In short
Noterat has no account, no sign-in, and no server run by us. We do not collect your personal data, we cannot read your notes, and there is no analytics, advertising or tracking in the app.
- Your notebooks are stored on your device.
- If you turn on iCloud sync, they are copied to the private iCloud storage of your own Apple Account. We cannot read it. Apple can, unless you turn on Advanced Data Protection.
- Your notes are in your device backup too, whether or not you use sync. That backup is handled by Apple, or by your own computer — not by us.
- Some Apple features on your device — Spotlight search, the clipboard — also touch your notes. We explain those below, because we would rather be accurate than reassuring.
- Nothing reaches us except what you deliberately send — an email, or TestFlight feedback — plus the anonymous, aggregated statistics Apple may pass on if you have allowed that in your device settings.
1. Who is responsible
Noterat is published by Westin Digital AB. Under the EU General Data Protection Regulation (GDPR) we are the controller for the limited processing described in this policy.
Org.nr 559598-0557
Parkpromenaden 19
191 38 Sollentuna
Sweden
info@westindigital.se
This policy covers the Noterat app for iOS and iPadOS, including that same app running on an Apple silicon Mac. It applies from the version current on the date above. The Settings paths below are the iOS ones; on a Mac the equivalent settings live in System Settings under the same names.
2. What Noterat does not do
The technical points below are properties of the app as built, and we checked each against our own source code; the last two are undertakings we give, which no source file could show:
- No user account, no sign-in, no password.
- No server operated by Westin Digital AB. The app makes no network requests of its own — there is nowhere for it to send anything. The only exception is the iCloud sync you can switch on, which goes to your own iCloud and is described in section 4. (iOS itself talks to Apple for its own reasons, whatever app you are using; that part is Apple's, and section 5 covers where it touches your notes.)
- No analytics, no usage statistics, no crash-reporting service, no advertising, no advertising identifier, and no tracking of you across apps or websites. The app never asks for tracking permission because it never tracks.
- No selling or sharing of personal data. The app sends us nothing, and the little that can reach us — an email you send us, or TestFlight feedback — is never sold and goes to no one but our email provider.
- No cookies. This page sets none and runs no scripts; the server hosting it keeps ordinary web-server logs, including your IP address, as any website does.
3. Your notes, and where they are kept
Everything you create in Noterat — handwriting, typed text, drawings, flashcards, photos you insert, documents you scan, PDFs you import, voice recordings, and calculations — is saved on your device, inside the app's own storage area, which other apps cannot read. If you turn on iCloud sync, a copy also goes to your own iCloud — section 4 sets out exactly what.
To make your notes searchable, the app also extracts text from each page (including recognising your handwriting and reading text out of imported PDFs and images) and keeps that text alongside the notebook. This happens entirely on your device; see section 7.
When you delete a notebook it goes to the app's Trash and is kept for 30 days by default — you can change or shorten that in the app's settings — after which it is deleted permanently.
Files you import are copied into the app. If you import a PDF or a photo, Noterat keeps its own copy inside your notebook rather than reading the original in place. If that file contains other people's personal data, you are the one deciding to store it, and you remain responsible for it.
If you use study cards, the app also keeps a record on your device of how each card went, so it knows what to show you next. That record stays on the device and is not part of what syncs.
4. iCloud sync (optional, and off until you turn it on)
Noterat can keep your library in step across your devices using Apple's CloudKit. This is switched off on a new installation. You turn it on in Settings inside the app. One exception: if you used an older version of Noterat that synced through iCloud Drive and had that switched on, upgrading carries that choice over and turns the new sync on for you, without asking again. It is a different store from the one you originally chose, so if you would rather it stayed off, turn it off in Settings after upgrading.
When sync is on, your library is written to the private database of your own Apple Account, in Noterat's iCloud container. It uses your iCloud storage, not ours. A private CloudKit database is reachable only through the Apple Account signed in on the device. Westin Digital AB has no access to it and no technical means of reading, retrieving or restoring anything you sync. Nothing passes through any system of ours, because we do not have one.
Apple is a different matter, and we would rather say so than let you assume otherwise. On standard iCloud, Apple holds the encryption keys to this data and can be compelled to produce it. If you would rather Apple could not read it either, turn on Advanced Data Protection in Settings → your name → iCloud; it covers Noterat's data, and your iCloud Backup, like any other app's.
What is uploaded when sync is on: your notebooks and pages; handwriting and ink; typed text and page objects; images you inserted; documents you scanned; PDFs, Markdown files and DXF drawings you imported; voice recordings; flashcard decks; saved elements, patterns and your own templates; and folder, tag and favourite information — and, for Markdown notes and DXF drawings, when you last opened the file. Notebook page thumbnails and the extracted search text are not uploaded — each device rebuilds those for itself. Standalone Markdown notes, DXF drawings, saved elements and patterns do carry a small preview image with them. Alongside what is uploaded travels the technical information sync needs: file and notebook names, internal identifiers, file types, modification times, revision counters, and a generic device model label such as “iPad”, which is used to name a conflicting copy if you edit the same page on two devices at once.
