NoteWay

Privacy Policy

How Note Way handles personal data on this website and in the Note Way apps for Mac and iPhone, under the EU General Data Protection Regulation (GDPR).

Last updated: 8 October 2026

In short

1. Who is responsible

The controller under Art. 4(7) GDPR is:

André Bäcker, Note Way
Hopstener Straße 25, 49479 Ibbenbüren, Germany
Email: hello@noteway.ai · Phone: +49 176 21878801

For any question about data protection and your data, write to hello@noteway.ai.

2. This website

2.1 Hosting

This website is hosted by Cloudflare (Cloudflare Pages), and the address noteway.ai is resolved through Cloudflare as well (DNS). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you open noteway.ai, your browser connects to Cloudflare's network. Cloudflare processes the connection data of each request: your IP address, the date and time, the page or file requested and what your browser sends with each request, such as your browser, operating system and the referring page. Cloudflare does this on our behalf to deliver the website to you and to protect it against attacks and abuse. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure website that works. Where Cloudflare processes connection data for its own purposes, for example to protect its network against attacks, Cloudflare is responsible for that itself (Cloudflare Privacy Policy).

We don't see or store any server logs ourselves: our Cloudflare plan gives us no access to logs of individual requests. Cloudflare does not state a fixed retention period. It keeps the connection data for as long as these purposes require or legal obligations demand, taking into account, among other things, the purpose, volume and sensitivity of the data, and then deletes it (section 11 of the Cloudflare Privacy Policy). When our contract with Cloudflare ends, Cloudflare deletes the data it processed on our behalf, unless the law requires it to be kept.

Cloudflare processes the data under its data processing agreement (the Cloudflare Customer DPA, Art. 28 GDPR), which is automatically part of our contract with Cloudflare. Cloudflare runs a worldwide network, so the data may also be processed in the USA. Cloudflare is certified under the EU–US Data Privacy Framework; the European Commission's Standard Contractual Clauses in the agreement apply as a fallback (see section 5).

2.2 Fonts

We serve the fonts on this website (Figtree, Geist, Geist Mono, Caveat) ourselves, together with the website. Your browser does not connect to Google Fonts or any other font service.

2.3 Cookies and similar technologies

This website sets no cookies and uses no tracking pixels and no fingerprinting. We use no analytics, marketing or social media tools.

There is one thing the website briefly keeps in your browser: when you move to another page of the website, it notes in your browser's session storage (sessionStorage, entry "nw-vt") which view you came from and where the element you clicked was, so the transition to the new page animates smoothly. The entry contains no identifier and nothing about you, never leaves your device, and is deleted as soon as the next page has read it, at the latest when you close the tab. This is strictly necessary to show the website the way you asked for it (§ 25(2) no. 2 TDDDG). You therefore don't need to agree to anything when you visit.

If we ever add a tool that stores or reads information on your device and is not strictly necessary, we will ask for your consent first (§ 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG) and update this policy.

When you buy Pro for the Mac, the app opens noteway.ai/pay, and the checkout of our reseller Paddle opens there. This is the only page of the website that loads something from another company: Paddle's checkout script, from Paddle's servers (cdn.paddle.com). Paddle may store cookies for the payment that are needed for it; Paddle's own privacy and cookie policy applies.

The Note Way apps store on your device what they need to work: your sign-in session, your settings and your entries so they are available offline. This is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG).

The download buttons lead to the Apple App Store or download the Mac app from download.noteway.ai, which Cloudflare stores and delivers for us (Cloudflare R2), with the same connection data and terms as in section 2.1. On another company's website, its own privacy policy applies.

2.5 Contacting us

If you write to us or call us, we process your name, your email address or phone number and your message in order to answer. Legal basis: Art. 6(1)(b) GDPR if your request concerns a contract with us or steps before one, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering you). We delete your messages once your request is settled, unless statutory retention periods under commercial or tax law require us to keep them.

Our email provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes emails on our behalf under its data processing agreement (Art. 28 GDPR). No data is transferred to a country outside the EU for this.

2.6 Our social media profiles

Note Way has profiles on Instagram, Threads, X and YouTube, and the footer of this website links to them. These are plain links: this website loads nothing from these services and shows no posts, videos or buttons from them. Only when you click one of the links does your browser connect to the service, and our links don't tell it which page you came from.

