There is no account, and there is no server of ours.

Notula for iPhone

The phone app collects nothing. There is no analytics, no crash reporting, no advertising identifier and no tracking of any kind, and the app's privacy manifest declares the same.

What it holds on the phone stays on the phone:

• The token for your git host is kept in the iOS keychain, which is encrypted by the system and is not readable by any other app.
• The documents you open are fetched from your git host and cached on the device so that recent ones are readable with no signal. Deleting the app deletes them.
• Dictation is done by iOS on the device. Nothing is sent to a speech service, and no recording is kept once the words are on the page.
• Photographs are read only when you attach one, and only the one you pick. Nothing is written back to your library.

Notula never sees your password. Signing in happens on GitHub's or GitLab's own page, and what comes back is a token scoped to the repositories you ticked.

Notula for macOS and Windows

The desktop application works on files in a folder on your disk. It has no account, and it sends nothing anywhere except the two things below.

Git. Fetching and pushing goes to whichever host the repository already points at, using the credentials you gave it. That is the same traffic your terminal would make.

Update checks. The application asks GitHub whether a newer release exists. GitHub sees that request the way it sees any other, including the address it came from. There is no version of this that reports to us, because there is no us to report to.

Crash reports, if you switch them on

The desktop application can send a crash report to Sentry. It is off when you install it, and nothing is transmitted until you turn it on in Settings.

• Stack traces, never memory. A crash dump is a slice of the heap, and the heap of this application is your document. Those are switched off. What leaves is the error message and the stack.
• Paths are replaced before a report goes out, so the folder your work lives in does not travel with it.
• Nobody is counted. Session tracking is off. A crash report says what broke, not who was running it.

Turning the switch off stops it again, and no report is sent while it is off.

The phone app has no equivalent. It sends no crash reports at all.

This website

notula.org uses Google Analytics to count visits. It records page views, how far down a page people scroll, and clicks that leave for another site. It is not tied to a name or an account, because there is no account on this site to tie it to.

The feedback form at the foot of the home page sends what you type in it. If you put an address in, that is how a reply reaches you; if you do not, nothing is stored that could identify you.

Your git host is not us

Your documents live in your repository on GitHub, GitLab, or a GitLab server of your own. Everything you write through Notula lands there as an ordinary commit under your own name, and everything Notula shows you was read from there.

What that host keeps, and for how long, is between you and them. Notula adds nothing to it and takes nothing out of it.

Children

Notula is a tool for working on documents and is not directed at children. Nothing is knowingly collected from anybody, of any age.

If this changes

This page is rewritten when the software changes, and the date at the top moves with it. A change that would send something new says so here before the version that sends it ships.

Questions about any of it: the feedback form on the home page, or open an issue.