Privacy Policy

Last updated: July 23, 2026

VibeNote ("we", "our", or "us") is operated by ServePoint / DigiForce Business. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices and rights you have. It applies to the VibeNote iOS and Android apps.

1. What VibeNote Records on the Free Plan — Nothing Leaves Your Phone

When you tap the record button, audio is captured on your device and transcribed locally using a Whisper speech-to-text model bundled with the app. The transcript, summary, custom vocabulary and any flashcards or quizzes you generate from a transcript are written to your phone's local database. On the free plan none of this audio is sent to our servers.

If you subscribe to Premium, finished recordings are uploaded to your private cloud storage for faster and more accurate transcription, as described in section 2. This is part of what Premium provides — if you would rather keep every recording on-device, stay on the free plan or delete the note before it uploads. Separately, importing a document sends its extracted text to our AI provider to produce the summary, on any plan.

2. Information We Collect (Only When You Opt In)

Account information (when you sign in)

• Email address and display name, obtained from your Google, Apple, or email sign-in.
• A Firebase-issued user identifier (uid). This identifier is what we use to alias all the data below to you.

Audio recordings (only with Premium cloud transcription)

• If you record on the free plan, audio stays on your phone forever. We never see it.
• If you're a Premium user, after each recording finishes, the audio file is uploaded to your private Cloud Storage bucket at users/<your uid>/uploads/<noteId>/ for cloud transcription. The file is automatically deleted from our servers once transcription completes (typically within minutes).

Imported documents (PDF, Word, PowerPoint)

• When you import a document, its text is extracted on your device — the file itself is never uploaded. The extracted text is stored locally like any other note.
• To write the summary, that extracted text is sent to OpenAI's API for a single request and the summary is returned to your device. This applies to all signed-in users, including the free plan — unlike audio, where cloud processing is Premium-only. OpenAI does not retain the data for training under their API data usage policy.
• If you are not signed in, or the request fails, VibeNote falls back to an on-device summary and no document text leaves your phone.
• We do not store the document text on our servers. It is held in memory only for the duration of the summary request.
• Only import documents you have the right to share. Do not import confidential or third-party material you are not permitted to process with an external AI provider.

Transcripts and summaries (only with cross-device sync)

• If you turn on Keep notes on all my devices in Settings, the text of your transcripts and summaries (not the audio) is mirrored to a private Firestore document at users/<your uid>/notes/ so your other signed-in devices can see them. Nobody else can read this data — Firebase Security Rules enforce uid-only access.
• If sync is off (the default), your notes never leave your phone.

AI Chat conversations

• Chat messages you send and the assistant's replies are stored on your device. When you ask a question, the relevant note context is sent to OpenAI's API for that one request; OpenAI does not retain the data for training under their API data usage policy.
• For accounting (free-tier monthly cap), we track only a per-user message counter at users/<your uid>/usage/<YYYY-MM>.chatMessages — a number, not the message contents.

Translation

• When you tap Translate on a transcript, the transcript text is sent to OpenAI's API for translation. The translated version is stored on your device (and synced if sync is on).

Speaker labels

• If you enable Label who is speaking, cloud transcription is routed through Deepgram's diarization API instead of OpenAI Whisper, so different speakers can be tagged separately.

Subscription & entitlement state

• RevenueCat verifies your subscription receipt with the App Store / Play Store and tells our backend whether you have an active Premium entitlement. RevenueCat receives a hashed user identifier; we never see your billing details (Apple / Google handle payment).

Calendar data (optional)

• If you connect Google Calendar or Microsoft Outlook, we fetch upcoming event titles, times and locations on demand. Calendar data is never stored on our servers — it lives in memory only while the Calendar tab is open.

Meeting recordings (optional)

• If you use the Meeting bot to send a transcriber into a Zoom, Meet or Teams call, the call audio is captured by Recall.ai and routed into the same private Storage bucket as your manually recorded files. You are responsible for obtaining consent from meeting participants.

Push notification tokens

• If you grant notification permission, Firebase Cloud Messaging gives us a device-specific push token so we can notify you when a cloud transcript or summary is ready.

