Notensive AI Privacy Policy
- Operator: TAEIL HA
- Privacy officer and contact: TAEIL HA, ppilsns@gmail.com, +82 10-2772-9335
- Effective date: September 15, 2026
- App covered: Notensive AI (Android and iOS,
com.ainote.taeil)
Notensive AI (the “Service”) provides handwriting, note-taking, and AI assistance features. The Operator publishes this policy to protect users' personal information and promptly address privacy concerns in accordance with applicable laws, including the Republic of Korea's Personal Information Protection Act.
1. Personal information processed and its purposes
When you use the app without signing in, your notes and files are stored only on your device and are not sent to the Operator's servers. The server processing described below occurs only when you sign in or explicitly use the relevant feature.
| Category | Information processed | Purpose | Processing location |
|---|---|---|---|
| Account | Google or Apple account email, name (display name), sign-in provider identifier, registration and last sign-in times, language and app settings, Apple sign-in refresh token (stored encrypted; revocation requested from Apple upon account deletion) | Identify members, maintain sign-in, associate purchases and credits | Server (Supabase) |
| Note synchronization | Information about notebooks and notes you choose to synchronize, such as titles, parent notebooks, and creation, modification, and deletion times | Synchronize and back up notes across devices | Server (Supabase), for paid subscribers |
| AI features | Questions and note text you submit, selected note regions or handwriting images, image-generation prompts, AI responses, model used and token usage | Answer questions, summarize and translate, recognize handwriting and formulas, generate images, deduct credits and prevent duplicate charges | Server (Supabase) and OpenAI |
| Audio transcription and translation | Selected audio files, source transcripts and translations, audio duration, selected language | Transcribe and translate audio files, calculate credits | API server and OpenAI (files are not stored on the server after their duration is checked) |
| Payments and credits | App user identifier, product ID, store transaction ID or purchase token, subscription status and expiration, credit grants, usage, and refunds | Verify purchases, provide subscriptions and credits, reconcile refunds, prevent abuse | Server (Supabase and Cloudflare) |
| Support inquiries | Email address, inquiry content, materials you provide | Respond to inquiries and resolve disputes | Operator's email |
| Service usage records | IP address, request time, device and app information, error records | Security, incident response, abuse prevention | Server infrastructure (Supabase and Cloudflare) |
Payment-method information, such as payment card numbers, is processed by Google Play or the App Store. The Operator does not receive or store it.
The original content of AI requests is not stored on the server. Only a hash is stored to prevent duplicate charges for the same request. AI responses are stored so that network retries can return the same result without charging again.
2. Information processed on the device
| Feature | Information processed | Details |
|---|---|---|
| Note-taking | Note content, handwriting strokes, attached images, recordings | Stored in the app's storage on your device |
| Handwriting recognition | Handwriting strokes and recognition candidates | On-device recognition using Google ML Kit on Android. Network communication may occur to download recognition models and operate the SDK |
| Dictation | Microphone audio and recognized text | Uses your device's speech recognition service. Depending on operating-system settings, its provider may process the information |
| Photos and camera | Photos you select or take | Attached to notes |
The app requests microphone, speech recognition, camera, and photo permissions when you use the relevant feature. You can continue using other features if you decline a permission, and you can revoke permissions in your device settings at any time.
3. Retention and deletion
| Information | Retention period |
|---|---|
| Account, synchronized notes, attachments, AI responses | Until account deletion. Deleted immediately when requested in the app, or within 30 days of verification of an email request |
| Payment, subscription, and credit records | Five years from the transaction date, under Korea's Act on the Consumer Protection in Electronic Commerce, Etc. (records of payment and supply of goods or services). Stored separately from the account after account deletion |
| Support and dispute-resolution records | Three years under the same Act (records of consumer complaints or disputes) |
| Service usage records (access logs) | Automatically deleted according to infrastructure providers' log-retention settings, up to a maximum of three months |
Information is destroyed without delay when the retention period expires or its processing purpose has been fulfilled. Electronic files are deleted using methods that prevent recovery. Information retained by law is kept separately and used only for the required purpose.
You manage notes stored on your device. You can delete local notes, images, and recordings in the app under Settings → Data management. Files already exported or shared, and operating-system backups, are not automatically deleted by the app.
4. Disclosure to third parties
The Operator does not disclose users' personal information to third parties except with the user's prior consent or when required by law.
5. Service providers and international transfers
The Operator engages the following providers to process personal information to deliver the Service. These providers are located outside Korea. Data is transferred over an encrypted network (HTTPS) when you use the relevant feature.
| Provider (contact) | Destination country | Information transferred | Processing purpose | Retention and use |
|---|---|---|---|---|
| Supabase, Inc. (privacy contact) | Japan (Tokyo region) | Account, synchronized notes, AI responses, payment and credit records, usage records | Database, authentication, and server functions | For the retention periods in Section 3 or until the processing agreement ends |
| OpenAI, L.L.C. (privacy contact) | United States | AI request text, images, audio files, generated results | AI responses, recognition, transcription, translation, and image generation | Deleted after retention for abuse monitoring for up to 30 days following response generation, according to OpenAI API policies |
| Cloudflare, Inc. (privacy contact) | United States and other countries where Cloudflare operates its network | App user identifier, store transaction information, request records such as IP addresses | Purchase verification server and website operation | Deleted after request processing according to log-retention settings |
If you do not want international transfers, you can use only local storage without signing in, or refrain from using AI, audio transcription, and synchronization. Those features will then be unavailable.
6. External services you use directly
The following providers process information under their own policies when you use the relevant features.
- Google and Apple sign-in: You authenticate directly with the provider. The Operator receives your email, name, and identifier.
- Google Play and App Store payments: Each store handles payments, subscription cancellation, and store refunds.
- Open-Meteo: Weather questions send the city name mentioned in your question and its coordinates. GPS location is not used. Open-Meteo may log IP addresses and request URLs to manage usage. (Open-Meteo terms)
- Korean Ministry of the Interior and Safety resident population statistics: Population questions retrieve public statistics without sending your personal information.
- Google ML Kit: May collect device, performance, and diagnostic information. (ML Kit data disclosure)
- Sharing and export: Files are sent to the app or storage location you select. You and that service manage the resulting copies.
The app does not include advertising, behavioral analytics, or external crash-reporting SDKs.
7. Your rights and how to exercise them
You may request access to, correction or deletion of, or a restriction on the processing of your personal information, and withdraw consent at any time. Send a request to the contact email above. After verifying your identity, the Operator will take action and notify you of the result within 10 days. Deletion may be restricted for information that must be retained by law; the reason will be explained.
You can delete your account and server data directly in Settings → Data export / Delete account, or by email following the account deletion instructions. Uninstalling the app or signing out does not delete your server account or cancel store subscriptions.
8. Security measures
- Communication with servers is encrypted using HTTPS.
- The database uses row-level access controls so signed-in users can access and modify only their own data.
- Secrets such as server administration keys and store authentication keys are kept only in the server environment and are not included in the app.
- Only the Operator accesses the Operator's account, and access to infrastructure consoles is kept to a minimum.
9. Children's privacy
The Service is not intended for children under 14. Children under 14 may not register or sign in. If the Operator learns that personal information from a child under 14 has been collected, it will be deleted without delay.
10. Privacy complaints and remedies
For privacy complaints or advice in Korea, you may contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
11. Changes to this policy
Changes to this policy will be announced on this page and in the app at least seven days before taking effect. Significant changes affecting users' rights will be announced at least 30 days in advance.
- Effective date: September 15, 2026