NotesGalore — Privacy policy

Your content

Notes, notebooks, the events you create in NotesGalore, attachments, revision history and settings stay in a local database. NotesGalore does not run a server that receives your note content. The vault is excluded from Android cloud backup, and on Apple devices it is marked as excluded from iCloud and device backup. Versions before 1.0.0 (515), including the public Google Play release, also exclude the vault from Android device transfer. From version 1.0.0 (515), in testing, Android can copy the vault to your new phone during device setup, as described under Moving to a new Android phone. Manual export remains the supported recovery path.

Moving to a new Android phone

From version 1.0.0 (515), in testing, when you set up a new phone from your old one on Android 12 or later, Android can copy your NotesGalore vault directly to the new phone. It is a one-time copy between your devices, made by Android during setup. It is not a backup, it is not kept anywhere else, and Timastra receives nothing; the vault stays excluded from cloud backup. What is copied: your notes, notebooks, templates, events, attachments and version history, and the app's settings. The settings include the stored Pro status, the mark that a purchase was started on the old phone, and the anonymous installation identifier that releases configured for Firebase reporting attach to analytics events, so the new phone carries the same one. What is not copied: the copies the home-screen widgets keep, text saved from outside the app and not yet filed, scheduled-reminder state, the anonymous RevenueCat app-user ID (a new phone gets its own) and any other purchase or reporting library data, and this installation's identity in a shared folder. The copied Pro status is checked with the app store and RevenueCat the first time the new phone can reach them, and is kept only if the store confirms the purchase for that phone; use Restore purchases if it is not. On Android 11 or earlier nothing is copied, and whether a transfer happens at all also depends on the phones and the setup tool their makers provide. The phone you transferred from keeps its copy until you wipe it there.

Calendars on this phone

From version 1.0.0 (515), in testing, the Android app can show the calendars already on your phone beside your own events and tasks, on Today and in Calendar. This is off until you turn it on. NotesGalore asks for Android's calendar permission only when you tap Show the calendars on this phone, tap Try again after refusing, or turn the setting on in Settings > Privacy; everything else works if you refuse. It only reads: NotesGalore does not add, change or delete calendar events and does not hold the permission that would let it. Those events are kept in memory only, while the app is open. They are not copied into your notes, the home-screen widgets, reminders, backups, exports or the shared folder, and are not sent to Timastra or anyone else. What is stored is the setting itself and the list of calendars you unticked, each by the number your phone gives it; no calendar name, account or event is stored. The events of a calendar hidden in your phone's own calendar app are not read, though that calendar is still named in the list in Settings. The name of the account a calendar belongs to is not read; the app looks only at whether the calendar is kept on the phone itself, to label it. Tapping one of these events opens it in your phone's calendar app, which is passed the event's number and its start and end time. Turning the setting off stops the reading; to withdraw the permission itself, use Android settings for the app. In a phone-to-phone transfer the setting and the unticked list move with your other settings, so look at the list again on the new phone; calendar events do not move, because the app holds none, and Android decides whether the permission carries over. Earlier versions, including the public Google Play release, do not request the calendar permission.

App lock

From version 1.0.0 (532), in testing, the Android app has a Lock NotesGalore setting in Settings > Privacy. The lock is off until you turn it on. When it is on, the app asks your phone to confirm you, with your fingerprint, your face or the phone's PIN, pattern or password, before it shows a note. The phone confirms you, not the app: NotesGalore shows Android's own prompt and receives only a yes or a no. It never receives, stores or sends a fingerprint, a face, a PIN, a pattern or a password, and it has no passcode of its own. To show that prompt the app declares Android's USE_BIOMETRIC permission, which Android grants without asking. The lock hides the app; it does not encrypt your notes. The notes on your device, a backup file and the notes folder are exactly as readable as without the lock to anyone who can reach the storage itself. While the lock is on, the app's window is kept out of the recent-apps picture and out of screenshots, and home-screen widgets and reminder notifications show no note, task or event text unless you turn on Show widget and reminder details while locked. In version 1.0.0 (532), a recent-apps picture taken before you turned the lock on is not replaced. From version 1.0.0 (543), in testing, entries that earlier runs of the app left in recent apps are removed when you turn the lock on and each time the app starts with it on. If the phone's screen lock is removed, NotesGalore turns its own lock off the next time it is opened and tells you once, so you are not kept out of your notes. Earlier versions, including the public Google Play release, have no app lock and do not declare that permission.

