Last updated: February 22, 2026 · Effective: February 22, 2026
NoteBee is operated by Nikita Havrylenko, operating as NoteBee, based in Poland.
No Data Protection Officer (DPO) is designated, as this is not required under GDPR Article 37 given the nature and scale of our data processing.
This Privacy Policy covers:
NoteBee is a local-first application. Your notes, templates, snippets, and categories are stored on your Mac and are never synced to cloud servers. However, certain features — specifically AI text processing and translation — require transmitting selected content to third-party services to function. These are clearly identified in this policy.
NoteBee generates revenue exclusively through paid subscriptions. We do not sell, rent, or monetize your personal data or user content. We do not serve advertisements, engage in ad-based tracking, or share your data with advertising networks. Our business model is simple: you pay for the product, not with your data.
This policy complies with:
| Feature | Data Transmitted | Recipient | When |
|---|---|---|---|
| AI features (rewrite, summarize, grammar fix, expand, simplify, change tone, continue writing, custom instruction) | Selected text content | Google (Vertex AI / Gemini) | Only when you invoke an AI feature |
| AI translation | Selected text content + target language | Google (Vertex AI / Gemini) | Only when you choose AI translation mode |
| Basic translation | Selected text content + target language | Apple (Translation framework) | Only when you use basic translation |
Important:
| Data | Service Provider | Purpose |
|---|---|---|
| Email address | Google (Firebase Auth) | Authentication |
| Display name | Google (Firebase Auth) | Profile |
| Password | Google (Firebase Auth) | Authentication (hashed server-side) |
| User profile | Google (Cloud Firestore) | Account persistence |
| Subscription status | RevenueCat, Stripe | Payment processing |
| AI usage quota | Google (Cloud Firestore) | Credit tracking |
| Data | Legal Basis (GDPR) | Retention |
|---|---|---|
| Email address | Performance of contract (Art. 6.1.b) | Until account deletion |
| Display name | Performance of contract (Art. 6.1.b) | Until account deletion |
| Password (hashed by Firebase) | Performance of contract (Art. 6.1.b) | Until account deletion |
| Avatar URL | Performance of contract (Art. 6.1.b) | Until account deletion |
| Data | Legal Basis (GDPR) | Retention |
|---|---|---|
| IP address | Legitimate interest (Art. 6.1.f) — security | Managed by Google per Firebase terms |
| User agent string | Legitimate interest (Art. 6.1.f) — security | Managed by Google per Firebase terms |
| Sign-in timestamps | Legitimate interest (Art. 6.1.f) — security | Managed by Google per Firebase terms |
If you sign in with Apple or Google, we receive your email address, display name, and avatar URL via OAuth 2.0. We do not receive or store your Apple or Google password.
| Data | Legal Basis (GDPR) | Retention |
|---|---|---|
| AI credits used per billing period | Performance of contract (Art. 6.1.b) | Until account deletion |
| Per-request metadata: feature used, token counts (input/output), credit cost, timestamp | Legitimate interest (Art. 6.1.f) — service operation and abuse prevention | Rolling 90 days, then automatically deleted |
AI usage data does not include the content of your text. Only aggregate token counts and the name of the feature used are recorded.
| Data | Legal Basis (GDPR) | Retention |
|---|---|---|
| Subscription tier (free/pro) | Performance of contract (Art. 6.1.b) | Until account deletion |
| Billing interval, expiration date | Performance of contract (Art. 6.1.b) | Until account deletion |
| Payment transaction data | Performance of contract (Art. 6.1.b) | Managed by Stripe per their terms |
NoteBee offers optional AI features powered by Google Vertex AI (Gemini). These features process your selected text content on Google's servers and return the result to your device.
Before using AI features for the first time, NoteBee displays a notice explaining that your content will be sent to Google for processing. You must acknowledge this before AI features are enabled. You may decline and continue using NoteBee without AI features.
Google processes content under their Cloud Data Processing Addendum and Vertex AI terms. Google is contractually prohibited from using customer data submitted via Vertex AI to train its models. NoteBee has verified this restriction and monitors compliance through Google's published terms and data processing commitments.
All template content is stored in a local SQLite database at:
~/Library/Application Support/NoteBee/notebee.store
This data is never transmitted to any server.
No encryption keys are stored in the Keychain in this version (encryption features are not active).
NoteBee does not collect, transmit, or process:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account management | Email, display name, password | Contract (Art. 6.1.b) |
| Authentication | Email, sign-in metadata, third-party tokens | Contract (Art. 6.1.b) |
| AI text processing | Selected text content (only when you invoke AI) | Consent (Art. 6.1.a) |
| Basic translation | Selected text content (only when you invoke translation) | Contract (Art. 6.1.b) |
| AI usage tracking | Token counts, credits consumed | Legitimate interest (Art. 6.1.f) |
| Subscription management | Subscription tier, billing data | Contract (Art. 6.1.b) |
| Security | IP address, sign-in metadata | Legitimate interest (Art. 6.1.f) |
| Software updates | App version, macOS version, architecture | Legitimate interest (Art. 6.1.f) |
NoteBee never sees or stores your payment card details.
The app does not use cookies, tracking pixels, advertising identifiers, or any form of analytics or telemetry.
Only essential session cookies and TLS/HTTPS. No analytics, no advertising cookies, no social media tracking.
NoteBee is operated from Poland (EU). Primary data storage is in EU (europe-west). Safeguards for US transfers include:
| Data | Retention Period | Deletion Method |
|---|---|---|
| Account data | Until account deletion | Account deletion in Settings |
| Local templates and content | Until deletion or app uninstall | Manual or app removal |
| AI usage quota | Until account deletion | Account deletion |
| AI transaction logs | Rolling 90 days | Automatic |
| Subscription data | Until account deletion | Account deletion |
| Payment data (Stripe) | Per Stripe's retention policy | Contact Stripe |
| Diagnostic logs | Managed by macOS | Automatic rotation |
Free tier: Full editing, basic translation, 50 AI credits/month.
Pro subscription: 1,000 AI credits/month, processed via Stripe through RevenueCat.
NoteBee never sees or stores your payment card details. All payment processing is handled by Stripe. Subscription management (status, billing interval, expiration) is handled by RevenueCat.
NoteBee uses macOS unified logging (OS Log). Logs are stored locally on your device and are never transmitted to any server. Sensitive values (such as email addresses) are masked in log output.
NoteBee may request the following macOS permissions:
NoteBee does not request access to your camera, microphone, location, contacts, calendar, photos, screen recording, or full disk.
If you are in the EU/EEA, you have the following rights regarding your personal data:
Contact privacy@notebee.cloud to exercise your rights. We will respond within 30 days.
Supervisory authority: UODO (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl
NoteBee respects privacy rights under state laws in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, Minnesota, Maryland, Nebraska, New Hampshire, and New Jersey.
NoteBee does not:
To exercise your rights, contact privacy@notebee.cloud.
NoteBee is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact privacy@notebee.cloud.
This policy is written in plain language with clear headings to improve readability. If you need this policy in an alternative format, contact support@notebee.cloud.
| Version | Date | Changes |
|---|---|---|
| 1.0 | February 19, 2026 | Initial policy (local-only) |
| 2.0 | February 22, 2026 | Added AI features, Firestore, subscriptions, translation, Remote Config, App Check |
| 2.1 | February 22, 2026 | Added cookies section, expanded US state coverage to 17 states, data breach procedures, revenue model transparency, Do Not Track, CCPA notice-at-collection, accessibility section |