Security & Trust
What happens to your notes after you write them: where they go, who can see them, and how to delete them.
At a glance
- Do you train AI on my notes? Not general-purpose AI models. No.
- Do you sell my data? We do not sell personal data. No.
- Can other users see my notes? Each account reaches only its own data. No.
- Do AI providers reuse my data? They work only on our instructions. No.
- Is my data encrypted? TLS in transit, and at rest where applicable. Yes.
- Can I delete my account and data? Personal data is permanently deleted within 14 days. Yes.
Where do my notes go?
When your pages and recordings sync, they are stored in your XNote account on our cloud servers. That is where handwriting becomes text and recordings become transcripts and summaries.
Your notes stay in your account until you delete them.
Who can see them?
You. Each account can reach only its own data, and that rule is enforced in the app and in the database itself.
Inside XNote, access to production systems is limited to the staff who need it to run the service.
Do you train AI on my notes?
No. XNote does not use customer data to train general-purpose AI models.
AI features run only when you use them. The providers that process them for us, Microsoft Azure OpenAI and AssemblyAI, work only on our instructions and do not reuse your data.
How is my data protected?
Everything sent between your devices and XNote is encrypted with TLS, and stored data is encrypted at rest where applicable.
Sign-in uses tokens, our APIs require authentication and requests are rate-limited. We scan our code for leaked secrets, keep dependencies updated and monitor the service so we can respond to incidents.
What happens when I delete something?
A note you delete is removed from our active systems without undue delay.
If you delete your account, your personal data is permanently deleted within 14 days. We keep something longer only when we must for legal or technical reasons.
- Day 0You ask us to delete your account
- About day 7Backups are typically overwritten
- By day 14Your personal data is permanently deleted
Who else handles my data?
A small number of service providers help us run XNote. Each is bound by contract to protect your data, and we do not sell personal data.
These are the examples in our privacy policy. The full list is available on request.
- Cloud hostingHetzner
- Database and storageSupabase
- AI processingMicrosoft Azure OpenAI, AssemblyAI
- Analytics and monitoringPostHog, Mixpanel, Sentry
- Payments and subscriptionsApple, Google, Shopify, Adapty
What are my rights?
Depending on where you live, you can ask us to access, correct, export or delete your data. Email privacy@xnote.ai.
Our representative in the EU and the UK under the GDPR is Prighter. The privacy policy has the details.
- Access
- Correct
- Export
- Delete
Questions about security or privacy?
Write to us at privacy@xnote.ai.