When you visit one of our profiles, the provider's privacy policy applies:

Statistics about our profiles. Instagram, Threads, X and YouTube show us aggregated statistics about how people interact with our profiles and posts, such as reach, views and rough information on location and age. To create them, the providers analyse data about visitors; we cannot identify individual people in these statistics. Under the case law of the Court of Justice of the European Union (judgment of 5 June 2018, C-210/16), we are jointly responsible with the respective provider for creating such statistics (Art. 26 GDPR). Our legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding which posts work. Which data the providers collect for this and how long they keep it is decided by the providers alone.

For statistics about Pages, Meta has allocated the obligations in an arrangement under Art. 26 GDPR (the Page Insights Controller Addendum). Where it applies to our Instagram and Threads profiles, Meta Platforms Ireland Limited takes primary responsibility under it: Meta ensures the legal basis, informs about the processing (Information about Page Insights), handles requests about your rights and protects the data. The lead supervisory authority is the Irish Data Protection Commission.

You can exercise your rights with us and with the respective provider. The provider can help fastest, because only the provider has access to the data; we forward requests we receive to the provider.

2.7 Cancelling and withdrawing on this website

At the bottom of every page you'll find "Cancel contracts here" and "Withdraw from contract". If you use them to cancel or withdraw, we process what you enter in the form (name, email address, which contract, the type and date of the cancellation and, if you give one, the reason) together with the date and time we received it. We use this to carry out your declaration, including through Paddle (section 3.9), and we immediately send you a confirmation by email. We keep the declaration and the confirmation for 3 years as proof. To protect the form against abuse, we limit how often it can be sent from the same IP address and for the same email address.

Legal basis: Art. 6(1)(c) GDPR together with §§ 312k and 356a of the German Civil Code (BGB); for carrying it out, Art. 6(1)(b) GDPR; for proof and protection against abuse, Art. 6(1)(f) GDPR (our legitimate interest in being able to prove declarations and in keeping the form available). The data goes to our database at Convex (section 4) and, for the confirmation, to our email provider STRATO (section 2.5).

3. The Note Way apps

3.1 Your account

You need an account to use Note Way on your Mac and iPhone. We process:

Purpose: to create and protect your account and to connect your devices. Legal basis: Art. 6(1)(b) GDPR (contract). Protecting accounts against misuse is also our legitimate interest under Art. 6(1)(f) GDPR. Our sign-in provider is Clerk (see section 4). Clerk sends sign-in emails, such as verification codes, through its subprocessor Twilio SendGrid (USA); SendGrid receives your email address and the content of that email for this.

3.2 What you capture

When you speak, type or photograph something in Note Way, we process this content: the text, the transcript of what you said, photos and what is recognised in them, and everything Note Way makes of it (tasks, events, lists, ideas, notes, pages, "Waiting on" items). We also process the date, time, time zone, language and the device of each entry.

Purpose: to provide Note Way, which means understanding your input, filing it in the right place, showing it in Today and syncing it between your devices. Legal basis: Art. 6(1)(b) GDPR. Your entries are stored on your devices and in our cloud database (Convex, see section 4).

What you capture can be about other people ("Ask Leila about the offer") or can be sensitive ("Doctor on Tuesday at 9"). We only process it to provide Note Way to you. For sensitive information about you, we ask for your explicit consent (section 3.4). Please capture only what you are allowed to. The legal basis for information about other people is the legitimate interest, yours and ours, in you being able to use Note Way for this (Art. 6(1)(f) GDPR). Informing these people separately would involve a disproportionate effort (Art. 14(5)(b) GDPR).

"That wasn't good". For any input, in the preview or under Library → Said, you can tell us what was wrong (misheard, filed in the wrong place, wrong time or something else) and, if you like, the right text (500 characters at most). We store this in your account so Note Way can fix the mistake, learn the right spelling if it misheard you (section 3.3), and so we can measure Note Way's quality. We delete the text after 90 days; after that only the reason and the time remain. Legal basis: Art. 6(1)(b) GDPR. We don't use it to train AI models.