Apple acts as the storage provider for this. Your use of iCloud is governed by your agreement with Apple and by Apple's Privacy Policy. To signal your devices that something has changed, sync also uses Apple's push service; these messages are silent, carry no content, and Noterat never sends you notifications. They can wake the app in the background to fetch what changed; that background work is the only thing Noterat does when you are not using it.
Two things worth knowing about turning sync off:
- Switching sync off in Noterat stops further syncing. It does not erase what is already in your iCloud.
- Deleted items are synced too. While sync is on, they leave your iCloud when the retention period ends and they are purged. Once sync is off nothing further is sent — so whatever was already uploaded stays there until you delete Noterat's iCloud data yourself.
To erase the iCloud copy yourself, go to Settings → your name → iCloud → Storage (called Manage Account Storage on some devices) on your iPhone or iPad, tap Noterat and choose Delete Data from iCloud. Deleting the app does not do this for you — iOS leaves an app's iCloud data in place. Because we cannot see that data, this is something only you can do; see section 10.
If you used an older version that stored your library in iCloud Drive, Noterat can still read that folder in order to move your library back onto your device. It writes nothing new there. That older copy is removed by the same route as above — it appears under Noterat in your iCloud storage — and it is not browsable from the Files app.
5. Apple features on your device that also touch your notes
Some of what happens to your notes is done by iOS itself rather than by Noterat. It still concerns you, so here it is:
- Spotlight search. For every page that has text on it, Noterat adds the notebook's title, the page number and up to 4,000 characters of the page's text to your device's Spotlight index, so you can find a note from system search. The index belongs to iOS, not to us, and the content is not sent to Westin Digital AB. A notebook you delete stays in that index until you empty the Trash: moving it to the Trash removes it from the app, but its Spotlight entry is cleared only when the notebook is deleted for good. The app has no switch for this; you can stop it in Settings → Apps → Noterat → Search by turning off Show App in Search and Show Content in Search.
- Device backup. Noterat excludes nothing from backup, so your notebooks, imported files and voice recordings are included in your iCloud Backup, which Apple operates under Apple's terms, and in any backup you make on your own computer, whether or not you encrypt it.
- The clipboard. If you copy recognised handwriting or a formula, it goes to the system clipboard. If you use Universal Clipboard, iOS may make it available on your other Apple devices.
- The keyboard. Dictation, Scribble, predictive text and Writing Tools are Apple features offered in text fields, including most of ours. We add nothing to them and see nothing they produce; in a few fields where autocorrect would rewrite what you meant — the Markdown editor, the handwriting review sheet, the drawing measurement fields — we turn autocorrect and spelling suggestions off. If you use dictation, the audio is handled by Apple, not by us.
- Web links. If you write a web link into a note and tap it, iOS opens it in your browser. Noterat has no browser of its own and adds no links of its own — where you go is between you and that site.
- Sharing and exporting. When you share or export a note, iOS's share sheet hands it to whatever app or service you pick. From that moment it is governed by that recipient, and we have no visibility into it. Worth knowing: sharing a whole notebook as a Noterat file sends everything inside it — not only the pages you can see, but also the original PDFs you imported, any voice recordings, the extracted text used for search, and the notebook's own tags and the name of the folder you kept it in. Exporting also leaves a temporary copy in the app's temporary storage, which the app does not delete itself — iOS may clear that storage on its own, and it goes for good when you delete Noterat.
Protection of the files at rest is provided by iOS Data Protection, which depends on you having a passcode set on the device. We do not add a separate lock or password to notebooks, and this version of the app has no biometric lock.
6. Camera, microphone and photos
Noterat touches three parts of your device. Each is used for one thing, only when you ask for it, and never in the background.
| Camera | To take a photo, or scan a document, straight into a note. The image is placed in your notebook. Noterat does not save it to your photo library and does not use the camera at any other time. |
|---|---|
| Microphone | To record an audio note attached to a page, when you start a recording. The recording is saved as an audio file inside that notebook. It is not transcribed, not analysed, and not listened to by us. |
| Photos | To insert a picture into a note. You choose the picture in Apple's own photo picker, which runs outside the app and hands Noterat only the image you picked. Because of that, Noterat does not browse, search or write to your photo library. |
You can withdraw camera or microphone access at any time in Settings → Apps → Noterat on your device. The corresponding feature stops working; nothing else in the app is affected.
Noterat does not use location, contacts, the calendar, reminders, health data, Bluetooth, the local network or motion sensors. It does not use Apple's speech-recognition framework and never transcribes your audio notes — the dictation described in section 5 is the system keyboard's, invoked by you, not something the app does.
7. Handwriting and text recognition
Recognising your handwriting, reading text out of scanned pages and imported PDFs, and turning written notes into text or formulas is done by Apple's on-device recognition engine, running locally on your iPhone or iPad. The recognised text is stored with your notebook so that search works. No image, no page and no recognised text is sent to us or to any recognition service.
8. Calculations
Noterat's calculation feature runs a complete mathematics engine — the CPython interpreter together with the SymPy and mpmath libraries — inside the app, on your device. The engine is included in the app when you download it. Nothing is downloaded, installed or updated at runtime, and no expression you type is sent anywhere for evaluation. There is no calculation service behind it, ours or anyone else's.
