Strawberry Notes Privacy Policy

Effective date: September 26, 2026

Strawberry Notes is made by Strawberry Notes LLC ("we", "us"). This policy explains what information the Strawberry Notes app, website and related services handle, why, who else receives it, and the choices you have.

The short version

• Your notes are yours and live on your devices. Notes, flashcards, tasks and AI chat history are stored on your device. If you turn on iCloud sync, they are also stored in your own iCloud account. We do not have access to them.
• No ads. No tracking. We do not show ads, we do not track you across other companies' apps or websites, and we do not sell or share your personal information for advertising.
• Handwriting recognition runs on your device. Your handwriting is read on your device, and the search index stays on it.
• An account is optional. You only need one (Sign in with Apple or Google) to use the AI assistant with credits or to publish to the community library.
• The AI assistant asks first. Before anything is sent to an AI provider, the app shows you what will be sent and to whom, and waits for your permission. You can withdraw permission at any time in Settings.
• You can delete your account in the app (Settings > Account > Delete Account).

1. Information that stays on your device (or in your iCloud)

• Notes and library. Your notes, drawings, typed text, imported PDFs, images, scans and videos stay on your device, as do flashcards and study history, tasks and reminders, templates, bookmarks, tags and AI chat history.
• iCloud sync (on by default, can be turned off in Settings > Sync). Your library is stored in a private Strawberry Notes folder in your own iCloud Drive, so it can sync between your Apple devices. Apple handles this under the Apple Privacy Policy. We cannot read your iCloud data.
• Backups and exports. A full-library backup (.sbarchive) or exported note is a file you create and save wherever you choose. We never receive it.
• Handwriting recognition and search.
  • Handwriting is recognized on your device using Google ML Kit, and the search index is stored only on that device.
  • The first time a language is used, the app downloads its recognition model (about 20 MB) from Google.
  • Google's ML Kit may send Google limited technical information to operate and improve the SDK, such as device model, OS and app version, and performance metrics. Your handwriting is not sent.
  • See Google's ML Kit data disclosure and Google Privacy Policy.
• Reminders. Task and flashcard reminders are local notifications scheduled on your device.
• Dictation for the AI assistant.
  • Speech is converted to text by Apple's speech recognition, on your device by default.
  • If on-device recognition is unavailable and you turn on "Allow online dictation", Apple may process your audio on its servers (Apple Privacy Policy).
  • The resulting text is sent to the AI assistant like any typed message (see section 3).

2. Your account (optional)

If you sign in with Apple or Google, we receive:

• your name and email address as shared by Apple or Google (Apple may give us a private relay address)
• an identifier from that provider

We store this on our servers, run on Cloudflare, to operate your account. An account is used for:

• the AI credit balance and its purchase and usage records
• publishing to, and moderating, the community library
• blocking and reporting

We never receive your Apple or Google password.

3. The AI assistant

The AI assistant only sends data after you allow it on the "Before you use the AI assistant" screen. You can withdraw permission in Settings, and the assistant stays off until you allow it again.

What is sent when you use it:

• your question and the earlier messages in that chat
• the selected or visible part of your note by default, or more of it when you ask: its typed text and recognized handwriting
• pictures of your selection or of the part of the note being read
• short snippets from your other notes when the assistant searches your library (the search itself runs on your device)
• when the assistant searches the web, its search terms

Who receives it:

• With AI credits, requests travel through the Strawberry Notes server to OpenRouter. OpenRouter passes them to the company behind the model you choose. The current selectable models use Z.ai, OpenAI or Google; chat titles may use Alibaba Cloud (Qwen). The app names the providers before you allow AI sharing and asks again if that list grows. OpenRouter may also use a partner that hosts a model.
• With your own OpenRouter key, requests go directly from your device to OpenRouter under your OpenRouter account.
• Web search terms are sent to Exa, OpenRouter's search partner.
• These companies handle the data under their own terms and privacy policies, which may include processing in other countries. We do not send them your name, email or account identifier.

What we keep:

• Chat content. We do not store the content of your chats on our server. Your chat history stays on your devices and in your iCloud.
• Usage records. For each request we record the model, the amount of AI usage, its cost and the time, so we can charge credits and prevent abuse.
• Simulations. Simulations are built on our server. We keep the request (such as the topic, a note excerpt and a picture) and the finished page only until it reaches your device, and no longer than 7 days.

AI answers are generated by third-party models and can be wrong. Please don't include sensitive personal information about yourself or others in AI requests.

4. Purchases

• Apple payments. Subscriptions, the Lifetime purchase and AI credits are bought through Apple. We never receive your payment card details.

• What Apple tells us. The app checks your subscription with Apple on your device. For AI credits, Apple provides our server with transaction information, such as product, transaction identifiers, dates and refunds, so we can add credits to your balance and handle refunds.

• Keeping purchases from being reused. We keep records of redeemed and refunded purchases with no name or email attached, even after account deletion. This stops the same purchase being redeemed twice.

• After you delete an account that used the AI assistant. We keep a scrambled key of each Apple or Google sign-in the account used, together with any AI balance it still owed. An unpaid balance can arise, for example, when Apple refunds credits that were already spent. The key is a one-way keyed hash, and it cannot be turned back into your Apple or Google account. If you later sign in again with the same Apple or Google account, we can recognize it: any unpaid balance moves to the new account, and the new account does not get a second starter allowance. Nothing else about the deleted account is kept with it. This prevents abuse of the starter allowance and of refunds.