3.3 Your voice

Note Way only listens while you hold the shortcut on your Mac (⌥ Space by default) or the dot on your iPhone, or when you start a recording yourself. What you say is turned into text, either on your device by Apple's speech recognition or by OpenAI. So that names and terms are spelled right, Note Way sends a short list of words to OpenAI with the audio: your name, the words in "Your dictionary" (added by you or learned from your corrections), the names of your lists and projects, the title of the entry or project you're in, names from your recent entries and your calendar, the first names of the people invited to the event that is running or about to start, the names under "Your people" and the names of people Note Way has remembered or that you picked or added in Note Way. Audio that goes to our server for this is deleted as soon as the text is ready; if something gets stuck, after three days at the latest. We don't keep recordings of your voice.

Your dictionary. So that Note Way spells your words right, it keeps "Your dictionary" for you. It holds words you add yourself and spellings Note Way learns from your corrections of spoken input: when you fix a misheard word in the preview, within the first 10 minutes in an entry made from a dictation or in a call, or when you cancel a dictation and type an improved version within two minutes. For each word we store the spelling, up to five forms in which speech recognition got it wrong, where it came from, whether it is on, how often you corrected or undid it and when it last came up. To learn from later changes, the app keeps what you said and the titles of the entries made from it on your device for 10 minutes. Whether a word is a name or an everyday word is checked by your device's spell checker; nothing goes to Apple for this. Your dictionary is stored in your account in our cloud database (Convex, section 4) and as a copy on your devices. It holds up to 1,000 words; beyond that, the learned words that haven't come up for the longest time drop out, never the ones you added yourself. With every input, your spellings go to our server so it can put them into what you said, and the matching ones also go to OpenAI as context (section 3.4). The purpose is that dictation and calls spell your words right; legal basis: Art. 6(1)(b) GDPR. You can edit, switch off or delete any word and turn learning off completely: on the Mac under Settings → Capture → Learning ("Learn words from corrections"), on the iPhone under Account → You → "Your dictionary". This is not training of AI models: Note Way only keeps your list, and only for you.

3.4 Understanding with AI (OpenAI)

To understand what you mean, Note Way sends your input through our server to OpenAI, together with the context needed for it: the current date, time and time zone, the names of your lists, places and pages, your upcoming events and tasks where they matter for the input, the first names you selected under "People", and what you tell Note Way about yourself under Account → You (your name, "About you", your people with their roles, your shortcuts), plus the spellings from "Your dictionary" that match your input (section 3.3). OpenAI sends back a structured suggestion, which Note Way shows you or files.

We also use OpenAI to write summaries and page structures, to read photos and, in call notes, to transcribe, summarise and answer your questions (section 3.6). For Insights, Note Way counts what you capture and complete each day and shows you looks back. For the text of your monthly profile, only numbers, up to three first names and the name of one project go to OpenAI, never your sentences, and only with your consent to AI processing. You can turn Insights off under Account → You ("Show insights"). What the AI writes, such as summaries, call cards and pages, is marked in the app as made with AI.

3.5 Access to your calendar, contacts, photos and more

Note Way only uses these with your permission, which your device asks for. You can withdraw it at any time in the system settings.

3.6 Call notes on your Mac (Note Way Calls)

Recognising a call. Note Way checks which apps are using the microphone and camera. If you allow Accessibility, it also reads the window and tab titles of meeting apps and browsers, for example "Zoom Meeting" or "meet.google.com", to recognise a call. This happens only on your Mac. A log of the last 300 detection events stays on your Mac, and you can copy it if you need our help.

Taking notes. Notes start when you start them. If you turned on automatic start for meeting apps and agreed once to tell the others, they start by themselves as soon as Note Way is sure it is a call; for ten seconds you can undo the start. Note Way then records the sound of your microphone and of the call. If you allowed Accessibility, Note Way also reads, while notes are running, the names of the participants in the meeting app's window, who is marked as speaking and whether the screen is being shared; for a meeting in the browser, only on the call's page. It uses this to give the voices their names. This information stays in your Mac's memory during the call; what becomes the names of the voices is stored with the call.

