Privacy policy

Version 2 · Effective October 19, 2026

Status: draft, not reviewed by a lawyer.

1. Who we are

KeepNote is made by AI Eh By Solutions, Newfoundland and Labrador, Canada. We are responsible for the personal information described here.

Our Privacy Officer is the person in charge of protecting personal information (including under Quebec's Law 25). Write to them at privacy@ai-eh-by.ca. For help with the apps, write to support@ai-eh-by.ca.

KeepNote is private software used by a small, invited group. This policy covers every part of it:

• This website (keepnote.ai-eh-by.ca).
• The web app (app.keepnote.ai-eh-by.ca).
• The Android app, the iPhone app (with its Apple Watch app and widgets) and the desktop app for macOS and Windows.
• The sync service, which keeps your devices in step, serves share links and these pages.
• The Claude connector, which lets Claude read your conversations when you connect it.
• Your AI server and its relay, when you use "My AI server" for transcripts and notes.

KeepNote works with the Fieldy pendant, a recording device made by another company. We are not the pendant's maker, and its own app and cloud are not covered by this policy.

2. What we collect

Account

If you sign in to sync: your email address, the sign-in method (Google, Apple or email and password), a password hash if you use a password, and sign-in times. You can use the Android, iPhone and desktop apps without an account; then nothing below marked "synced" leaves your device.

Your content

• Recordings: audio from the pendant, your phone, your Apple Watch or your computer (microphone and, on the desktop, the computer's own sound when you allow it).
• Conversations: transcripts, speaker labels and names, summaries, tasks, bookmarks, titles, templates, names and terms you add, and your Ask questions and answers.
• Voices: voice samples you record for a speaker profile and the voice embeddings (number lists) made from them, used to recognise that speaker in later recordings. This is biometric information; it is optional.
• Location tags (optional, off until you turn them on): where a conversation started and ended, and the place name.
• Calendar information (optional): the title, time and attendees of the calendar event happening during a recording.
• Contact names (optional): names from your contacts, used only to spell names correctly.

Device and usage

• Devices: device name, model, app and system version, sign-in times, and the approximate city, region and country of the address a device connects from (from our hosting provider's network), shown to you in Settings → Sync → Devices.
• Activity: an activity log of what changed in your account (which device, which item, which fields), without the content.
• Push: the push address of each device or browser where you turn notifications on.
• Technical logs: IP address, time and request, kept for security.
• Pendant: the pendant's Bluetooth address, battery, firmware version and status. These stay on your device.

This website

This website sets no cookies and uses no analytics. Your light or dark theme choice is kept in your own browser. When you send the contact, support or deletion form, we receive and store your name, email address, topic and message, and keep a log of the email that delivers it to us.

The apps: permissions we ask for and why

• Microphone (all apps): to record when you press record or turn on Always On listening.
• Bluetooth / Nearby devices (Android, iPhone): to connect to your pendant.
• Notifications (all apps): recording status, notes ready, task reminders.
• Location (Android, iPhone, desktop, web app; only when you turn location tags on): to tag conversations with a place.
• Calendar (Android READ_CALENDAR, iPhone Calendars, macOS Calendars): to link a recording to the event happening at the time, and to use event titles and attendee names to spell names correctly. The calendar is only read, never changed.
• Contacts (Android READ_CONTACTS, iPhone Contacts; optional): to spell names correctly in transcripts.
• Speech recognition (iPhone, Android): for the live transcript on the device.
• Local network (iPhone): to reach your own AI server.
• Screen & system audio recording (macOS) and computer sound (Windows): to record the other side of a call on the desktop.
• Background activity (Android, iPhone, Apple Watch): to keep recording and stay connected to the pendant.

3. Why we use it, and what we never do

We use your information to record, transcribe and summarise your conversations; to keep your devices in step; to show calendar, task and reminder features you turn on; to send the notifications you ask for; to answer Ask questions; to serve share links you create; to answer support requests; and to keep the service secure.

We never sell your information, never use it for advertising, never use it to track you across other sites or apps, and never use your content to train AI models. The AI providers you choose process your content to give you the result; their own terms say whether they keep it.

4. Consent and your choices

These are off until you turn them on, and you can turn each off again in Settings: sync and account, recording sync, location tags, including the place in AI prompts, voice samples, calendar, contacts, Google Calendar & Tasks, notifications on each device, the Claude connector, share links, and each AI provider.

Before your first recording, each app asks you to confirm that you will get the consent of the people you record. Turning a feature off stops new collection; to remove what was already collected, delete it (section 10).

5. Who we share it with

We share information only with the service providers below, and only what each one needs. They act for us or for you, under their own security and privacy terms.

