit is preserved as a conflict copy rather than silently lost. It cannot be reversed to recover the text. A place's name is encrypted the same way, so the service can file a note into a place without knowing what that place is called.

Note metadata. Colour, paper style, pinned state, archived state, whether a note is locked, board position, which place a note is filed in, reminder times and how often a reminder repeats, timestamps, and version numbers are stored unencrypted so the service can order and reconcile changes across devices. Treat these as visible to the service. Note text, which is the sensitive part, is not. A locked note is encrypted exactly like every other note; the lock only tells the service that the note is locked.

Sync space identifiers. A private sync space is an anonymous identifier with no personal information attached. Access uses a bearer capability generated on your device; the service stores only a SHA-256 hash of it. Each device also sends a random identifier of its own so the service can tell which device last changed a note; it is generated locally and says nothing about the hardware.

Accounts. Signing in with Apple is optional and offered on iOS. It gives a space an owner, so there is somebody to bill, to warn before anything is deleted, and to help when they write in. The service stores Apple's per-app identifier for you and, when you share them, your Apple account name and email address. The email is often a private relay and is used only for writing to you. The service does not retain Apple access, identity, or refresh tokens. Apple may send the service a signed notice when you disable or enable private email forwarding, revoke consent, or delete your Apple Account. Those notices update forwarding state or delete the Ambient account and its owned cloud data. The name is used only to label your account in the app. Apple does not provide a profile photo, and Ambient Notes does not ask Apple for one. Signing in hands back no capability and no key, so an account cannot open a space or read a note.

Guest accounts, when you open a shared link. Opening an invitation link without an Apple account creates a guest account so the note has somebody to belong to. It holds the display name you type on the join screen and nothing else: no email address, no Apple identifier, no password. The name exists so the other people in that note can see who is editing, which means they see it — choose accordingly. A guest account can be deleted from the app like any other account, and deleting it removes the name.

Shared notes. Sharing a note creates a shared document the service relays between the people in it. Its text and presence travel as sealed frames encrypted on the device with a key the service never holds, exactly like private notes. Drawings and pictures on the note are not part of the shared document — they stay in your own space and sync only to your own devices; the other people in the note see the text. What the service does hold, and can read, is who is in a note, what part each person plays in it (owner, editor, viewer), when they joined, the public half of each participating device's key, invitation codes as hashes, and, for each relayed frame, which device sent it, in what order, and when it arrived. Sealed frames are kept only as a bounded recent tail so somebody who was away can catch up. Removing a member, leaving a note, or stopping sharing ends that person's access; it cannot reach back and unread what they already read, and this policy will not pretend otherwise.

Problem reports. Choosing Report a problem sends what you type, along with a description of what the app was doing: the screen you were on, recent gesture shapes, sync state, the app version and build, the iOS version, the kind of device and its screen size, its orientation, how many notes, places, pinned and archived notes you have, and the size and position of the card and list involved. It never includes note content, note titles or place names, and you see the report before it is sent. It goes to GitHub, where it becomes an issue in this project's private repository. GitHub processes that report on our behalf; if you would rather not send anything to GitHub, do not use that button. Reporting a shared note (from People in this note) uses the same channel and additionally carries that share's identifier, never its text, so we can act on the report.

Approval alerts (push notifications). If you approve another device's request for your notes, the app can alert you. To do that it stores a push token for your device — the identifier Apple's notification service assigns — with your account. The notification itself is a fixed sentence; it never carries note content or anything derived from it. Push tokens are deleted with the account, and turning alerts off stops new ones being stored. Apple delivers the notification, as it does for every iOS app.

Diagnostics. The service records ordinary operational logs (timestamps, request paths, status codes, a release identifier, and account identifiers for account operations so a support request about one can be answered) to keep the service running. Note content never appears in logs, telemetry, or error reports.

What Ambient Notes does not collect

No password or phone number is ever requested. There is no advertising identifier, no analytics SDK, no location data, no contacts access, and no cross-app tracking. Your notes are never used to train machine learning models.

Encryption and its consequences

The encryption key never reaches the service. On Apple devices it is stored in the Keychain as a synchronizable item, which means iCloud Keychain carries it between your own devices, end to end encrypted in a way Apple cannot read either, so a restored phone finds its own notes. On the web the browser holds it in a form the page cannot read back out, where the browser supports holding one — a browser that cannot (or that blocks the storage involved) falls back to keeping the key alongside the credential, protected by the browser's own same-origin rules. Anywhere iCloud Keychain does not reach, the key travels through the device-link flow or a recovery phrase, both of which wrap it so the service only ever sees an opaque blob.

On your own devices, notes are stored the way device-local data ordinarily is — protected by your device's passcode, account and operating system rather than by the sync key. The encryption above is about what leaves the device.

This has an important consequence you should understand: if you lose every device, do not have iCloud Keychain switched on, and have not saved a recovery phrase, your notes cannot be recovered by anyone, including us. That is the cost of the service being unable to read them. The app cannot tell whether iCloud Keychain is on, because Apple exposes no way to ask, so a recovery phrase saved from the Private space screen is the only guarantee.