Text saved from outside the app on Android

Text you share to NotesGalore from another Android app is first kept in the app's own storage on the phone until NotesGalore files it into your notes. From version 1.0.0 (441), in testing, the same applies to text you save from the Quick note sheet (opened from the Quick Settings tile or a launcher shortcut) and from another app's text-selection menu with Save to NotesGalore; it is put into your notes the next time NotesGalore is running. In those versions, text you typed into the Quick note sheet and did not save is kept there as a draft, and Settings > Wipe all data discards the draft and any text not yet filed. None of this text is sent anywhere, and it is excluded from Android cloud backup and device transfer in every version.

Android home-screen widgets

Your phone's launcher draws a widget while the app is closed, so if you add a NotesGalore home-screen widget that shows a note, the app keeps a copy of what the widget shows in its own storage on the phone, outside your notes database. For the widget that shows a note you choose, that is the titles of up to 100 notes for its chooser and, for the note it shows, the title, a short preview and its checklist. From version 1.0.0 (515), in testing, that widget is named Checklist and also keeps up to 40 of the note's lines; a Today widget keeps seven days of the titles and start times of the events you made in NotesGalore and the text of your open tasks; and a Quick note widget opens the Quick note sheet and keeps nothing. These copies are excluded from Android cloud backup and device transfer in every version, and are removed when you remove the last widget of that kind or use Settings > Wipe all data.

App analytics and crash reporting

The Android build configured with disabled app telemetry sends no app usage analytics or crash reports through Firebase. Settings > Privacy shows when that reporting is disabled for your build; its analytics switch cannot enable an absent Firebase reporting service. Only releases explicitly configured for Firebase reporting may send scrubbed crash diagnostics and limited product events without note content, titles, tags or written text. In those releases, analytics honors the saved opt-out preference; crash reporting runs separately. This setting does not control the Google ML Kit processing described below.

Android text recognition

The Android app uses Google's bundled ML Kit library to find Latin-script text in supported image attachments. Recognition happens on your device, and the recognized text is saved locally with the attachment; NotesGalore does not upload the images or recognized text. Indexing runs when you attach an image and when you use Settings > Data > Index attachment text. Google documents that ML Kit may contact its servers and sends device and app information, performance and usage metrics, and a per-installation identifier not intended to uniquely identify a person or physical device. See Google's provider references below. The app has no switch to turn this recognition off or control the library's metrics; Settings > Privacy's analytics preference does not affect ML Kit. Index attachment text reruns indexing and is not an opt-out control.

Advertising and purchases

There are no ads or sale of data to advertisers. Apple or Google processes payments; NotesGalore does not receive card details. New Pro offers use monthly or yearly subscriptions when available for the installed build and account, with no trial by default. Existing Lifetime purchases remain restorable without a renewal charge.

Purchase validation

Store builds that sell Pro use RevenueCat to check whether an install owns Pro. RevenueCat receives a random anonymous app-user ID, the store's NotesGalore purchase records (product, purchase token, order ID, dates, price, currency and store country), technical details (platform, OS, app and SDK version, locale) and the IP address. It never receives notes, names, email addresses, card details or an advertising ID. The app contacts RevenueCat only when you open the upgrade screen, restore or buy Pro, or when the install has Pro or a purchase in progress, so refunds and delayed payments apply. This is required for purchases, is not analytics and cannot be switched off in those builds.

Protecting a backup with a passphrase

From version 1.0.0 (515), in testing, you can choose a passphrase when you export a backup. That backup file is then encrypted, and restoring it asks for the passphrase. The passphrase is used on your device only: NotesGalore does not store it and Timastra never receives it, so a forgotten passphrase cannot be recovered, by you, by Timastra or by anyone else. It protects that one file only. It does not encrypt the notes kept on your device, a Markdown export or the desktop shared folder, and a backup exported without a passphrase is not encrypted. Earlier versions, including the public Google Play release, have no passphrase option; their backups are not encrypted.

Automatic backups

From version 1.0.0 (532), in testing, you can ask NotesGalore to write a backup by itself when you open it: daily, weekly or monthly, into a folder you choose with your device's own folder picker. Automatic backups are off until you turn them on. Nothing runs while the app is closed; a backup is written only when you open the app, or bring it back to the screen, and the last one is old enough. Automatic backups are not encrypted. NotesGalore never stores a passphrase, so a backup it writes by itself has none, and anyone who can open the folder can read these files. They go only into the folder you chose: NotesGalore sends them nowhere and Timastra never receives them. If that folder is synced or uploaded by another app or service, the copies leave your device through that app, under its terms, not through NotesGalore. NotesGalore keeps the newest 3, 5 or 10 of the backups it wrote there and deletes its older ones; it deletes no other file in the folder. On Android the app keeps the permission to that one folder until you choose another, clear the app's data or uninstall it, and it asks for no general storage permission. Earlier versions, including the public Google Play release, write a backup only when you export one.