Turning sound into text. The sound is written down on your Mac by Apple's speech recognition and, in short pieces, by OpenAI, which also tells the voices apart. To keep the voices apart within one call, short samples of each voice from that call are sent with the next pieces. So that names and terms are spelled right, the call's title and a list of names and terms are sent as well: the people invited according to your calendar, the names from the meeting app's window, your people from Account → You, the words in "Your dictionary" (including words you corrected in calls; section 3.3), the names of your projects and other names Note Way knows from your entries and your calendar. The sound is not kept: longer pieces sit on our server only briefly for processing and are deleted afterwards, if something gets stuck after three days at the latest; on your Mac and at OpenAI the sound is not kept beyond the processing described in section 3.4. After the call, OpenAI writes a summary (the call card) from the transcript and your notes. If you ask questions about a call or about all your calls, your question and the matching parts of the transcript go to OpenAI.

What is stored. Every call is stored in your account in our cloud database (Convex, section 4), so you can find it again on your devices, search it and ask about it. We store: title, app, start and duration; the names of the voices, which you give or which Note Way recognises from the conversation (for example when someone is addressed by name), and how much each voice spoke; the call card with summary, topics, points with short verbatim quotes and "Who said what"; your notes and marked moments; the tasks and "Waiting on" items made from it; and, as long as "Keep call notes in the entry" is on, the transcript with times and voices. The transcript is also in the call's entry. For search, we also store these texts in a search index. A copy stays on your Mac so that Note Way also works without a connection.

Deleting. "Delete call notes" removes a call's transcript from the database, the search index and the entry; the summary, points and notes stay. If you turn on "Delete call notes after 90 days" on your Mac, Note Way deletes the transcripts of calls older than 90 days once a day in our cloud. To delete a whole call, delete its entry and then delete it for good in the trash. If you discard a call in Calls, it stays in the Calls trash for 30 days and is then deleted for good; until then you can restore it. Otherwise calls stay stored until you delete your account.

Call hours. Calls count towards the hours included in your plan; for that we store when a call started, how long people spoke and which plan applied.

The other people in the call. A call contains personal data of the others: their voices, their names and what they say. Before notes start, you must tell everyone in the call and get their consent. In Germany, recording or transcribing a private conversation without it is a criminal offence (§ 201 of the German Criminal Code, StGB). In several US states, such as California, everyone in the call must agree as well, and many other countries have similar rules. Note Way gives you a sentence to paste into the chat. If you use Note Way for work, your organisation is the controller for the participants' data, and we process it on its behalf under a data processing agreement (Art. 28 GDPR). We provide it to business customers on request to hello@noteway.ai.

Legal basis. Towards you: Art. 6(1)(b) GDPR. Where we process the data of other participants under our own responsibility: Art. 6(1)(f) GDPR. The legitimate interest is a written record of a conversation that the participants agreed to.

If you were in a call with a Note Way user and want to exercise your rights, please contact that user first, because they decide about their notes. You can also contact us; we will support you as far as we can identify the data.

3.7 Notifications

If you allow notifications on your iPhone, Note Way stores the device token issued by Apple (Apple Push Notification service) to send you reminders. Legal basis: Art. 6(1)(b) GDPR.

3.8 Performance, usage limits and errors

The apps and our server measure how long certain steps take and whether they succeed, for example the time until your words appear or until an entry is saved. These measurements are linked to your account and contain the app version and platform, but no content. We keep them for 30 days. After each dictation, the apps also measure ten minutes after saving whether you corrected anything afterwards: language, platform, whether a word or something else (type, day, time, place) was changed, and how many words Note Way learned, replaced, undid or marked as uncertain. This measurement never contains a word, a name or audio either. The line "This week: X of Y dictations without a correction" is worked out by the app on your device itself (on the Mac under Settings → Capture → Learning, on the iPhone under Account → You → "Your dictionary").

The Mac app also reports its own errors to us, because Apple sends no crash reports for apps downloaded from a website. A report contains the kind of error, its technical name (for example "TypeError"), the place in Note Way's own code where it happened, how often it happened, and the app and macOS version. It never contains an error message or anything you said, typed or saved. We keep a report for 30 days after the error last occurred.

You can switch all of this off in the app's settings: Privacy and legal → Share diagnostics. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a fast and reliable app.

