Privacy Policy

Introduction

Welcome to Noted - Day Planner ("Noted", "the App", "we", "us", or "our"), developed and operated by Holokraft Consulting Services (OPC) Pvt Ltd ("Company", "Holokraft", "Developer"), a private limited company incorporated in India.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Noted Android application (Package ID: com.holokraftinc.noted), our website at https://holokraftinc.github.io, and any related services (collectively, "Services").

By downloading, installing, or using Noted, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please do not use the App.

This Privacy Policy is designed to satisfy requirements under:

• Google Play Developer Policy
• Google API Services User Data Policy
• General Data Protection Regulation (GDPR) — European Union
• California Consumer Privacy Act (CCPA) — United States
• Information Technology (Amendment) Act, 2008 — India

Information We Collect

We collect information in the following categories depending on how you use the App:

2.1 Information You Provide Directly

• Account Information: When you sign in with Google, we receive your name, email address, and Google profile picture URL. This information is used to create and identify your Noted account.
• Tasks: Task titles, descriptions, due dates, priority levels, completion status, and recurrence settings that you enter into the App.
• Notes: The text content of notes you create, including titles and body text.
• Smart Lists: List names, list items, and checklist states that you create and manage.
• Reminders: Reminder titles, date and time settings, recurrence patterns, and notification preferences you configure.
• App Preferences: Your settings and configuration choices within the App.

2.2 Information We Collect Automatically

• Device Information: Device model, Android OS version, and unique device identifiers necessary for app functionality and support.
• App Usage Data: Basic usage metrics such as session duration and feature usage patterns, collected in aggregate and anonymized form to improve the App. (Future: via Firebase Analytics.)
• Crash Reports: If the App crashes, anonymized crash data including stack traces and device state at the time of crash may be collected. (Future: via Firebase Crashlytics.)

2.3 Information We Do NOT Collect

• We do not collect your Google Calendar event content beyond what is displayed within the App.
• We do not collect your precise GPS location.
• We do not collect your contacts or address book.
• We do not access your camera, microphone, or photos unless you explicitly grant such permissions for a specific feature.
• We do not collect payment or financial information.

Google Sign-In & Authentication

Noted uses Google Sign-In via Google's OAuth 2.0 protocol as the sole method of authentication. This provides a secure and convenient way to access the App without creating a separate username and password.

3.1 What Google Data We Access

During sign-in, we request the following Google account scopes:

• openid: To verify your identity with Google.
• profile: To access your display name and profile photo URL.
• email: To access your Google email address, which serves as your unique account identifier.
• https://www.googleapis.com/auth/calendar.readonly (Optional): To read your Google Calendar events for display within the Noted timeline. This scope is only requested if you choose to enable Calendar Sync.

3.2 Authentication via Supabase

We use Supabase Authentication to manage your session securely. When you sign in with Google, Supabase creates a secure session token associated with your account. This token is used to authenticate all your requests to our database and is stored securely on your device.

3.3 Token Storage

Authentication tokens are stored in encrypted local storage on your Android device using Android's secure storage mechanisms. We do not store raw passwords or Google credentials on our servers.

Google Calendar Access

Noted offers an optional Google Calendar integration that allows you to view your Google Calendar events within the App's Timeline Planner and Smart Inbox alongside your tasks.

4.1 What We Access

• We request read-only access to your Google Calendar events using the calendar.readonly scope.
• We read event titles, dates, times, and descriptions solely to display them inside the App.
• Calendar data is fetched directly from the Google Calendar API and displayed in-app.

4.2 What We Do NOT Do With Calendar Data

• We do not create, edit, update, or delete any Google Calendar events.
• We do not store your Google Calendar event content on our servers beyond a temporary cache needed for display.
• We do not share your calendar data with any third party.
• We do not use your calendar content to serve advertisements or for any purpose unrelated to displaying your schedule.
• We do not use calendar data to train machine learning models.

4.3 Revoking Calendar Access

You can revoke Noted's access to your Google Calendar at any time by:

• Going to Google Account Permissions and removing Noted's access.
• Disabling Calendar Sync within the Noted app under Settings.

Revoking calendar access does not affect your Noted tasks, notes, lists, or reminders.

User-Generated Content Storage

All content you create within Noted — including tasks, notes, smart lists, reminders, and preferences — is stored in our cloud database powered by Supabase.

5.1 Notes Storage

Notes you create are stored in your user-specific database partition. Only you have access to your notes. Notes are transmitted over encrypted HTTPS and stored with row-level security policies that ensure your notes can only be accessed with your authenticated credentials.

5.2 Tasks Storage

Tasks including their titles, descriptions, due dates, priorities, recurrence rules, and completion status are stored in your secure user account. Task data is synced between your device and the cloud whenever you are online.

5.3 Lists Storage

Smart Lists, list items, and their checklist states are stored securely in your account. List data is subject to the same security and privacy protections as all other user content.

5.4 Reminder Storage

Reminder configurations including their schedule, recurrence pattern, and notification preferences are stored in your account. Local notification triggers are also stored on-device to ensure reminders fire even when you are offline.

