PenDate Notes

Privacy Policy

Published by PenDate Notes

Last updated: August 19, 2026

This Privacy Policy explains what information PenDate Notes ("the App") collects and processes, how that information is used, how it is protected, and the choices available to you. This policy applies to the PenDate Notes application available on Google Play for Android devices and on the App Store for iPhone and iPad.

At a Glance

  • PenDate Notes is an offline-first note-taking app. Core note-taking works without an account; store purchase and restore verification requires an internet connection.
  • Cloud sync via Google Drive is entirely optional and only activates when you choose to link your Google account.
  • When you purchase or restore paid items, limited store transaction data is sent to our cloud-hosted verification service and the relevant app store.
  • The App does not contain advertising SDKs, analytics SDKs, or crash-reporting SDKs.
  • We do not sell, rent, or trade your personal information to third parties.
  • On-device handwriting recognition runs locally on your device and does not send your writing to any server.

1. Information the App Processes

1.1 Content You Create

PenDate Notes stores the content you create or import, including:

  • Text notes, rich text notes, and note titles
  • Handwritten drawings, canvas strokes, and canvas page data
  • Checklists and checklist items
  • Photos captured with your camera and audio recordings you create within the App
  • Files you import (such as PDFs) and files you export or share
  • Events you create in the App and calendar events you choose to import
  • Reminder and scheduling information
  • Tags, folders, and organizational metadata
  • App settings and preferences (theme, language, calendar options)

By default, all of this information is stored only on your device in a local database.

1.2 Google Account Information (Optional Cloud Sync)

If you choose to link your Google account for cloud sync, the App uses Google OAuth 2.0 to request the following permissions (scopes):

Google API ScopeWhat It AccessesWhy It Is Needed
drive.file Files the App creates or opens in your Google Drive Upload and download your synced notes
drive.appdata A hidden app-specific folder in your Google Drive Store sync metadata (manifests, conflict snapshots) that you do not need to manage directly
openid, profile, email Your Google account ID, display name, and email address Identify your linked account and display it in the App's Settings screen

The App accesses only files it creates in your Google Drive. It does not read, modify, or delete other files in your Drive.

When you link Google Drive, the App receives and stores locally on your device:

  • Your Google account ID, display name, and email address
  • OAuth access and refresh tokens

This Google user data is used solely to provide the cloud sync feature. It is not transferred to any third party, used for advertising, used to determine creditworthiness, or used for any purpose unrelated to the sync functionality described in this policy.

1.3 Cloud Sync Data

When cloud sync is enabled, the App uploads note data and sync metadata to an app folder in your Google Drive. In some versions this folder may appear as "CalendarNotes" for compatibility with existing sync data. This includes:

  • Individual note files (JSON format) containing note content, metadata, and drawing data
  • Sync manifests and conflict-resolution snapshots
  • Database snapshots used for full-device sync

All data transmitted between your device and Google Drive is sent over HTTPS (TLS-encrypted connections).

1.4 On-Device Processing

PenDate Notes includes optional handwriting recognition and text recognition features powered by Google ML Kit. These features run entirely on your device. No handwriting data, canvas strokes, or recognized text is sent to any external server. Language models for recognition are either bundled with the App or downloaded once to your device for local use.

1.5 Public Holiday Data

The App can optionally display public holidays on your calendar. To provide this feature, the App sends your selected country code and calendar year to the Nager.Date public holiday API (date.nager.at). No personal information, account data, or note content is sent in this request.

1.6 Calendar Event Import

If you choose to import events from calendars on your device where platform access is available, PenDate Notes processes the event details needed to show those events in the App. This may include event titles, dates, times, and related calendar metadata from supported calendar providers such as Google Calendar, Samsung Calendar, Apple Calendar, or other calendars available through the device calendar system.

Calendar import is optional. Imported event data is used to display your schedule inside PenDate Notes and keep it close to related notes, reminders, checklists, and canvas pages.

1.7 Purchase Verification Data

When you make or restore an in-app purchase, the App sends a limited purchase-verification request to our cloud-hosted verification service, currently hosted on Firebase and Google Cloud. The request includes the store platform, application or package identifier, product identifier, transaction identifier, and store verification data (for example, an App Store verification value or Google Play purchase token). It may also include a purchase identifier, transaction date, verification source, and local verification data included in the request. The cloud host may also process standard technical request information, such as request time, IP or network information, and response status, to operate and secure the service.

We use this information only to validate the purchase or restore and return the entitlement status to the App. The App does not send your notes, synced Google Drive content, or payment-card details to the verification service.

2. How We Use Information

PenDate Notes uses the information it processes only to provide, maintain, and improve App features:

  • Storing and organizing your notes, drawings, and checklists on your device
  • Syncing your notes to and from your Google Drive when you enable cloud sync
  • Displaying your linked Google account name and email in Settings
  • Exporting, sharing, and importing note content when you initiate those actions
  • Creating events and importing calendar events when you choose to use those features
  • Scheduling and delivering reminder notifications
  • Recognizing handwriting on-device when you use that feature
  • Displaying public holidays on the calendar
  • Verifying in-app purchases and restores and returning whether the related entitlement is active
  • Saving and applying your preferences (theme, language, time format, calendar start day)

We do not use your data for advertising, profiling, or behavior tracking.

