nostellaWho is responsible
Nostella is provided by thunderflow x, based in India. This policy applies to the Nostella app, optional cloud sync, and our website at https://nostella.app. It takes effect on 2026-09-18.
For privacy questions or requests, email support@nostella.app. You do not need a Nostella account to use the app locally or contact us.
The notebook on your device
The app stores notes, drawings, selected images, voice memos, transcripts, reminders and preferences on your device. You can use it without signing in. If you create an account, we store your email, chosen locale, profile details, provider identifiers, trial and subscription state, storage usage, sync revisions, and object relationships in PostgreSQL. Your App Store storefront determines purchase currency; the signup locale controls language and formatting.
Cloud sync starts only after you consent. The app encrypts note records and media on your device before placing them in private Azure Blob Storage. PostgreSQL stores opaque blob identifiers and relationship metadata, not note text or media bytes. The account sync key stays on your device and is wrapped with a recovery key that you must keep; Nostella staff cannot decrypt cloud content or replace a lost recovery key. Profile pictures are encrypted cloud assets too.
On iOS, local database records use SQLCipher and managed media uses iOS Data Protection, which permits access after the first device unlock. Your device or operating-system backup settings can affect local copies. Keep the copies you need and review those settings.
Permissions have a purpose
- Microphone: to record a voice memo when you start recording.
- Speech recognition: to create transcripts. Nostella requests on-device recognition; availability depends on the platform, device and language. You can record a memo when transcription is unavailable.
- Selected photos: to attach images, choose covers and create image-based themes.
- Notifications and scheduling: to deliver local reminders. Android may ask for exact-alarm permission for precise timing.
- Device authentication: to open protected notes or sections. The operating system handles biometric authentication; Nostella receives the authentication result, not your biometric template.
You can review or revoke permissions in your device’s settings. Features that depend on a denied permission may become unavailable; writing ordinary notes does not require microphone or speech permission.
Ink reacts to the moment
Living Ink responds to activity such as writing, sketching, recording or searching. The companion’s activity controller receives the current activity and whether work is happening. It does not receive your note text, recording, drawing strokes or a history of your taps.
Ink’s changing shapes and expressions are interface animation, not a service that reads or interprets your private notes.
This website and your messages
Nostella does not add its own analytics tracker, advertising tracker or tracking cookies to this website. The interactive notebook demonstrations run in your browser’s memory. They do not use your microphone or upload the words and marks you try in the demo. Reloading the page clears the demonstration content.
The iPhone Duo 3D demonstration loads its model and example app screens from this website as the demonstration approaches your screen. It runs in your browser and pauses rendering when it leaves view. It does not connect to a third-party model viewer. Words or marks you enter in the notebook demo, and your waitlist details, are not sent to the 3D demonstration. Leaving the page closes it.
If you join the early waitlist, the website sends the email address you enter and your agreement to receive early access and launch updates to our editorial CMS. We store the address, the time you agreed, and whether you joined from the homepage. Editors can see these entries to manage the waitlist. Joining does not create a Nostella app account, and we do not send your notebook content. Ask support@nostella.app to remove your entry.
Serving the website and receiving a waitlist request requires your browser to send technical request information, including its IP address and browser request details, to the hosting infrastructure. Such information may be processed to deliver the service, maintain security and diagnose faults; the waitlist entry itself does not store your IP address.
If you email us, we receive the address you write from, your message and any attachments you choose to send. We use them to respond, investigate the issue, handle your request and maintain relevant support records. Do not send passwords, recovery secrets, private recordings or a complete notebook. Redact screenshots wherever possible.
Providers that deliver the website, CMS or support email process information needed for those services. We do not use support messages to build advertising profiles or enrol you in marketing.
Protection, retention and deletion
Protected local notes retain their separate lock or hidden access controls. Cloud content is encrypted before upload with a separate account key. We cannot decrypt your cloud notes, images, recordings or transcripts. Losing your recovery key and all signed-in devices can make cloud content unrecoverable.
Supported local deleted items remain in Recently Deleted for 30 days unless you permanently remove them sooner. For cloud sync, a seven-day trial starts at account creation. When trial and paid access end, uploads stop; deliberate download remains available for a 30-day grace period and seven-day final warning. An hourly server job removes active cloud content at or after day 37 unless paid access is restored. You can delete cloud content or your account sooner in the app. Local notes remain on your device. Deletion from the active cloud service is not secure physical erasure: encrypted infrastructure backup copies can remain for up to 30 days after active deletion under our configured backup retention policy. Device backups, exported files and recipients’ copies are separate.
We keep account and subscription records while your account exists and remove them when account deletion completes, subject to the separate infrastructure backup window and legal obligations. We keep waitlist and support records for their stated purposes; ask support@nostella.app to remove or review them. See Data & Deletion for controls and limits.
Your choices and questions
You can change permissions, edit your profile and locale, stop cloud sync, delete local content, deliberately download cloud content during recovery, delete active cloud content, and delete your account in the app. Deleting an account does not cancel an App Store subscription; manage or cancel renewal separately through Apple. Depending on applicable law, you may have other access, correction, deletion, restriction, objection or complaint rights.
Email support@nostella.app with enough detail to identify a request. We may ask for proportionate verification before disclosing or deleting correspondence. We will not ask for a vault password, recovery key or notebook contents.
Nostella is a general-purpose notebook. If a child has sent personal information to support or the waitlist, contact us using the same address.
Keeping this explanation current
We may update this policy as the app, website or applicable requirements change. We will publish the revised policy here with its effective date and provide any additional notice or choices required by applicable law. Adding a new data use requires an updated explanation; the current policy does not authorise unspecified future collection.