Diagnostic information

• If a cloud operation fails, we log the error type, a Firebase request id, and the time, so we can debug. Logs do not contain the contents of your recordings, transcripts, or chat messages.

3. What We Do NOT Collect

• We do not collect contacts, photos, location, browsing history, or device identifiers beyond what's strictly needed for the features above.
• We do not use any third-party analytics or advertising SDKs.
• We do not sell, rent, or share your personal data with any advertiser, data broker, or third party for marketing.
• We do not use your recordings, transcripts, or chat messages to train machine learning models.

4. How We Use Your Information

• To run on-device recording and transcription (entirely local).
• To run optional cloud features you've turned on — high- accuracy transcription, AI Chat, translation, speaker labels, cross-device sync.
• To summarise documents you choose to import, by sending their extracted text to our AI provider for that one request.
• To verify your subscription entitlement so Premium features unlock.
• To send push notifications when something is ready for you.
• To diagnose and fix bugs.
• To enforce monthly limits (cloud minutes for Premium, AI Chat messages for free).

5. Google API Services User Data Policy

VibeNote's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we request the calendar.readonly scope so you can see upcoming meetings in the app and tap one to start recording. We only read event titles, times and locations. We do not modify, create or delete calendar entries; we do not transfer calendar data to any third party; we do not use calendar data for advertising; and we do not allow humans to read your calendar data unless you give explicit consent for support purposes.

6. Microsoft Graph Permissions

If you connect Outlook, we use the Calendars.Read scope to fetch your upcoming events for the same purpose. The OAuth tokens are stored only on your device. Calendar data is never persisted to our servers.

7. Third-Party Processors

The following sub-processors may receive your data in the course of providing VibeNote, each under their respective privacy terms:

• Firebase (Google): Authentication, Firestore (sync), Cloud Storage (audio uploads), Cloud Functions (server logic), Cloud Messaging (push notifications).
• OpenAI: Cloud Whisper transcription, GPT-4o editorial summary (for recordings and for imported documents), GPT-4o-mini AI Chat, and translation. Data sent to OpenAI's API is not retained for training under their API data usage policy.
• Deepgram: Speaker diarization, used only when you turn on "Label who is speaking".
• RevenueCat: Subscription receipt validation and entitlement state.
• Recall.ai: Meeting-bot recording, used only when you explicitly send a bot into a meeting.
• Apple: Sign in with Apple, App Store payments, push delivery (iOS only).
• Google Identity / Microsoft Identity: OAuth sign-in for calendar integrations.

8. Data Storage & Retention

• Audio, transcripts and summaries are stored on your device by default and remain there until you delete them or uninstall.
• Uploaded audio is removed from Cloud Storage automatically after transcription completes (minutes).
• Cloud-synced transcripts, summaries, and chat messages live in Firestore until you delete the account or turn sync off.
• OAuth refresh tokens for Outlook / Google are stored on-device only.
• Subscription receipt data is retained by RevenueCat for the active subscription period plus their standard archival window.

9. Deleting Your Account

Open VibeNote → Settings → Delete my account. You will be asked to confirm. The deletion runs server-side and wipes:

• Every Storage object under users/<your uid>/ — including audio files still being processed.
• Every Firestore document under users/<your uid> — synced notes, chat messages, usage counters.
• Your Firebase authentication record.

Notes that only ever lived on your phone stay on your phone until you uninstall — we were never able to see them. If you prefer to request deletion by email, write to digiforcebusiness@gmail.com and we'll do it manually within 7 business days.

10. Your Rights (GDPR / CCPA)

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (see the in-app flow above or email us).
• Object to or restrict certain processing.
• Export your data in a portable format.
• Opt out of the sale of personal information (CCPA) — we do not sell personal information.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email digiforcebusiness@gmail.com from the address tied to your account.

11. Children's Privacy

VibeNote is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has signed up, email us and we will delete the account.

12. International Transfers

Your data may be processed in the United States or other countries where our sub-processors operate. Where data is transferred out of your home region, we rely on standard contractual clauses or equivalent safeguards.

13. Changes to This Policy

We may update this policy as VibeNote evolves. Material changes will be notified in-app or by email. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

Questions about this policy? Email digiforcebusiness@gmail.com or open the Support page from inside the app.