Privacy Policy
In short: Your recordings and transcripts are stored on your phone. To transcribe, the audio file is sent to our speech-to-text provider ElevenLabs (United States); to create a summary, the text is sent to OpenAI. Below we explain exactly what goes where, why, and for how long. We don't ask for an account, your name or your email.
1. Who we are
Hearnote is published by Ozcan Zafer AYAN, an individual developer, who is the data controller under the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Contact: destek@gethearnote.com.
2. Where your recordings and transcripts go
On your phone
Your audio recordings, transcripts and summaries are stored on your iPhone, in the app's own storage. You can delete them inside the app, and deleting the app removes them from the device. If iPhone backups (iCloud or computer) are turned on, app data may be included in those backups under Apple's backup rules.
Transcription: ElevenLabs
When you transcribe a recording, the audio file is sent directly from your phone to our speech-to-text provider, ElevenLabs, which processes data in the United States. ElevenLabs may log requests. After the transcript is delivered, we ask ElevenLabs to delete it; ElevenLabs' backups may keep data for up to 30 days. We have turned off ElevenLabs' use of our data for model training in our account settings.
Summary: OpenAI
To create the summary and key points, only the text (never the audio) is sent from our server to OpenAI. Requests are made with storage turned off. Under OpenAI's API terms, data may be kept for up to 30 days for abuse monitoring and is not used to train models.
Our server
The transcript and summary are kept on our server only temporarily, until your app downloads them, and are deleted at most 24 hours after completion. Your audio files are not stored on our server.
3. What our server stores
Our server runs on Cloudflare (api.gethearnote.com). There is no account; we don't ask for your name, email address or phone number. Our server holds only the following:
| Data | Why | How long |
|---|---|---|
| Anonymous device identifier (a random ID created by the app) | To link your usage and subscription without personal information | Until you use “Delete my data” |
| Usage seconds and quota | To apply Free and Pro limits | Until you use “Delete my data” |
| Subscription status (App Store transaction IDs) | To verify your Pro subscription | Until you use “Delete my data” |
| Push notification token and app language | To notify you, in your language, when a transcript is ready | Until you use “Delete my data” or turn off notifications |
| Transcript and summary | So the app can download them | Temporary; deleted at most 24 hours after completion |
You can delete this server-side data at any time from Settings → Delete my data in the app. If you have an active subscription, it continues through Apple; cancel it in your App Store settings.
Apple DeviceCheck
We use Apple's DeviceCheck to remember whether a device has already used the free 30 minutes. It is a small per-device flag stored by Apple; it contains no personal data and persists even if the app is deleted and reinstalled.
4. Third-party services
| Service | Purpose | Data |
|---|---|---|
| ElevenLabs (US) | Speech-to-text | Audio file, requested language |
| OpenAI (US) | Summary and key points | Transcript text |
| Cloudflare | Server and website hosting | Server data (see section 3), technical connection data (e.g. IP address) |
| Apple | Payments, DeviceCheck, push notifications | Purchases, device flag, push token |
| RevenueCat | Subscription management and analytics | Anonymous purchase records |
| PostHog (EU servers) | Anonymous usage analytics | Anonymous usage events; no recordings or text |
| Google AdMob | Ads for free users | Advertising identifier (if you allow it), device and ad interaction data |
Apple processes all payments; your card details never reach us or RevenueCat.
5. Ads and tracking
Free users see a small banner ad; Pro users see no ads. Ads are served by Google AdMob.
- In the European Economic Area and the United Kingdom, Google's consent form (UMP) is shown to ask for your choice.
- On iOS, App Tracking Transparency asks for permission before personalised ads are shown.
- If you decline, you still see ads, but they are non-personalised.
You can change your choice on your iPhone in Settings → Privacy & Security → Tracking.
6. Analytics
To improve the app, we collect anonymous usage events with PostHog (EU servers), for example that a screen was opened or a transcription completed. Your recordings, transcripts and summaries are never sent to analytics. You can turn analytics off in the app's Settings.
7. Microphone and background recording
We use microphone permission only to record when you tap the record button. Recording can continue in the background until you stop it, and iOS shows its microphone indicator while it does. The app never records without your action.
8. Legal bases
Under Article 6 GDPR (and Article 5 KVKK) we rely on:
- Performance of a contract: transcription, summaries, quota and subscription management.
- Legitimate interests: preventing abuse (e.g. DeviceCheck), security and anonymous analytics.
- Consent: personalised ads and, where required, international transfers. You can withdraw consent at any time.
9. International transfers
To provide the service, some data is transferred outside Turkey and the EU, mainly to the United States (ElevenLabs, OpenAI, Apple, RevenueCat, Google; Cloudflare operates a global network). These transfers rely on safeguards offered by the providers, such as standard contractual clauses, in line with Chapter V GDPR and Article 9 KVKK.
10. Your rights
Under the GDPR and KVKK you have the right to:
- access your personal data and learn whether it is processed,
- have inaccurate data corrected,
- have your data deleted,
- object to processing and ask for it to be restricted,
- receive your data in a portable format,
- withdraw consent where you gave it,
- lodge a complaint with your local data protection authority (in Turkey, the Personal Data Protection Authority).
Because there is no account, we don't know who you are. The fastest way is Settings → Delete my data in the app. For any other request, email destek@gethearnote.com; we reply within 30 days.
11. Children
Hearnote is not directed at children under 13, and we do not knowingly collect data from them.
12. Security
All connections between the app, our server and our providers are encrypted (HTTPS/TLS). We keep only the minimum data needed, for the shortest time needed. No system is risk-free; if a data breach occurs, we will notify as required by law.
13. Changes and contact
We may update this policy. We will announce significant changes on this page and, where appropriate, in the app; the effective date is always shown at the top.
Questions: destek@gethearnote.com.