3. When Information Is Shared

PenDate Notes shares information only in the following circumstances:

  • Google Drive sync — If you choose to link Google Drive, your note data and sync metadata are transmitted to Google Drive to provide sync functionality. This transfer is governed by Google's Privacy Policy.
  • System sharing and export — When you use the share or export features, the App passes the content you selected to the system share sheet or file picker. The receiving app is determined by your choice.
  • Holiday data request — The App sends a country code and year to Nager.Date to retrieve public holidays. No personal data is included.
  • Calendar event import — If you import events from calendars on your device where platform access is available, the App reads the selected calendar event data needed to show those events inside PenDate Notes. This data is not used for advertising or profiling.
  • Purchase verification — Our cloud-hosted verification service checks the purchase record with the relevant store. For App Store purchases, it sends the transaction identifier and app identity to Apple's App Store Server API. For Google Play purchases, it sends the package and product identifiers and purchase token to Google's Android Publisher API. See Apple's Privacy Policy and Google's Privacy Policy.
  • Legal requirements — Information may be disclosed if required to comply with applicable law, regulation, or legal process.

We do not sell, rent, or trade your personal information. We do not transfer Google user data to advertising platforms, data brokers, or information resellers.

4. Data Security

PenDate Notes implements the following measures to protect your data:

  • Encrypted token storage — Google OAuth tokens are stored using Android's EncryptedSharedPreferences (AES-256 encryption) and iOS Keychain, provided by the flutter_secure_storage library.
  • Secure transport — All communication with Google Drive and other network services uses HTTPS (TLS-encrypted connections). The App does not transmit data over unencrypted channels.
  • Store-side verification — The purchase-verification service validates ownership directly with Apple or Google. It does not trust a client-reported purchase without an authoritative store response.
  • Local-first storage — Note content is stored in a local SQLite database on your device. No remote server managed by PenDate Notes holds your note data.
  • No third-party tracking — The App does not include advertising SDKs, analytics trackers, or crash-reporting services that would transmit data to third parties.
  • On-device AI processing — Handwriting and text recognition run locally and never send your content to an external server.

5. Data Storage and Retention

Local Data

Notes, settings, and all other app data remain on your device until you delete them, clear the App's data, or uninstall the App. Deleted notes are moved to a Recycle Bin within the App and can be permanently removed from there.

Google Drive Sync Data

If you enable cloud sync, copies of your synced notes are stored in your Google Drive account. This data remains in your Google Drive until you delete it from Drive.

Unlinking your Google account in the App removes the local session data (tokens and account information) and stops future syncing, but it does not automatically delete files already stored in your Google Drive. You can delete those files directly from Google Drive at any time.

Google OAuth Tokens

When you unlink your Google account, the App deletes the locally stored OAuth tokens from encrypted storage. You can also revoke the App's access to your Google account at any time through your Google Account permissions page.

Purchase Verification Data

The verification service processes purchase identifiers and verification data transiently to complete each verification request. It does not write transaction identifiers, purchase tokens, or verification payloads to a PenDate Notes application database. Firebase and Google Cloud may retain limited operational and security records according to the project's cloud configuration and Google's applicable terms. Apple and Google may retain store transaction records under their own policies and legal obligations.

6. Your Choices and Controls

You have full control over your data:

  • Use offline only — Use the App without linking any cloud account. No internet connection is required for core note-taking features.
  • Enable or disable cloud sync — Link or unlink Google Drive at any time in Settings.
  • Delete notes — Delete individual notes or clear all notes from within the App.
  • Delete synced data — Delete synced files directly from your Google Drive account.
  • Revoke Google access — Remove the App's access to your Google account at myaccount.google.com/permissions.
  • Clear app data or uninstall — Clear the App's local storage or uninstall it to remove all locally stored data.
  • Manage permissions — Grant or revoke device permissions (camera, microphone, notifications, storage) through your device's Settings at any time.

7. Device Permissions

PenDate Notes may request the following device permissions. Each permission is requested only when you use the feature that requires it:

Internet & Network State Required for optional Google Drive cloud sync, public holiday data retrieval, and purchase verification.
Camera Used when you choose to take a photo to insert into a rich text note. Not required for basic note-taking.
Microphone Used when you choose to record an audio clip to embed in a rich text note. Not required for basic note-taking.
Notifications & Alarms Used to deliver reminder notifications at the date and time you schedule. Includes exact alarm and boot-completed permissions to ensure reminders persist.
Calendar Access Used only when you choose to import events from supported calendars on your device where platform access is available.
Vibration & Wake Lock Used to alert you when a scheduled reminder fires.
Storage / File Access Used when you import files (such as PDFs), export notes, or save shared content. On Android 10+, the App uses scoped storage and the system file picker (SAF).

All permissions are optional. The App's core offline note-taking features work without granting any of these permissions except notifications (for reminders).

8. Google API Services — Limited Use Disclosure

PenDate Notes' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • The App uses Google Drive and account data only to provide cloud sync and account display. Google Play purchase data is used only to verify Google Play purchases and restores.
  • The App does not transfer Google user data to third parties except as necessary to provide the applicable sync or purchase-verification feature, for security purposes, or to comply with applicable law.
  • The App does not use Google user data for serving advertisements, retargeting, or interest-based advertising.
  • The App does not allow humans to read your Google user data unless you provide affirmative consent, it is necessary for security or legal compliance, or the data is aggregated and anonymized for internal operations.

9. Children's Privacy

PenDate Notes is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe that a child under 13 has provided personal information through the App, please contact us so we can take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App's features or applicable legal requirements. The updated version will be posted at this page with a revised "Last updated" date. We encourage you to review this policy periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the App's data practices, you can reach us at:

Email: pendate.notes@gmail.com

You can also visit the support page for setup help and guide links.