Always, when you use sync, the web app or this website

• Google Cloud (Google LLC): hosts the sync service, its database, recording storage, backups, logs and secrets in Montréal, Canada; Firebase Hosting serves this website and the web app worldwide.
• Google Identity Platform (Google LLC): accounts and sign-in, and the sign-in emails it sends (verify your address, reset your password). It may process data outside Canada.
• Google Fonts (Google LLC): the sync service's pages (share links, these pages when opened from the apps) and the Claude connector's sign-in page load fonts from Google, which receives your IP address.

When you choose to use them

• Sign in with Google (Google LLC) and Sign in with Apple (Apple Inc.): your sign-in request; they return your email address.
• Google Calendar and Google Tasks (Google LLC), if you connect a Google account: see section 13.
• Push notification services: see section 13.
• The AI provider you choose for transcripts, notes and Ask, which receives the audio or text it processes and, if you allowed it, event and place details:
  • My AI server: our own AI server in the owner's premises in Canada. Away from that network, requests pass through a relay on Google Compute Engine (Google LLC) in South Carolina, United States (us-east1).
  • Claude (your subscription): text sent through My AI server to Anthropic (Anthropic PBC, United States).
  • OpenAI (OpenAI, United States), Deepgram (Deepgram, United States), Baseten (Baseten, United States), Anthropic (Anthropic PBC, United States) for Ask in the web app, or a custom provider at an address you enter: under your own account and key with that provider.
  • On device: nothing leaves your device.
  • In the web app, the sync service relays these calls for you (it does not keep the audio or text; it keeps your provider key, encrypted).
• Speech recognition by your system: the live transcript uses your device's on-device recognition (Android, Apple). In the web app, your browser's speech recognition is used, which for some browsers (for example Google Chrome) sends the audio to the browser maker; choose "On device" to avoid it. Android's voice input for Ask may use Google's speech service if no on-device model is installed.
• Place names: when location tags are on, the coordinates are turned into a place name by Google (Android), Apple (iPhone and macOS) or the OpenStreetMap Foundation's Nominatim service (United Kingdom; web app). Windows uses Microsoft's location service for the position.
• Calendar feeds (web app): the sync service fetches the calendar address (ICS) you add from the calendar provider that publishes it.
• Claude (Anthropic PBC, United States), if you connect the Claude connector: the conversations, tasks and people Claude asks for while you use it in your Claude account.
• Fieldy (the pendant's maker), if you sign in to your Fieldy account in Settings → Firmware: your email address, the sign-in code and the pendant's hardware revision, to download firmware.
• Hugging Face (United States): the Android app downloads its on-device language model from Hugging Face, which receives your IP address; no content is sent.
• Google Workspace / Gmail API (Google LLC): delivers the messages you send with the website's contact, support and deletion forms to our mailbox, with your name, email address and message. Each submission and the log of its email are also stored in our forms database on Google Cloud in Montréal.
• Cloudflare Turnstile (Cloudflare, United States) or Google reCAPTCHA (Google LLC), only if we turn on a spam check on the website forms: your IP address and browser signals.

We may also disclose information when the law requires it. We tell you about such a request unless we are not allowed to.

People you share with

Anyone with a share link you create sees the parts you chose (summary, tasks, transcript, recording) until you revoke it or it expires. Share links are public to anyone who has them.

6. Where your data is stored, and transfers outside Canada

Synced data, recordings, backups and logs are stored on Google Cloud in Montréal, Canada (northamerica-northeast1), and the Claude connector's sign-in records in the same region. Your AI server is in Canada. Everything else on your devices stays on your devices.

Some providers in section 5 process information outside Canada and outside Quebec, mostly in the United States: Google Identity Platform, Firebase Hosting's worldwide network, the AI relay, push services, sign-in providers, and any AI provider, place-name service or connector you choose. Before using a provider, we assessed that it protects information with encryption in transit, access controls and contractual commitments. Information outside Canada is subject to the laws of that country, including access by its authorities.

7. How long we keep it

8. Cookies and storage on your device

This website: keepnote.theme in your browser's local storage (your theme choice), removed when you choose "System"; a choice saved earlier under site-theme is moved there and the old key removed.

The web app:

• __session cookie: your sign-in (HttpOnly, 14 days), removed when you sign out.
• Local storage: keepnote.theme (theme), keepnote.local (this browser's recording and notes settings), keepnote.deviceId (this browser's id in your device list), keepnote.install-dismissed (you closed the install tip), keepnote.recording-consent (your recording consent and its version), keepnote.auth.lastProvider (the sign-in method you used last, shown as "Last used"; removed when you delete your account).
• Session storage: keepnote.signedInAt, keepnote.after-signin (the page to return to) and keepnote.auth.link (a sign-in method waiting to be linked to your account), cleared when the tab closes or you sign out.
• The app's offline files (Cache Storage keepnote-web-…), replaced on each update.

The Android, iPhone and desktop apps keep your recordings, conversations, voices, settings and backups in their own storage on the device (databases keepnote.db and sync.db, app settings keepnote and keepnote-sync), and keys in the system's secure store (Android Keystore, Apple Keychain). Signing out of sync keeps your local data; uninstalling the app or deleting it in the app removes it. Backups you export are files you control.