5.5 Local Device Storage

To support offline functionality, a copy of your data is maintained in local device storage (SQLite database on your Android device). This local copy is synchronized with the cloud when connectivity is available. Local data is protected by your device's built-in security mechanisms.

Notifications & Permissions

6.1 Notification Permission

Noted requests permission to send you local notifications on Android. This permission is used exclusively to deliver task reminders and meeting alerts that you have set up within the App. We do not send unsolicited marketing notifications.

You can manage notification permissions at any time through Android Settings → Apps → Noted → Notifications.

6.2 Calendar Permission

If you enable Google Calendar Sync, Noted requests read-only access to your Google Calendar via the Google Calendar API (not via Android Calendar permissions). We use only the Google OAuth flow and do not access the on-device Android Calendar content provider.

6.3 Internet Permission

Noted requires internet access to sync your data with the cloud, authenticate with Google, and fetch calendar events. This permission is standard for any app with cloud sync functionality.

6.4 Exact Alarm Permission (Android 12+)

On Android 12 and later, Noted may request the SCHEDULE_EXACT_ALARM or USE_EXACT_ALARM permission to ensure reminders fire at precisely the time you scheduled them. This permission is used solely for local reminder delivery.

6.5 Permissions We Do NOT Request

• Camera or microphone access
• Access to your photo library or files
• Contacts or address book access
• Location data (GPS or network-based)
• Phone call or SMS access

Data Security & Encryption

We take the security of your personal data seriously and implement industry-standard measures to protect it.

7.1 Transport Security

All data transmitted between the Noted app and our servers is encrypted using TLS 1.2 or higher (HTTPS). This ensures that your data cannot be intercepted while in transit.

7.2 Database Security

We use Supabase for our cloud database, which implements:

• Row-Level Security (RLS): Your data is isolated at the database level. Policies ensure that queries executed on your behalf can only access your own rows of data — even if someone were to attempt unauthorized access.
• Encryption at Rest: All database contents are encrypted at rest using AES-256.
• PostgreSQL-backed storage: Enterprise-grade relational database with security best practices.

7.3 Authentication Security

• Authentication is handled via Google OAuth 2.0 — no passwords are stored by Holokraft.
• Session tokens are short-lived and refreshed automatically.
• All API endpoints require valid authentication tokens.

7.4 On-Device Security

Local data stored on your device is protected by Android's standard storage security features, including app sandboxing. Noted does not request access to external storage and stores data only within its private app directory.

7.5 Security Breach Response

In the event of a data breach that affects your personal data, we will notify affected users within 72 hours of becoming aware of the breach, in compliance with GDPR requirements and applicable Indian data protection guidelines. Notification will be sent to the email address associated with your Google account.

Third-Party Services

Noted integrates with the following third-party services to provide its core functionality. Each has its own privacy policy which governs their use of data.

8.1 Google APIs & Google Play Services

Noted uses Google's services for authentication and calendar integration:

• Google Sign-In / Google Identity Services: For secure user authentication via OAuth 2.0.
• Google Calendar API: For read-only access to your calendar events (if you enable this feature).
• Google Play Services: For app distribution, updates, and in-app billing infrastructure (future).

Applicable Google Privacy Policy: https://policies.google.com/privacy

8.2 Supabase

Supabase is our backend-as-a-service provider. It handles our cloud database, authentication session management, and real-time data synchronization. Supabase processes data on our behalf under a data processing agreement.

• Supabase Privacy Policy: https://supabase.com/privacy
• Data is stored on servers hosted by AWS (Amazon Web Services).
• You can find Supabase's security and compliance documentation at https://supabase.com/security

8.3 Firebase (Future)

We may integrate Google Firebase services in the future for:

• Firebase Analytics: To understand aggregate App usage patterns and improve the product. Data will be anonymized and collected in aggregate form.
• Firebase Crashlytics: To receive anonymized crash reports that help us fix bugs quickly.

If and when Firebase is integrated, this Privacy Policy will be updated, and you will be notified through an App update notification and/or an in-app notice.

8.4 Data Processors

We do not sell, rent, or trade your personal data to any third party. We may share your data with service providers only as necessary to operate the App (e.g., Supabase for database hosting). These providers are contractually bound to process your data only on our behalf and in accordance with this Privacy Policy.

Analytics & Crash Reporting

9.1 Current State

As of the effective date of this Privacy Policy, Noted does not use any third-party analytics or crash reporting service. We do not currently track individual user behaviour or collect analytics data beyond what is necessary for basic service delivery.

9.2 Future Analytics Integration

We plan to integrate anonymized analytics (likely Google Firebase Analytics) in a future update to help us understand how the App is used in aggregate — for example, which features are most popular. This will allow us to make Noted better for everyone.

When analytics are introduced:

• Data will be anonymized and aggregated — we will not track individual user sessions in a personally identifiable way.
• You will be able to opt out of analytics collection through the App settings.
• This Privacy Policy will be updated, and you will be notified.