• Superwall. We use Superwall to show our subscription screens and check subscription status. Superwall receives:

  • device and app information, such as device model, OS version, language, region, app version and an app-specific identifier
  • events about subscription screens and purchases

  We use Superwall only to run and measure our own subscription screens, not for advertising or cross-app tracking.

5. Publishing to the community library

• What becomes visible. When you publish a note, template or flashcard deck, the published content becomes visible to everyone who uses Strawberry Notes, and is served through our public catalog service. That covers the content itself, its title, description and tags, its download count and your author name. Your author name is shown as your first name and the initial of your last name.
• Review. Every submission is screened automatically, using an AI model accessed through OpenRouter, and then reviewed by a person. Messages between you and our reviewers are stored with the submission.
• Reports and blocks. When you report content, we store the report and email an alert with the item, the reason and your words to our moderation inbox, without your identity. When you block an author, we store the block.
• Downloaded copies. People who add your published content to their library keep their copy even if you later withdraw it.
• Withdrawing. You can withdraw published content at any time from My Submissions.

6. Support and feedback

If you send feedback from the app, we receive:

• your message
• your email address, if you choose to give it
• your app version, device model and OS version

We use this to answer and to fix problems. We keep it only as long as needed to handle your request and any related issue, unless the law requires a longer period.

If you use the contact form on our website, we receive the email address, subject and message you submit. The form may use Cloudflare Turnstile to check for automated submissions; Cloudflare processes technical information needed for that security check. We use this information to respond to you and protect the form from abuse.

Our website uses Vercel Web Analytics for aggregate page-view statistics. Vercel does not use analytics cookies or retain identifiers that let us track you across websites. The website may also generate ordinary hosting and security logs. We use these statistics and logs to understand site performance and keep the service working.

7. Web pages and videos inside the app

• Your browser pane. The built-in browser and the YouTube pane load pages directly from those websites. The sites and YouTube (Google) receive your request, including your IP address, under their own policies.
• Clipped pages. Pages you clip become images in your notes, stored with your notes.

8. Server logs and security

• What the servers log. Our servers run on Cloudflare. When your device talks to them, they process technical information such as IP address, request time and error details. We use it to operate, secure and debug the service.
• How long logs are kept. Logs are kept for a short period and then deleted automatically.
• Protection. We protect data in transit with TLS and limit access to people who need it.
• No guarantee. No method of storage or transmission is completely secure.

9. Why we use your information (legal bases)

Where laws such as the GDPR apply, we rely on:

• Contract: to provide the app, your account, purchases, AI credits and publishing.
• Consent: to send data to AI providers, and for online dictation. You can withdraw consent at any time; this does not affect processing that already happened.
• Legitimate interests: to keep the service secure, prevent fraud and abuse (including purchase-reuse records and the scrambled sign-in keys kept after account deletion), moderate public content, respond to support requests, measure aggregate website use and fix problems.
• Legal obligation: to keep records the law requires and respond to lawful requests.

We do not use automated decision-making that has legal or similarly significant effects on you. Automated content screening only flags submissions for a human reviewer.

Creating an account, buying credits, publishing or contacting support is optional. If you do not provide the information needed for one of these features, we cannot provide that feature or respond to that request.

10. Who we share information with

We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only:

• with the service providers named in this policy, to run the features you use:
  • Cloudflare (hosting and website form security checks)
  • Vercel (website analytics)
  • OpenRouter, the AI model providers and Exa (AI features you allow)
  • Superwall (subscription screens)
  • Apple (payments, iCloud, sign-in, dictation)
  • Google (sign-in, handwriting models)
• when the law requires it, or to protect the rights, safety and security of our users, the public or us
• as part of a merger, acquisition or sale of assets, with notice to you

11. International transfers

We and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask for information about these safeguards, or a copy where available, at [email protected].

12. How long we keep information

Deleting your account deletes:

• your account and sign-in links
• your AI balance and usage records
• your AI simulation jobs
• everything you published
• the reports and blocks you made

If the account used the AI assistant, we keep only a scrambled key of its sign-in, with any balance it still owed (see section 4). For Sign in with Apple, deletion also revokes the app's access to your Apple ID. Your notes on your devices and in your iCloud are not affected. Content that others already downloaded stays with them, and requests already sent to AI providers are governed by their policies.

13. Your rights and choices

• In the app:
  • Delete your account (Settings > Account > Delete Account).
  • Withdraw AI data sharing (Settings > AI Assistant).
  • Turn iCloud sync on or off.
  • Export your whole library to one file.
  • Withdraw published content.
• Depending on where you live (for example the EU, UK, or US states such as California), you may have the right to:
  • access, correct, delete or receive a copy of your personal information
  • object to or restrict certain processing
  • withdraw consent
• How to ask. Email [email protected]. We may need to verify your request, and we will not discriminate against you for exercising your rights.
• Complaints. If you are in the EU, you may complain to your local data protection authority. If you are in the UK, you may complain to the Information Commissioner's Office.
• California residents. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes that require an opt-out.

14. Children

Strawberry Notes is not directed to children under 13. We do not knowingly collect personal information from children under 13, or under the minimum age of digital consent in their country if that is higher. If you believe a child has given us personal information, contact [email protected] and we will delete it.

15. Changes to this policy

We will update this policy when our practices change and change the effective date above. If a change is significant, we will tell you in the app before it takes effect. If a change affects what the AI assistant sends, the app will ask for your permission again.

16. Contact

Strawberry Notes LLC
Email: [email protected]