Noterat does not run program code that you write. What you type is parsed into a mathematical expression and checked against a fixed list of permitted mathematical functions before the engine sees it.
Your formulas and their results are saved as part of the note, like any other content — which means that if you have turned on iCloud sync, they are synced to your own iCloud along with the rest of the page.
9. What we receive, and when
The app sends us nothing. There are only three ways anything about you can reach Westin Digital AB, and all three start with you or with Apple:
- If you write to us. If you email info@westindigital.se, we receive your email address, whatever you tell us, and anything you choose to attach. We use it to answer you and to put right anything you report, and for nothing else. The legal basis is our legitimate interest in providing support (GDPR Art. 6(1)(f)). We keep the correspondence for as long as it takes to deal with the matter and for at most twelve months afterwards, and then delete it.
- If you test the beta through TestFlight. If we invited you by email, we already have your address from the invitation, and your name shows up for us once you accept — whether or not you ever send us anything. If you do send feedback, Apple additionally passes on what you wrote, any screenshot you attached, and technical details of your device and app version. Separately, Apple collects crash logs and basic usage information from beta builds and passes them to us even if you never send us anything; Apple gives testers no way to switch that off. Same legal basis and handling as above. Beta testing is also governed by Apple's own terms for TestFlight.
- Reports from Apple. If you have turned on sharing with developers in Settings → Privacy & Security → Analytics & Improvements, Apple may give us statistics and crash reports about the app. The statistics are aggregated; the crash reports do not name you, and contain your device model, iOS version and a technical trace of where the app failed. Either way we receive this from Apple, not from the app, and you control it in that setting.
Two companies handle data on our behalf: the provider that hosts our email, and Apple. Under the developer agreement we have signed, Apple acts as our processor for whatever Noterat stores in its iCloud container, and may hold that data encrypted at a location of Apple's own choosing, including outside the EU/EEA. That transfer relies on the European Commission's standard contractual clauses, which form part of the developer agreement; write to us if you would like to know more about the safeguards. We make no transfers of our own beyond our email provider, and we sell nothing. What Apple does with data of its own, as part of iCloud, TestFlight or the App Store, is determined by Apple under Apple's own privacy terms.
10. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, and to restrict or object to its processing. The right to data portability does not arise against us, because the only personal data we hold is your correspondence, which we process on the basis of our legitimate interest rather than on consent or a contract (Art. 20(1)). You can exercise your rights at any time by writing to info@westindigital.se.
Being honest about what that means here: for correspondence and TestFlight feedback, these rights apply to us in the ordinary way, and we answer within one month. If a request is complicated, or we receive several, we may extend that by up to two further months; we will tell you within the first month if so, and why. For your notes there is nothing for us to give you or delete, because we neither have them nor can get access to them. We cannot identify you from what sits in your iCloud, and we are not required to acquire more information in order to do so (Art. 11) — so Articles 15 to 20 cannot be exercised against us for your notes. Everything they would otherwise give you, you do yourself:
- Access and copies: your notes are already yours and already on your device. You can export or share any notebook from inside the app.
- Correction: edit the note.
- Erasure: delete the notebook in the app and empty the Trash. If iCloud sync is on, also remove Noterat's iCloud data as described in section 4.
- Objection and restriction: turn off iCloud sync in Noterat's own settings, or withdraw the camera or microphone permission in Settings → Apps → Noterat.
If you are unhappy with how we have handled your personal data, you may complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se — imy.se. If you live or work in another EU or EEA country, or what you are complaining about happened there, you may go to that country's supervisory authority instead.
We make no automated decisions about you and we do not profile you.
We have not appointed a data protection officer, and are not required to under Article 37. As a company established in Sweden, and so within the EU, we do not need a representative under Article 27.
11. Children
Noterat is a general-purpose note-taking app. It is not directed at children, and it is not offered in the App Store's Kids Category. We do not knowingly collect personal data from anyone through the app, children included — the app sends us nothing at all. The only personal data that can reach us is what someone deliberately sends us by email or as TestFlight feedback, as described in section 9; if we understand that a child has written to us, we use what they sent only to answer and then delete the correspondence. If a child uses Noterat, their notes stay on their device on exactly the same terms as anyone else's. If you are a parent or guardian and have a question about this, please write to us.
12. Third-party components
Noterat includes a small amount of open-source software, compiled into the app when it is built. None of it collects data, and none of it connects to a network:
- SwiftMath — renders mathematical notation on the page.
- CPython, SymPy and mpmath — the calculation engine described in section 8, together with the supporting libraries CPython itself needs.
There are no third-party SDKs for analytics, advertising, attribution or crash reporting in Noterat.
13. Changes to this policy
If we change what the app does with data, we will update this page and change the date at the top. Material changes will also be described in the app's release notes. Because the app has no way of contacting you, this page is where the current version always lives.
14. Contact
Questions about this policy, or about privacy in Noterat, go to info@westindigital.se, or by post to the address in section 1. We answer in Swedish or English.