Privacy Policy.

Simple Note (“the app”) is made by ALAZ Software (“ALAZ”, “we”, “us”), a software studio. ALAZ is the controller of the personal data processed through the app. You can reach us at hello@alaz.pro; our office addresses are listed on alaz.pro.

This policy explains what the app collects, why, who receives it, how long it is kept and what you can do about it. It covers the iOS, Android, macOS and web app. Our website has its own privacy policy.

Your notes are yours. We store them so they sync and stay safe; we don't read them, sell them, or use them for ads, profiling or analytics.

Your notes. Notes and checklists with their titles, text, formatting, items, colors, paper and folders, reminders and calendar dates, archive and trash state, and the last five versions of each note. They are stored in our cloud database so they sync between your devices — also before you sign in: the app starts with an anonymous account (a random ID, no personal details), and your notes are saved under it.

Your account. If you sign in: your email address, display name and sign-in method (email and password, Google or Apple). Passwords are handled by Firebase Authentication; we never see them.

Settings. Your app settings sync with your account. If you use the note lock, its 6-digit PIN is stored only as a salted, one-way hash (PBKDF2), never in plain text. Face ID, Touch ID or fingerprint unlock is handled by your device; we never receive biometric data.

Devices. For each signed-in device: platform, device model, operating system and app version, time zone, last activity and a push notification token. They appear in your device list so you can sign a device out remotely, and they are used to deliver reminders.

Reminders. So a reminder can reach you even when the app is closed, we keep a schedule entry with its time, repeat rule and text (the note's title and first line, or the checklist item). Locked notes never put their text in reminders.

Shared notes. When you share a note, the people you invite see it and can edit it according to their role. We store who is a member, their display name and role, the note's sharing and edit history, and invitation links (valid for 7 days). If you invite someone by email, we send them an invitation email with your name and the note's title.

Search. To search across devices, our server keeps an index of the words in your notes (for a locked note, only its title).

Purchases. Whether you have Pro, which plan and its renewal status, through RevenueCat, linked to your account ID. Payment details stay with Apple or Google.

Usage and diagnostics. A short, fixed list of usage events (for example “note created”, “reminder set”, “export”, “paywall shown”) with counts and simple values, sent to Firebase Analytics; crash and error reports (device model, operating system and app version, error details) sent to Firebase Crashlytics on mobile and macOS. No note content is ever included, and the app doesn't track you across other companies' apps or websites. Firebase App Check verifies that requests come from a genuine copy of the app.

On your device. A local copy of your notes for offline use, home screen widget content (never locked notes), and the files you export. Exports (JSON, Markdown) and note images are created on the device and only leave it if you share them.

• To store, sync and back up your notes, run sharing and deliver reminders.
• To provide Pro: check your plan and unlock its features.
• To keep the service secure: verify requests, prevent abuse, let you sign out lost devices.
• To find and fix crashes and understand, in aggregate, which features are used.
• To answer your messages.

Where the GDPR, the UK GDPR or Türkiye's KVKK applies, we rely on these legal bases:

• Contract — to provide the app, sync, sharing, reminders and Pro, as described in the terms.
• Legitimate interests — security, fraud prevention, stability and aggregate usage statistics that contain no note content. You can object at any time.
• Consent — for notifications, which you can turn off in the app or in your device settings.
• Legal obligation — purchase records required by tax law, and lawful requests.

• We don't sell or rent your personal data.
• We don't use it for advertising and we don't share it with data brokers.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
• We don't read your notes, except when you ask us to look into a specific problem and give us permission.

We use a few service providers to run the app. They process data on our behalf, under contracts that limit them to that purpose:

• Google Firebase / Google Cloud — sign-in (Authentication), database (Cloud Firestore), server functions, push notifications (Cloud Messaging), App Check, Analytics, Crashlytics and hosting of the web app (Google LLC / Google Ireland Ltd.)
• An email delivery service — sends the invitation emails you ask the app to send, through Firebase
• RevenueCat — manages subscriptions and Pro status (RevenueCat, Inc., USA)
• Apple and Google — sign-in with Apple or Google, push notification delivery (Apple Push Notification service, Firebase Cloud Messaging) and payments

Apart from them, we disclose data only when the law requires it (for example a valid court order), to protect our rights or users' safety, or to a successor if ALAZ or the app is sold or merged, in which case this policy keeps applying to your data.

People you share a note with are not our service providers: they see the shared note because you invited them.

Your notes, account and devices are stored in Google Cloud Firestore in the European Union (Belgium, europe-west1), where our server functions also run. Firebase Authentication, Cloud Messaging, Analytics and Crashlytics, and RevenueCat, may process data in the United States and other countries where they operate. This may be outside the country where you live. When data leaves the European Economic Area, the United Kingdom, Switzerland or Türkiye, we rely on the safeguards the law provides, such as the European Commission's adequacy decisions (including the EU–US Data Privacy Framework for certified providers) and standard contractual clauses in our providers' data processing terms.

• Notes: until you delete them. Deleted notes stay in the trash for 30 days, then are erased permanently.
• Versions and history: the last 5 versions of each note and the last 50 sharing events.
• Account, settings and devices: until you delete your account; a device's entry is removed when you sign it out.
• Reminder schedule entries: until the reminder is done, deleted or its note is deleted.
• Invitation links: they expire after 7 days.
• Analytics data: up to 14 months; crash reports: up to 90 days.
• Purchase records: as long as tax and accounting law requires (Apple, Google and RevenueCat keep their own records).
• Emails you send us: up to 24 months after we answer.

Depending on where you live (for example under the GDPR, the UK GDPR, Türkiye's KVKK, Brazil's LGPD or US state privacy laws such as the CCPA), you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it, or delete it;
• export it in a portable format;
• restrict or object to how we use it, and withdraw any consent you gave.

In the app you can edit or delete any note and empty the trash, export all your notes (Settings › Data), leave or stop sharing a note, sign devices out (Settings › Account & devices) and delete your account there (how).

For anything else, email hello@alaz.pro from the address on your account, with “Simple Note” in the subject. We may need to confirm it's you. We answer within 30 days and don't charge for it. You can also complain to your local data protection authority (in Türkiye, the KVKK Authority at kvkk.gov.tr; in the UK, the ICO). California residents: we don't sell or share personal information as those terms are defined by the CCPA, and we won't treat you differently for using your rights.

Data travels over encrypted connections (TLS) and is encrypted at rest by our cloud providers. Access is limited by per-user rules, so one user can't read another's data, and only the people at ALAZ who need it for support or operations can reach it. The note lock hides notes on a device behind your PIN or biometrics; it is a screen lock, not end-to-end encryption. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

The app isn't directed at children under 13, and we don't knowingly collect personal data from them. In some countries the age to consent to data processing on your own is higher (up to 16 in parts of the EU); below it, a parent or guardian has to agree. If you believe a child has given us data, write to hello@alaz.pro and we'll delete it.

When we change how the app handles data, we update this page and the date at the top. If a change is significant, we also tell you in the app before it takes effect.

Questions about this policy or your data: hello@alaz.pro. Help with the app: Simple Note support.