Optional encrypted Google Drive sync

Google Drive sync is off until you explicitly connect it in a configured build. It uses your own Google account and storage; it is not managed storage supplied by Timastra and does not require Pro. Google handles account sign-in and consent. The requested Drive permission is limited to this application's hidden appDataFolder, rather than general access to your Drive files. When connected, the app encrypts synced notes, notebooks, templates, events and attachments on your device before sending them over HTTPS to Google's Drive API. Google processes the account authorization, network address, request timing and encrypted object sizes under its own terms. Timastra does not operate the Drive storage or receive the recovery key or plaintext note content through this connection. Document indexes and other synced metadata travel with the encrypted records. Save the separate sync recovery key before connecting another device. The app keeps the connection and key in this device's protected credential storage; they are not included in portable note backups or Android device transfer. Native protection depends on the operating system. Browser credential protection depends on the browser and origin: someone who compromises that origin or an unlocked session can use its saved connection. Neither Timastra nor purchase restoration can recover a lost sync recovery key. While the connection is enabled, the app can synchronize changes and refresh an existing Google authorization without another consent prompt. Disconnecting stops this device's connection and attempts to remove its saved credentials; it keeps local notes and does not revoke the Google account grant or delete encrypted files already stored in Drive. You can separately revoke access and manage the application's stored data through your Google account controls. Drive sync keeps an append-only encrypted journal, including older records and attachment blobs. A note deletion is synchronized as a deletion marker; it does not erase every historical encrypted version. Offline devices retain their copies until they reconnect. For a full purge, manage the application's Drive data and copies on all devices separately, as well as any backups or exports.

Optional email capture

Email capture is an optional Pro tool in Settings → Sync & sharing. Normal notes and Google Drive sync do not require a mailbox connection. NotesGalore does not provide a mail server or an email address to forward to. When you explicitly tap Fetch preview, the app sends your mailbox username, app password, selected folder and message requests to the IMAP server you choose over TLS. Your email provider receives your network address and applies its own data policies. The app reads only the chosen folder and does not move, delete or mark messages as read. It does not poll in the background. Providers must support IMAP and the configured sign-in method; OAuth mailbox sign-in is not included. After a successful fetch, the connection is kept in this device's operating-system credential store. It is excluded from the app's workspace sync, backups and diagnostic exports. Forget mailbox sign-in or Delete all app data removes this saved connection, without changing messages in your mailbox. If credential removal fails, the app stops the data wipe so you can retry. You preview and select messages before import. Imported text and an original .eml file become notes on your device and follow your existing sync, export, backup and deletion choices. You can also select a local .eml file without connecting a mailbox. Email text and supported itinerary fields are parsed locally; remote images and links in the message are not loaded. Flight cards reflect details in the message and do not query an airline or verify live status.

Local document search and PDF annotations

Embedded PDF text and Pro extraction of supported DOCX, XLSX and PPTX text run on your device. Pro can also use Android on-device Latin-script OCR on supported scanned PDF pages, with the same ML Kit processing disclosures above. Indexing does not upload document contents, execute macros or formulas, or fetch external document resources. File, format, page and processing limits apply. Saved extracted text is attachment metadata and follows your selected encrypted Drive or desktop shared-folder sync and backup settings. Native PDF markup creates a separate annotated copy; original bytes remain available. Browser builds can view or save the original but do not create these annotations. No hosted AI is used.

Recorded media and interrupted capture

Audio and video remain local note attachments unless you explicitly export, share or sync them. Before recording, the app discloses plan and file limits; camera, storage or device limits can stop a requested recording earlier. Android may retain an unfinished camera result in the app-owned recovery folder for an explicit retry, save/share or discard. The recovery marker is tied to its original note and device, is excluded from backups and sync, and protected notes require unlocking again. Wipe all data attempts to remove this owned recovery file and stops for retry if removal fails.

Subscriptions and existing Lifetime access

New Pro offers use monthly or yearly subscriptions only when available for your installed build and account. The store supplies the localized checkout price and renewal terms; RevenueCat validates expiry, confirmed grace, restoration and revocation. Existing Lifetime purchases stay restorable and are not converted to subscriptions. No trial is offered by default. Expiry restricts premium creation and editing without deleting authored notes, files or saved indexes. Removing the app, wiping local data or requesting data deletion does not cancel store renewal. Manage cancellation and refund requests separately through the store. Google Drive uses your own storage and stays available without Pro.

Exports and desktop shared-folder sync

Exports and backups contain the content you select. Optional shared-folder sync is available on desktop platforms only and writes notes and attachment contents to a folder you choose. Those files are not encrypted by NotesGalore; people and storage providers with folder access can read them. Disabling sync leaves existing files in that folder. The provider may keep trash and file history.

Provider privacy references

• Google ML Kit privacy and on-device processing
• Google ML Kit Android data disclosure