Strawberry Notes Privacy Policy

Effective date: October 15, 2026

Strawberry Notes is made by Strawberry Notes LLC ("we", "us"). This policy explains what information the Strawberry Notes app, website and related services handle, why, who else receives it, and the choices you have.

The short version

• Your notes are yours and live on your devices. Notes, documents, flashcards, tasks, calendar events and AI chat history are stored on your device. If you turn on iCloud sync, they are also stored in your own iCloud account. We do not have access to them.
• No ads. No tracking. We do not show ads, we do not track you across other companies' apps or websites, and we do not sell or share your personal information for advertising.
• Handwriting recognition runs on your device. Your handwriting is read on your device, and the search index stays on it.
• An account is optional. You only need one (Sign in with Apple or Google) to use the AI assistant with credits or to publish to the community library.
• The AI assistant asks first. Before anything is sent to an AI provider, the app shows you what will be sent and to whom, and waits for your permission. You can withdraw permission at any time in Settings.
• Your calendar stays with you. Calendar events are never sent to our servers or to AI providers.
• You can delete your account in the app (Settings > Account > Delete Account).

1. Information that stays on your device (or in your iCloud)

• Notes and library. Your notes, drawings, typed text and documents, imported PDFs, images, scans and videos stay on your device, as do flashcards and study history (including decks you import from Anki, which are read on your device), tasks and reminders, calendar events, templates, bookmarks, tags and AI chat history.
• iCloud sync (on by default, can be turned off in Settings > Sync). Your library, including your AI chat history and calendar events, is stored in a private Strawberry Notes folder in your own iCloud Drive, so it can sync between your Apple devices. The app also keeps a few small settings in your iCloud key-value storage, such as an identifier for your synced library. Apple handles this under the Apple Privacy Policy. We cannot read your iCloud data.
• Backups and exports. A full-library backup (.sbarchive) or exported note is a file you create and save wherever you choose. We never receive it. If the app asks for Face ID or your passcode before exporting a backup, that check is done by your device; we never receive biometric data.
• Handwriting recognition and search.
  • Handwriting is recognized on your device using Google ML Kit, and the search index is stored only on that device.
  • The first time a language is used, the app downloads its recognition model (about 20 MB) from Google.
  • Google's ML Kit may send Google limited technical information to operate and improve the SDK, such as device model, OS and app version, and performance metrics. Your handwriting is not sent.
  • See Google's ML Kit data disclosure and Google Privacy Policy.
• Reminders. Task, flashcard and calendar reminders are local notifications scheduled on your device. We do not send push notifications.
• Calendar.
  • Events you create in Strawberry Notes (title, notes, location, time, repeat rules and alerts) and the dates you give tasks are stored on your device and, with iCloud sync, in your iCloud. Each event also records a random identifier for the device that created it, so your devices can keep their copies in step.
  • Calendar events are never sent to our servers or to AI providers.
• Apple Calendar sync (off unless you turn it on).
  • When you turn it on, the app asks for access to your calendars. You can turn the sync off in the app and remove access at any time in iOS Settings.
  • The app reads the events in your other calendars to show them beside your Strawberry Notes events. It reads them on your device when it shows them; it does not copy them into your library or send them anywhere.
  • It creates a calendar named "Strawberry Notes" and keeps a copy of your Strawberry Notes events in it (title, notes, location, time, repeat rules and alerts). Each copy carries a link back to Strawberry Notes, so the app can recognize it. The app changes and deletes only the copies it made.
  • Whether the sync is on is kept in your iCloud key-value storage, so your other devices follow the same choice.
  • Your calendars are kept by Apple, or by the calendar account you chose for them, under its own privacy policy.
• Dictation for the AI assistant.
  • Speech is converted to text by Apple's speech recognition, on your device by default.
  • If on-device recognition is unavailable and you turn on "Allow online dictation", Apple may process your audio on its servers (Apple Privacy Policy).
  • The resulting text is sent to the AI assistant like any typed message (see section 3).

2. Your account (optional)

If you sign in with Apple or Google, we receive:

• your name and email address as shared by Apple or Google (Apple may give us a private relay address)
• an identifier from that provider

We store this on our servers, run on Cloudflare, to operate your account. An account is used for:

• the AI credit balance and its purchase and usage records
• publishing to, and moderating, the community library
• blocking and reporting

We never receive your Apple or Google password.

3. The AI assistant

The AI assistant only sends data after you allow it on the "Before you use the AI assistant" screen. Your permission is kept on the device where you gave it, so each of your devices asks once. You can withdraw it in Settings > AI Assistant & Dictation, and the assistant stays off until you allow it again.