The Claude connector's sign-in page uses one __session cookie for 10 minutes while you sign in.

9. Your rights

You can ask to see, correct or get a copy of your information, withdraw a consent, or have it deleted. Most of this you can do yourself: export and backup in Settings → Backup, edit in the app, delete in Settings → Sync → Delete account. For anything else, write to our Privacy Officer at privacy@ai-eh-by.ca. We answer within 30 days.

You can complain to the Office of the Privacy Commissioner of Canada and, if you live in Quebec, to the Commission d'accès à l'information du Québec.

10. Deleting your account

In any app: Settings → Sync → Delete account deletes your account and everything synced (conversations, recordings, tasks, voices, share links, devices, the Google connection and the activity log) at once. Without the app, use the deletion page: we delete within 30 days and confirm by email. Database backups that still contain your data expire within 30 days. Data on your own devices stays until you delete it there.

11. Security, breaches and risks

Information is encrypted in transit and at rest. Provider keys, calendar addresses and the Google connection are additionally encrypted with a key only the sync service can use. Access is limited to the people who run the service.

If a breach creates a real risk of significant harm, we notify the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec where it applies, and the people affected, and we keep a record of every breach.

Recordings and voice embeddings are sensitive. Anyone with your unlocked device, your backup files or a share link can see what they contain.

12. Children

KeepNote is for people 14 and older. We do not knowingly collect information from children under 14. If you think a child under 14 has an account, write to privacy@ai-eh-by.ca and we will delete it.

13. Features with their own rules

Audio, recording consent and voices

Recording people can require their consent by law. You are responsible for it; each app reminds you before your first recording. Voice samples and embeddings are biometric information: they are made only when you record a sample or choose "Remember this voice", used only to suggest speaker names in your own recordings, never used to identify anyone else, and deleted with the speaker profile or your account.

AI features

Transcripts, summaries, tasks, name fixes and Ask answers are made by the AI provider you choose (section 5). With "Hybrid" processing, short recordings are handled on the device and longer ones by your AI server. Recordings marked "Skipped (not noteworthy)" are not sent anywhere until you choose "Process anyway". AI results can be wrong.

Push notifications

When you turn notifications on, your device or browser gives us a push address and we send notifications through its push service: Firebase Cloud Messaging (Google LLC) for Android, iPhone and Chrome, Apple Push Notification service (Apple Inc.) for iPhone and Apple Watch (Firebase Cloud Messaging hands iPhone notifications to it) and for Safari, Mozilla's push service for Firefox, and Microsoft's push service (Windows Push Notification Services) for Edge. A notification says only what happened (for example "Task due", or "New note ready" with the number of suggested tasks), never the text of your tasks, notes or conversations, and the item it opens. Turn them off per device in Settings → Notifications (or in your system or browser settings); the address is then deleted, and unused addresses are deleted after 60 days.

Location, contacts and calendar on your device

Location is used only when you turn location tags on; the place is kept with the conversation, synced if you use sync, and sent to an AI provider only if you turn on "Include place in AI context". Contacts are read only on the device and only names are used; they become part of the vocabulary sent with a recording to your AI provider. Calendar events are read on the device; the title and attendees of the linked event are kept on the conversation and used as vocabulary.

Google Calendar and Google Tasks

If you connect a Google account (Settings → Calendar → Connect Google Calendar & Tasks), the sync service keeps a Google refresh token, encrypted, and your Google email address. With Calendar it reads your calendar list and the events of the calendars you choose, to show them and to put an event's title and attendees on the conversation recorded during it; it never changes your calendar. With Tasks it copies your tasks to the Google Tasks list you choose and copies that list's tasks back (text, due date, done, deleted). Scopes: calendar.calendarlist.readonly, calendar.events.readonly and tasks. Google data is used only for these features, is never shared, sold, used for advertising or used to train AI models, and no person reads it unless you ask us to for support or the law requires it.

KeepNote's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect in the same place (or delete your account) and the service revokes its access at Google and deletes the token; you can also remove access at myaccount.google.com/permissions.

The Claude connector

When you connect KeepNote in Claude, you sign in here and the connector gets read-only access to your synced conversations, tasks and people. Claude receives only what it asks for while you use it, and Anthropic handles it under your Claude account's terms. Disconnect it in Claude, or disconnect it in Settings → Sync → Devices, where it is listed with your devices.

Invited users

KeepNote is invite-only. Team members who use it are users like anyone else under this policy.

14. Changes to this policy

When we change this policy, we update the version and date at the top. For a change that affects how your information is used, the apps ask you to accept the new version before you keep using sync.

15. Contact

Privacy Officer: privacy@ai-eh-by.ca. Support: support@ai-eh-by.ca.