Privacy Policy

1. Scope

This Policy applies to the App, Website, and support communications. It does not govern services operated by Apple, Google, device manufacturers, cloud-storage providers, email providers, linked websites, or other third parties. Those services have their own privacy practices.

2. How Note Hero works

Note Hero lets you create and organize notes, ideas, lists, reminders, birthdays, important dates, borrowed or lent items, saved places, “Where I Put It” records, custom record types, photos, files, and other information. Current versions do not require an account and do not provide an Otipu-operated cloud-sync service.

App content is stored locally in the App’s private storage on your device. We do not receive, view, host, or control that locally stored content. Ordinary non-Vault records are protected by your device and app sandbox but are not encrypted by Note Hero at the application level.

3. Information we do not collect through the App

Current versions of the App do not send us your notes, records, Vault contents, attachments, contacts, precise location, reminder contents, search history, device advertising identifier, or in-app activity. We do not use advertising SDKs, cross-app tracking, behavioral advertising, or sell personal information.

If a future version introduces optional accounts, cloud services, analytics, advertising, crash reporting, or other remote data processing, we will update this Policy and provide any notice or consent required before that processing begins.

4. Device permissions and local processing

The App may request device permissions only when needed for a feature you choose:

• Photos, camera, and files: to select, capture, attach, export, or save content.
• Location: to obtain your current location when you choose to save a place or location record.
• Notifications: to schedule and deliver local reminders.
• Face ID, Touch ID, biometrics, passcode, or device authentication: to control access to Secure Vault.
• External links and communication: to open a website, email address, phone number, or another installed app when you choose that action.

Permission results and related App content remain on your device unless you deliberately share or export them. You can deny or revoke permissions in device settings. Some related features may then stop working.

5. Secure Vault

Secure Vault is intended for sensitive records. Vault fields are encrypted on your device using authenticated encryption. Vault access relies on supported device authentication. Encryption reduces risk but does not guarantee absolute security.

Vault protection cannot prevent access caused by a compromised, rooted, or jailbroken device; malicious operating-system software; runtime instrumentation; screen photography; observation while Vault is unlocked; disclosure by you; weak device security; or other circumstances outside our control. We do not possess your Vault key and cannot unlock, recover, or restore inaccessible Vault content.

6. Backups, exports, sharing, and deletion

You may create a password-protected encrypted backup. Backup encryption uses a password you choose. We do not receive that file or password, cannot reset the password, and cannot recover an unreadable, damaged, lost, deleted, or incompatible backup. Keep independent copies and test them before relying on them.

Human-readable exports intentionally exclude Secure Vault records. When you export, share, copy, print, open, or save information, the destination app or service receives the content you selected and handles it under its own terms. This can include iCloud Drive, Google Drive, Files, email, messaging, printing, or other share-sheet destinations.

You control local retention. You may delete records in the App. Some deleted items may remain temporarily in an in-app trash or in device backups you control. Permanently deleting records or deleting the App may make data unrecoverable. Operating-system or third-party backups may retain copies until you delete them through that provider.

7. Website technical data

When you use the Website, our hosting, network, security, and domain providers may automatically process standard request data needed to deliver and protect it. This may include IP address, approximate region derived from IP, date and time, requested URL, referring page, browser and device type, operating system, response status, and security events.

We use such data for site delivery, security, abuse prevention, troubleshooting, reliability, and legal compliance—not cross-site advertising. Provider logs may be stored in countries where those providers operate and retained under their operational and security policies.

8. Support and other communications

If you contact notehero@otipu.com, we receive information you choose to provide, including your email address, name, message, attachments, and technical details. We use it to respond, investigate problems, prevent abuse, improve support, enforce our terms, protect legal rights, and comply with law.

Do not send passwords, Vault keys, complete payment-card data, government identification numbers, medical records, or other highly sensitive content. If you send such information voluntarily, we will handle it only as reasonably needed for your request and applicable obligations.

9. Legal bases

Where laws such as the UK GDPR or EU GDPR apply, we process Website and support data as necessary for our legitimate interests in operating, securing, supporting, and improving our services; to perform a contract or take requested pre-contract steps; with consent where required; and to meet legal obligations or protect vital or legal interests. You may object to legitimate-interest processing, but our rights or obligations may sometimes permit continued processing.

10. Disclosure of information

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose limited Website or support information to service providers acting for us, such as website hosting, network security, domain, and email providers; to professional advisers; during a merger, financing, acquisition, reorganization, or sale of assets; or when reasonably necessary to comply with law, legal process, enforceable government requests, protect rights or safety, investigate fraud or abuse, or defend legal claims.

Service providers are permitted to process information only for contracted purposes and under applicable safeguards. We cannot control information you independently send to third-party apps or services.

11. Retention

We do not retain App content that never leaves your device. Support communications are retained only as long as reasonably necessary to answer requests, maintain business and security records, resolve disputes, enforce agreements, and comply with law. Website and security logs are retained by relevant providers for limited operational periods. We may keep minimal records of deletion or opt-out requests when required to demonstrate compliance.

12. Security

We use reasonable technical and organizational measures appropriate to information we control. No device, encryption method, software, network, storage system, or transmission is completely secure. To the extent permitted by law, we cannot guarantee that information will never be lost, corrupted, accessed, disclosed, altered, or destroyed. You are responsible for device updates, strong device credentials, backup-password protection, safe sharing choices, and physical control of your device.

13. Your privacy choices and rights

You can control App permissions in device settings, delete local records in the App, delete exported files from their destination, and delete the App. Because we do not possess your local App content, we cannot access, correct, export, or delete it for you.

Depending on your location, you may have rights regarding personal information we do control, including access, correction, deletion, portability, restriction, objection, withdrawal of consent, and appeal. You may also complain to a data-protection authority. California residents may request information about collection, disclosure, correction, or deletion and may not be discriminated against for exercising applicable rights. We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act.

Send requests to notehero@otipu.com. State your location and request. We may verify your identity and authority, deny or limit requests where law permits, and retain information required for security, legal compliance, or claims.

14. Children

Note Hero is a general-audience productivity app and is not directed to children under 13 or the higher minimum age required in their jurisdiction. We do not knowingly collect personal information from children through an Otipu account or cloud service. If you believe a child sent us personal information through support or the Website, contact us so we can review and delete it where required.

15. International processing

Website and support providers may process information in countries different from yours. Those countries may have different privacy laws. Where required, we rely on lawful transfer mechanisms and provider safeguards. By using global internet and email services, information may transit multiple jurisdictions.

16. Changes to this Policy

We may update this Policy when features, providers, practices, or laws change. Updated text will appear on this page with a new effective date. We will provide additional notice or request consent when law requires it. Your continued use after the effective date is subject to the updated Policy.

17. Contact

Privacy questions and requests: notehero@otipu.com.

Note Hero is published by Otipu. Also read our Terms of Use.