9.3 Future Crash Reporting

We may integrate Firebase Crashlytics for automated crash reporting. Crash reports will contain device information, Android version, and app state at the time of crash — no personally identifiable content from your notes, tasks, or lists will be included in crash reports.

Cookies & Local Storage

10.1 Android App

The Noted Android application does not use HTTP cookies. Authentication tokens and user preferences are stored in Android's SharedPreferences and app-private database storage, which are not accessible to other apps on your device.

10.2 Website

Our website at https://holokraftinc.github.io/noted/ is a static GitHub Pages website. It does not set cookies, does not use tracking pixels, and does not collect personal information from visitors. Any links to Google Play or external services are clearly marked.

10.3 Future Web Application

When a web version of Noted is launched, we will implement a cookie consent mechanism compliant with GDPR and ePrivacy Directive requirements. This Privacy Policy will be updated accordingly.

Children's Privacy

Noted is not directed at children under the age of 13 (or the applicable minimum digital consent age in your jurisdiction). We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@holokraftinc.com. We will take prompt steps to delete such information from our systems.

Users between the ages of 13 and 18 should have their parent or guardian review this Privacy Policy before using the App. By using the App, you represent that you are at least 13 years of age.

Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data. We are committed to honoring these rights for all users, regardless of jurisdiction.

12.1 Right to Access

You have the right to request a copy of the personal data we hold about you. To make this request, contact us at privacy@holokraftinc.com. We will respond within 30 days.

12.2 Right to Rectification

If any of your personal data is inaccurate or incomplete, you can update it directly within the App or by contacting us. Account information such as your display name is controlled by your Google account settings.

12.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data. You can delete your account and all associated data directly within the Noted app (Settings → Account → Delete Account) or by visiting our Account Deletion page. All personal data will be permanently deleted within 30 days of your request.

12.4 Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format. To request a data export, contact us at privacy@holokraftinc.com. We will provide your data in JSON format within 30 days.

12.5 Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

12.6 Right to Object

You have the right to object to our processing of your personal data for certain purposes. If you object to analytics data collection (once implemented), you will be able to opt out through the App settings.

12.7 California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt out of the sale of your personal information. (Note: We do not sell personal information.)
• The right to non-discrimination for exercising your CCPA rights.

To exercise your CCPA rights, please contact us at privacy@holokraftinc.com.

12.8 Exercising Your Rights

To exercise any of the rights described above, you may:

• Use the in-app settings and account management features in Noted.
• Email us at privacy@holokraftinc.com with the subject line "Privacy Rights Request".
• Visit our Contact page and submit a request.

We will verify your identity before processing any rights request and respond within the legally required timeframe (typically 30 days, or 45 days for CCPA).

Account & Data Deletion

You have the right to delete your Noted account and all associated personal data at any time.

13.1 How to Delete Your Account

You can delete your account using any of the following methods:

• In-App: Open Noted → Settings → Account → Delete Account → Confirm deletion.
• Web: Visit our Account Deletion page and follow the instructions.
• Email: Send a deletion request to privacy@holokraftinc.com from your registered email address.

13.2 What Gets Deleted

Upon account deletion, the following data will be permanently and irrecoverably deleted:

• All tasks, notes, smart lists, and reminders associated with your account.
• Your account profile data (name, email, profile picture).
• All app preferences and settings.
• Authentication credentials and session tokens.

13.3 Deletion Timeline

Account deletion is processed within 30 days of your request. During this period, the data is marked for deletion and becomes inaccessible. After 30 days, data is permanently purged from all our systems including backups.

13.4 Revoking Google Access

After deleting your account, we also recommend revoking Noted's access from your Google Account at Google Account Permissions.

For full details on the deletion process, visit our dedicated Account Deletion page.

Data Retention

We retain your personal data for as long as your account remains active and as long as necessary to provide you with our Services. Specifically:

• Active Account Data: Tasks, notes, lists, reminders, and account information are retained for the lifetime of your active account.
• Deleted Account Data: Permanently deleted within 30 days of your account deletion request, including from backups.
• Anonymized Analytics Data: Aggregate, anonymized usage statistics may be retained indefinitely as they contain no personally identifiable information.
• Crash Reports: Anonymized crash reports may be retained for up to 90 days for debugging purposes.
• Legal Hold: If we are required by law to retain certain data, we will retain it for the legally mandated period.

International Data Transfers

Holokraft is based in India. Our cloud infrastructure (Supabase/AWS) may store and process data in data centers located in other countries, including the United States and the European Union.

When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA.
• Data Processing Agreements with our service providers.
• Compliance with applicable Indian data protection regulations.

By using the App and agreeing to this Privacy Policy, you consent to the transfer of your personal data to countries outside your country of residence, where data protection laws may differ from those in your home country.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy.
• Notify you through an in-app notification or on our website.
• For significant changes affecting your rights, we may send a notification to your registered email address.

Your continued use of Noted after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you should stop using the App and may request deletion of your account.

We encourage you to review this Privacy Policy periodically. Previous versions of this policy are available upon request.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.