What is sent when you use it:

• your question and the earlier messages in that chat
• the part of your note your request is about: its typed text, recognized handwriting and pictures of it. A lasso selection tells the assistant what to focus on, and it reads more of the note only when it needs the context. If you say "only this page", only that part is sent. A general request, such as "make a game", can send the whole note, including pictures of its pages and drawings
• the text of a document you ask the assistant to summarize, continue or rewrite
• for a simulation or game: your request, the part of your note it is about (up to the whole note) and pictures of it
• short snippets from your other notes when the assistant searches your library (the search itself runs on your device)
• when the assistant searches the web, its search terms

Who receives it:

• With AI credits, requests travel through the Strawberry Notes server to OpenRouter. OpenRouter passes them to the company behind the model you choose. The current selectable models use Z.ai, OpenAI, Google or Anthropic; chat titles use Alibaba Cloud (Qwen). OpenRouter may also use a partner that hosts a model.
• One permission, every model. The permission screen names example providers and links to this list. Your permission covers every model the app offers, including models added later, so this list may change as models are added. Each request goes only to the provider of the model you choose (and, for chat titles, Alibaba Cloud).
• No keeping or training, as far as we can ask for it. With every request we tell OpenRouter to use only providers that do not store requests or train on them (OpenRouter's "data collection: deny" setting).
• With your own OpenRouter key, requests go directly from your device to OpenRouter under your OpenRouter account, to the same companies. Your key is stored in your device's keychain, on that device only, and is never sent to our server.
• Web search terms are sent to Exa, OpenRouter's search partner.
• These companies handle the data under their own terms and privacy policies, which may include processing in other countries. We do not send them your name, email or account identifier.

What we keep:

• Chat content. We do not store the content of your chats on our server. Your chat history stays on your devices and in your iCloud.
• Usage records. For each request we record the model, the amount of AI usage, its cost and the time, so we can charge credits and prevent abuse.
• Simulations and games. When you use AI credits, simulations and games are built on our server.
  • The note excerpt and pictures sent to build one are deleted from our server as soon as building ends, whether it succeeded or failed. If anything goes wrong, a game's pictures are deleted automatically at most 3 days later.
  • The finished page is deleted from our server once it reaches your device, or after 7 days if it never does.
  • We keep a record of each one with your account: the model, its status and its cost, which we use to charge credits and to show the job in the app. Until the result reaches your device (or for at most 7 days if it never does), the record also holds a short description of what was asked for, the title and outline of the result, and the reason if building failed; then those are removed. The record is deleted when you delete your account.
  • With your own OpenRouter key, simulations and games are built on your device and nothing passes through our server.

AI answers are generated by third-party models and can be wrong. Please don't include sensitive personal information about yourself or others in AI requests.

4. Purchases

• Apple payments. Subscriptions, the Lifetime purchase and AI credits are bought through Apple. We never receive your payment card details.

• What Apple tells us. The app checks your subscription with Apple on your device. For AI credits, Apple provides our server with transaction information, such as product, transaction identifiers, dates and refunds, so we can add credits to your balance and handle refunds.

• Keeping purchases from being reused. We keep records of redeemed and refunded purchases with no name or email attached, even after account deletion. This stops the same purchase being redeemed twice.

• After you delete an account that used the AI assistant. We keep a scrambled key of each Apple or Google sign-in the account used, together with any AI balance it still owed. An unpaid balance can arise, for example, when Apple refunds credits that were already spent. The key is a one-way keyed hash, and it cannot be turned back into your Apple or Google account. If you later sign in again with the same Apple or Google account, we can recognize it: any unpaid balance moves to the new account, and the new account does not get a second starter allowance. Nothing else about the deleted account is kept with it. This prevents abuse of the starter allowance and of refunds.

• Superwall. We use Superwall to show our subscription screens and check subscription status. Superwall receives:

  • device and app information, such as device model, OS version, language, region, app version and an app-specific identifier
  • events about subscription screens and purchases

  We use Superwall only to run and measure our own subscription screens, not for advertising or cross-app tracking.

5. Publishing to the community library

• What becomes visible. When you publish a note, template or flashcard deck, the published content becomes visible to everyone who uses Strawberry Notes, and is served through our public catalog service. That covers the content itself, its title, description and tags, its download count and your author name. Your author name is shown as your first name and the initial of your last name.
• Review. Every submission is screened automatically, using an AI model accessed through OpenRouter, and then reviewed by a person. The screening sends a picture of the first page and the title, description and tags you wrote, with the same instruction that providers may not store it or train on it. Messages between you and our reviewers are stored with the submission.
• Reports and blocks. When you report content, we store the report and email an alert with the item, the reason and your words to our moderation inbox, without your identity. When you block an author, we store the block.
• Downloaded copies. People who add your published content to their library keep their copy even if you later withdraw it.
• Withdrawing. You can withdraw published content at any time from My Submissions.

6. Support and feedback

If you send feedback from the app, we receive:

• your message
• your email address, if you choose to give it
• your app version, device model and OS version

We use this to answer and to fix problems. We keep it only as long as needed to handle your request and any related issue, unless the law requires a longer period.

