Privacy Policy

1. Privacy Principles & Architecture

Driftnote is built from the ground up on privacy-by-design and local-first architecture ("A quiet place for your thoughts"). Your notes, voice dictations, folder structures, and reflection histories belong strictly to you. By default, your data stays on your device inside an encrypted container.

2. Information We Collect & Device Permissions

• Waitlist Email: When you sign up on our public web waitlist at driftnote.tech, we collect your email address solely to notify you of availability. Waitlist submissions are stored in a write-only Firestore database. We never sell, share, or market your email to third parties.
• Voice & Audio Dictation: When you use voice capture, audio is recorded locally to your device’s application sandbox. We require the RECORD_AUDIO permission only when you explicitly press the dictation trigger. We do not engage in background listening.
• Journal & Reflection Content: Your text notes, voice transcripts, and tags are stored locally in an encrypted Room SQLite database.
• Account Information: If you choose to enable cross-device cloud sync, we utilize Google Firebase Authentication (Email/Password or Google Identity) to generate a unique, cryptographically isolated space for your data.

3. Local Storage & Hardware Encryption

On Android devices, Driftnote encrypts local database files using SQLCipher (AES-256). The 256-bit encryption passphrase is generated dynamically and protected by the hardware-backed Android Keystore System (Secure Enclave / TEE). Database files are strictly excluded from automated cloud backups to prevent unrecoverable decryption states.

4. Zero-Leak AI Reflection (Google Gemini)

Driftnote uses Google Gemini API (via Firebase Vertex AI) to provide optional transcription, mood reflection, and cognitive pattern highlights.

• All AI payloads are transmitted over encrypted TLS connections.
• Zero-Retention & Training Policy: User notes and voice transcripts are never stored permanently by AI servers and are never used to train public foundation models.
• Payloads are hashed using SHA-256 to prevent duplicate processing and conserve network resources.

5. Cloud Synchronization & Infrastructure

When signed into Cloud Sync, your notes sync with Google Cloud Firestore over secure TLS connections. Our Firestore Security Rules enforce strict owner-only access (/users/{uid}). No other user or unauthorized process can read, write, or query your synced records.

6. Analytics & Crash Reporting

We utilize Firebase Analytics and Crashlytics solely to monitor performance and app stability. Our integration adheres to a strict Zero-Content Logging Policy. We never log note titles, text contents, voice transcripts, AI summaries, or personal identifiers. Only non-sensitive structural events (e.g., app launches, sync completion status) are logged.

7. User Rights & Data Control

You have complete authority over your data:

• Deletion: Deleting a note instantly removes local audio files, database records, and synced cloud copies.
• Sign-Out & Wipe: Signing out or clearing app data completely purges all local offline stores.
• Waitlist Removal: You can request immediate removal from the waitlist by emailing kephagathata@gmail.com.

8. Children’s Privacy

Driftnote is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

9. Contact & Data Protection

For any privacy questions, data deletion requests, or security inquiries, please contact our data team at:

Email: kephagathata@gmail.com
Web: driftnote.tech/privacy