To apply fair limits and to calculate our costs, we count your requests to the AI services (number, model, size, costs) and the call hours you use. We keep these counts linked to your account for 12 months and then delete them; if you delete your account, we delete them at once. How many of your 5 free inputs you used is kept with your account. Legal basis: Art. 6(1)(b) GDPR.

If you agreed in your iPhone settings to share analytics with app developers, Apple sends us anonymous crash reports and usage statistics. Apple is responsible for this.

3.9 Subscription and payment

Legal basis: Art. 6(1)(b) GDPR. We keep records that commercial and tax law require for the statutory periods (Art. 6(1)(c) GDPR together with § 147 of the German Fiscal Code, AO, and § 257 of the German Commercial Code, HGB).

3.10 Deleting your account

You can delete your account in the app (Settings → Delete account). We delete your sign-in at once and all content of your workspace within 30 days; it disappears from our backups within a further 14 days, because we delete every backup after 14 days at most. In a workspace you share with others, the content you shared stays with them. Records we must keep by law are kept, but blocked for any other use. Deleting your account does not cancel an App Store subscription; please cancel it in your Apple account settings.

3.11 Updates of the Mac app

Every few hours the Mac app asks download.noteway.ai whether there is a newer version, and if there is, downloads it and checks our signature before putting it in place. This request contains no account data and nothing you captured; Cloudflare processes the connection data as described in section 2.1. Legal basis: Art. 6(1)(b) GDPR, because we owe you a secure app that works.

4. Who receives data

We use these service providers. Where they process data on our behalf, we have a data processing agreement with them (Art. 28 GDPR).

Provider What for Which data Where Basis for transfer
Clerk, Inc., San Francisco, USA Sign-in Account and sign-in data USA EU–US Data Privacy Framework, Standard Contractual Clauses as a fallback
Convex, Inc., San Francisco, USA Database and server functions All app data, entries in the cancellation and withdrawal form EU (Ireland, in data centres of Amazon Web Services) Standard Contractual Clauses (in Convex's data processing agreement), because Convex can access the data from the USA
OpenAI Ireland Ltd (see section 3.4) Understanding, transcription, summaries, answers to questions about calls Your input with context, call audio in pieces, call transcripts Ireland, processing in the USA Standard Contractual Clauses
Cloudflare, Inc., San Francisco, USA Website (Cloudflare Pages and DNS), downloads and updates of the Mac app (Cloudflare R2) Connection data when you open the website or download the Mac app USA and worldwide network EU–US Data Privacy Framework, Standard Contractual Clauses as a fallback
STRATO GmbH, Berlin, Germany Email Messages to us, confirmations of cancellations and withdrawals Germany No transfer outside the EU

These companies receive data under their own responsibility when you use their services: Apple (App Store, Sign in with Apple, notifications, speech recognition), Google (only if you sign in with Google) and Paddle (payment for the Mac). Their privacy policies apply.

We only pass data to authorities if the law requires us to.

5. Transfers outside the EU

Some of our providers are based in the USA or process data there. For the USA, the European Commission has decided that companies certified under the EU–US Data Privacy Framework ensure an adequate level of protection (Art. 45 GDPR). Where a provider is not certified, we agree the European Commission's Standard Contractual Clauses with it (Art. 46(2)(c) GDPR). For the United Kingdom there is an adequacy decision of the European Commission. You can ask us for a copy of the safeguards.

6. How long we keep data

7. Your rights

You have the right to:

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims.

To exercise your rights, write to hello@noteway.ai.

You can also complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

8. Do you have to provide data?

You need an email address (or an Apple or Google account) to create an account. Without it, we cannot provide Note Way. What you capture is up to you.

9. Automated decisions

Note Way uses AI to suggest where an entry belongs and to write summaries. You see what it understood and can change or undo it. We make no decisions based solely on automated processing that have legal effects on you or affect you similarly significantly (Art. 22 GDPR).

10. Children

Note Way is not meant for people under 16. We do not knowingly process data of children under 16.

11. Security

Data travels encrypted (TLS) between your devices, our servers and our providers. Our providers store it encrypted. Only those who need it to run Note Way can access it.

12. Changes to this policy

We update this policy when Note Way or the law changes. The current version is always on this page. We tell you about important changes in the app or by email.