If you use the contact form on our website, we receive the email address, subject and message you submit. The form may use Cloudflare Turnstile to check for automated submissions; Cloudflare processes technical information needed for that security check. We use this information to respond to you and protect the form from abuse.

Our website uses Vercel Web Analytics and Cloudflare Web Analytics for aggregate page-view statistics. Neither uses analytics cookies or keeps identifiers that let us track you across websites. The website may also generate ordinary hosting and security logs. We use these statistics and logs to understand site performance and keep the service working.

7. Web pages and videos inside the app

• Your browser pane. The built-in browser and the YouTube pane load pages directly from those websites. The sites and YouTube (Google) receive your request, including your IP address, under their own policies, and YouTube can tell that the video is played inside Strawberry Notes. Searches you type in the browser go to Google or YouTube.
• Cookies in the browser pane. Like Safari, the built-in browser keeps cookies and website data on your device, so websites you sign in to can remember you. We do not read them.
• Clipped pages. Pages you clip become images in your notes, stored with your notes.

8. Server logs and security

• What the servers log. Our servers run on Cloudflare. When your device talks to them, they process technical information such as IP address, request time and error details. We use it to operate, secure and debug the service. Our logs record identifiers, error codes and counts; they never contain the content of your notes or chats.
• How long logs are kept. Logs are kept for a short period and then deleted automatically.
• Protection. We protect data in transit with TLS and limit access to people who need it.
• No guarantee. No method of storage or transmission is completely secure.

9. Why we use your information (legal bases)

Where laws such as the GDPR apply, we rely on:

• Contract: to provide the app, your account, purchases, AI credits and publishing.
• Consent: to send data to AI providers, for online dictation, and for Apple Calendar sync. You can withdraw consent at any time; this does not affect processing that already happened.
• Legitimate interests: to keep the service secure, prevent fraud and abuse (including purchase-reuse records and the scrambled sign-in keys kept after account deletion), moderate public content, respond to support requests, measure aggregate website use and fix problems.
• Legal obligation: to keep records the law requires and respond to lawful requests.

We do not use automated decision-making that has legal or similarly significant effects on you. Automated content screening only flags submissions for a human reviewer.

Creating an account, buying credits, publishing or contacting support is optional. If you do not provide the information needed for one of these features, we cannot provide that feature or respond to that request.

10. Who we share information with

We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only:

• with the service providers named in this policy, to run the features you use:
  • Cloudflare (hosting, website analytics and website form security checks)
  • Vercel (website analytics)
  • OpenRouter, the AI model providers (Z.ai, OpenAI, Google, Anthropic and Alibaba Cloud) and Exa (AI features you allow)
  • Superwall (subscription screens)
  • Apple (payments, iCloud, sign-in, dictation, Apple Calendar if you turn on its sync)
  • Google (sign-in, handwriting models)
• when the law requires it, or to protect the rights, safety and security of our users, the public or us
• as part of a merger, acquisition or sale of assets, with notice to you

11. International transfers

We and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask for information about these safeguards, or a copy where available, at [email protected].

12. How long we keep information

Deleting your account deletes:

• your account and sign-in links
• your AI balance and usage records
• your AI simulation jobs
• everything you published
• the reports and blocks you made

If the account used the AI assistant, we keep only a scrambled key of its sign-in, with any balance it still owed (see section 4). Cost records of individual AI requests (the model and what it cost) may also be kept for accounting, with nothing that links them to you. For Sign in with Apple, deletion also revokes the app's access to your Apple ID. Your notes on your devices and in your iCloud are not affected. Content that others already downloaded stays with them, and requests already sent to AI providers are governed by their policies.

13. Your rights and choices

• In the app:
  • Delete your account (Settings > Account > Delete Account).
  • Withdraw AI data sharing (Settings > AI Assistant & Dictation).
  • Turn Apple Calendar sync off, or remove calendar access in iOS Settings.
  • Turn iCloud sync on or off.
  • Export your whole library to one file.
  • Withdraw published content.
• Depending on where you live (for example the EU, UK, or US states such as California), you may have the right to:
  • access, correct, delete or receive a copy of your personal information
  • object to or restrict certain processing
  • withdraw consent
• How to ask. Email [email protected]. We may need to verify your request, and we will not discriminate against you for exercising your rights.
• Complaints. If you are in the EU, you may complain to your local data protection authority. If you are in the UK, you may complain to the Information Commissioner's Office.
• California residents. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes that require an opt-out.

14. Children

Strawberry Notes is not directed to children under 13. We do not knowingly collect personal information from children under 13, or under the minimum age of digital consent in their country if that is higher. If you believe a child has given us personal information, contact [email protected] and we will delete it.

15. Changes to this policy

We will update this policy when our practices change and change the effective date above. If a change is significant, we will tell you in the app before it takes effect. If we change the kinds of information the AI assistant sends, the app will ask for your permission again. Adding a new model does not by itself change that; new models are listed in section 3.

16. Contact

Strawberry Notes LLC
Email: [email protected]