Privacy Policy

Suvojeet Sengupta ("I," "me," or "my") built the NoteNext app as an Open Source app. This Privacy Policy is used to inform you regarding my policies with the collection, use, and disclosure of personal information if anyone decided to use my Service.

By using NoteNext, you agree to the collection and use of information in relation to this policy. The information that I collect is used for providing and improving the Service. I will not use or share your information with anyone except as described in this Privacy Policy.

1. Information Collection and Use

NoteNext is designed with your privacy as a top priority. All of your primary data is stored locally on your device.

a. Information You Provide

We collect the content you create and store within the app, which includes:

• Notes (titles and content)
• Checklists and Todo items
• Labels and Projects
• Reminders
• Attachments (images, audio, etc.)
• Settings, including your theme preferences and app lock status.

This data resides solely on your device's private storage. Your App Lock PIN is stored using industry-standard hashing (PBKDF2), meaning even we cannot retrieve it.

b. Donations (Optional)

If you choose to support NoteNext via a donation, the transaction is processed securely through Google Play Billing. We do not collect or store your credit card, payment details, or any personal identity information during this process.

c. Permissions

NoteNext requests certain permissions to enable its features:

• READ_MEDIA_IMAGES: To allow you to attach images from your gallery to your notes.
• INTERNET & ACCESS_NETWORK_STATE: To fetch link previews, download expressive Google Fonts, and perform Google Drive backups (if enabled).
• USE_BIOMETRIC: To secure the app with your fingerprint or face unlock.
• SCHEDULE_EXACT_ALARM: To ensure your note reminders trigger precisely at the time you set.
• POST_NOTIFICATIONS: To show notifications for your reminders.

2. Cloud Backup (Google Drive)

NoteNext offers an optional feature to backup your notes to Google Drive. If you choose to use this feature:

• The app requests access only to the files it creates (using restricted scopes). It cannot read your other Drive files.
• Your data is compressed and uploaded directly to your personal Google Drive. We do not have a private server and never see your files.
• Encryption: You can set a password to encrypt your backups using AES-256 encryption before they are uploaded.

3. Note Sharing (Optional, End-to-End Encrypted)

NoteNext offers an optional feature to share a note as a link. This is the only case where note content is stored on our server, and it is designed to be zero-knowledge:

• Encrypted on your device: The note's title and content are encrypted with AES-256-GCM on your device before anything is uploaded. Our server only ever receives and stores an unreadable, encrypted blob.
• The key never reaches us: The decryption key exists only inside the share link itself (its URL fragment). Browsers and apps never transmit that fragment to any server, so we are technically unable to read a shared note.
• Automatic expiry: Every shared note is deleted automatically after the duration you pick (10 minutes, 1 hour, 1 day, or 7 days). You can also enable "burn after reading" to delete it once it has been opened.
• Only metadata is in the clear: Aside from the encrypted blob, we store only a technical share ID, the chosen expiry time, and an optional display name you provide.
• You control deletion: Only the creator can unshare a note early, proven by a secret token stored on your device. We keep no accounts and cannot link a shared note back to you.

4. AI Features

NoteNext includes AI-powered tools like "Note Summarization" and "Grammar Fix". We support multiple providers including Groq, OpenAI, Anthropic (Claude), and Google Gemini:

• Explicit Action: Content is only sent to an AI provider when you manually trigger an AI action (e.g., clicking "Summarize").
• Data Sent: Only the text content of the specific note you are editing is sent.
• Privacy: Data is processed according to the respective provider's privacy policy. We do not store your AI queries on any server.

5. Advanced Privacy & Security

• Decoy Vault: If enabled, NoteNext allows you to set a secondary PIN that opens a separate, "decoy" set of notes. This provides plausible deniability under coercion. When active, biometric login is hidden to prevent bypass.
• Screenshot Protection: To prevent data leaks, NoteNext blocks screenshots and hides the app's content from the system "Recents" menu while you are on the App Lock screen.
• Self-Destruct: All self-destruct processing for ephemeral notes is performed entirely on your device using exact system alarms. No external service is involved in the deletion process.
• Forensic Hardening: We have disabled standard Android cloud extraction (Android 12+) and device-to-device transfers to ensure your sensitive notes never leave your device's hardware-bound encryption vault.

6. Crash Reporting

To improve app stability, NoteNext uses ACRA (Application Crash Reports for Android). If the app crashes:

• A technical report containing device info and stack traces may be sent to the developer.
• User Consent: Depending on your settings, you may be prompted before a report is sent.
• These reports do not include your personal note content.

7. Data Retention and Deletion

Your data is yours. You can:

• Delete individual notes (moved to Bin).
• Empty the Bin to permanently delete data.
• Uninstall the app to wipe all local data from your device.
• Delete your Google Drive backups via the app settings or Google Drive directly.
• Stop sharing a note at any time to delete its encrypted copy from the share server; otherwise it is deleted automatically when its link expires or is burned after reading.

8. Third-Party Services

NoteNext uses these services:

• Google Drive API: For optional backups.
• Google Fonts: For typography.
• Groq / OpenAI / Anthropic / Google AI APIs: For optional AI features (BYOK).
• Jsoup: For local generation of link previews (fetches metadata from URLs you type).

9. Contact

If you have any questions or suggestions about my Privacy Policy, do not hesitate to contact me at support@suvojeetsengupta.in.