Shared notes

You can share a single note with other people, by a link. Here is exactly what that means for your data.

The content stays encrypted. A shared note's text travels between participants as sealed frames, encrypted on your device with a key for that note before anything is sent. The service relays and stores those frames as ciphertext it cannot read, exactly as it stores your private notes. The note's key is delivered to each participant's device wrapped for that device's own key pair; the service sees only opaque envelopes.

Who can see what. Everyone who has joined a shared note can read and edit its text and can see the display name each participant chose, along with when they are present in the note. The service can see that a shared note exists, which accounts and devices are members, and when frames were exchanged -- it cannot see the note's text or its title, and it is never told which of your private notes a shared note is bound to on your device.

Links. Anyone with an invitation link can join the note until the link expires or you remove them. Treat a link like a key: sending it to somebody is inviting them in.

Joining without an account. Someone who opens a link without an account is asked for a display name and gets a guest session. The name is the only thing asked for; it is shown to the other participants and stored with the guest's membership.

Leaving and deleting. Your own copy of a shared note stays yours: it lives in your private space like any other note, and deleting your synced copy or your account removes your membership. The shared document and its frames are removed when the shared note itself is deleted.

Photos

Two different things use the photo picker, and they are treated differently.

A custom background is processed and stored on that device only. It is never uploaded and is not part of sync.

An image attached to a note, whether picked from your library or taken with the camera, is part of that note. It is encrypted on your device with the same key as the note's text, before it leaves, and syncs so your other devices can see it. The service stores it as ciphertext it cannot read, exactly like note text and doodles. Attached images are resized and compressed first, both to keep them small and because a note shows an illustration rather than an archive of the original photo. A photo taken with the camera is treated no differently: nothing about it is stored or sent unencrypted, and the camera is not used for anything else.

Handwriting

Handwriting is ink, and it stays ink. Nothing reads it and nothing turns it into characters: the canvas keeps the strokes you drew, and they are encrypted before sync like the rest of a note. What you write is never sent to Google or to anyone else.

Earlier builds tidied handwriting into neat script using a recognition model downloaded from Google and run on the device. That feature has been removed, so there is no model to download and nothing about handwriting touches the network at all.

Deleting your data

Deleting the app removes every local note from that device.

To remove the server data used for sync and recovery, open Private space and choose Delete synced copy. This erases the sync space and everything attached to it, including all encrypted notes, the full change history, every access capability, and any pending device-link codes. Notes already on the device you are holding are kept so you do not lose your work. Your Apple account is not deleted. The deletion is immediate and cannot be undone.

If you signed in, Delete Ambient Notes account in the Apple account screen removes the account and every synced copy it owns. It refuses the first time and says how many synced copies that is, so the cost is named before anything is erased rather than after. Notes already on your devices are kept here too. You confirm the action with Apple, and Ambient Notes revokes its Sign in with Apple authorization before deleting the account. A guest account is deleted the same way and needs no confirmation from Apple, because there is no Apple identity behind it.

Deleting an account also removes everything collaboration held for it: the shared notes it owned, along with their membership, invitations, key envelopes and relayed frames; its membership of anyone else's shared notes; its devices' public keys; and the frames it published. Other people's shared notes survive, without you in them.

Data retention

Encrypted notes and their change history are retained until you delete the sync space. A shared note's relayed frames are kept as a bounded recent tail — the newest five thousand — and older ones are discarded as new ones arrive. Invitations expire after seven days and are then purged, as are account sessions after thirty days and the frames of a note that is no longer shared. The record of an ended share — the shared document's row, who was in it and when — is purged thirty days after it ended, and a removed member's seat thirty days after the removal; who once shared what with whom is not kept as a permanent record. A guest account whose sessions have all expired and that is no longer in any note is deleted, typed name and all — a guest has no way to sign back in, so nothing reachable is lost. Deleting a note keeps it as a row marked deleted, which is how a second device learns the note is gone rather than putting it back. Its encrypted text, doodle and pictures stay with that row for up to thirty-one days (thirty, plus a day's grace for a device whose clock runs behind), so Recently deleted can restore the note on any of your devices; after that the doodle and pictures are purged and only the encrypted text and the metadata remain. Deleting the synced copy or the account removes everything at once, deleted notes included. Expired device-link codes and old idempotency receipts are purged automatically by routine maintenance.

A sync space that has never held a note or a place is reclaimed thirty days after it was created, provided nothing has ever contacted it and it carries no recovery phrase, no linked device, and no account. A space that holds notes is never reclaimed, however long it has been quiet.

Service providers

The service runs on Microsoft Azure (App Service and Azure Database for PostgreSQL) in the United States, and the web client is served by Vercel. These providers process data on our behalf as infrastructure and can only ever see encrypted note content. GitHub processes the problem reports you choose to send, as described above. Traffic uses HTTPS, and the database is not reachable from the public internet.

Children

Ambient Notes is not directed at children under 13 and does not knowingly collect information from them.

Changes

Material changes to this policy will be reflected here with an updated date, and significant changes will be surfaced in the app.

Contact

Questions about privacy or a data request can be sent to the support address on the support page, which is also the support contact listed on the App Store product page.