Privacy Policy

Effective date: November 24, 2026 Last updated: November 24, 2026

This Privacy Policy describes how Femi Studio LC ("KeptNote," "we," "us," or "our") collects, uses, and shares personal information when you visit https://keptnote.com (the "Site") or use the KeptNote service (the "Service").

If you do not agree with this policy, please do not use the Site or the Service.

1. Who we are

Femi Studio LC is a Maryland limited liability company.

We are the controller of the limited personal information described in this policy: information about visitors to the Site and people who join the waitlist or write to us, and people who buy, give, or receive a KeptNote license, and people who use the App’s online features described below.

KeptNote is local-first software. The recordings, transcripts, and notes you create with the App are stored on your own devices, and your audio recordings never leave them. Two optional features, sync and share links, place a copy of your notes on our servers, but only after your device has sealed it with a key we never receive, so we cannot read it. We can read meeting content only if you send it to us yourself, for example by attaching a note to feedback. This policy covers the Site, the App’s online features, and our communication with you.

2. Information we collect

Information you provide to us:

• Waitlist and contact information: your email address and whatever you choose to write to us.
• Purchases: when you buy a license on the Site, you pay Paddle.com, our reseller and Merchant of Record, on a checkout it runs. Paddle.com collects your email address, payment details, billing country and postal code, and your network (IP) address, to take the payment, work out tax, and prevent fraud. We never receive your card details. From Paddle.com we receive your email address, the customer and transaction numbers it gives us, and the price, tax, and currency of your purchase, so we can issue and support your license.
• Purchases in the iPhone or Android app: Apple or Google Play takes the payment. On iPhone the App sends us the purchase record that Apple signed; from Google Play we receive the purchase token, product, order number, purchase time, and country or region. Either arrives together with the device code of the phone that bought it. We keep Apple’s price, currency, and storefront for the sale. We check the purchase with Apple or Google before issuing your license, and they tell us later about a refund or chargeback. We never receive your payment details, your Apple Account, or your Google Account.
• Gifts: if you buy a gift, the recipient’s first name, their email address (only if you choose to have the gift emailed), the delivery date and time zone, your name as you want it shown, your message, the card style, and your choices about notices, together with a hashed form of your network address, used to limit how many gifts can be bought from one place. If you redeem a gift, the email address you redeem it with, which becomes the email address of your license, and any thank-you note you choose to write to the buyer.
• Trial reminders: if you ask the App to email you about your trial, the email address you give. We send nothing but a confirmation until you confirm it, and every reminder has a one-click unsubscribe.
• KeptNote for Teams: if you join its waitlist or write to us about it, your work email address, your name if you give it, your company’s name and size, the devices you use, what you want from AI and compliance, and any note you add.
• Feedback you send from the App: what you write, your email address if you give it, a name to show if you let us quote you, up to three screenshots or screen recordings you attach, a diagnostics file if you choose to include it (the App’s logs: times, counts, and error codes, with no titles, names, or note text), the App version and the screen you sent it from, and a one-way code for the install, used only to limit repeat sending. If you rate a note and turn on Include this note, the note’s text is sent as well, in readable form. Nothing is sent until you press Send.
• Crash reports you choose to send: if the App quits unexpectedly on a computer or a phone, it can show you a crash report the next time it opens. Nothing is sent on its own. A report is sent only if you press Send, after you have been able to read every line and remove any line. A report contains the App and operating system versions, the kind of device (such as “Mac with Apple silicon” or “Android phone”), the time of the crash to the minute in UTC, technical details of the crash (the error type and where in the App’s own code it happened), and a few recent lines from the App’s own diagnostic logs, with names, titles, email addresses, phone numbers, file paths, web addresses, network addresses, and keys taken out on your device before you see it. It never contains your recordings, transcripts, notes, meeting titles, or the names of people, and it carries no device code, license, or account. We store it on our servers with a random report number and the time it arrived, use it only to find and fix problems in the App, do not keep the network address it came from, and delete it 90 days after we receive it. To stop being asked, choose Never ask in the App’s Settings.
• Communications with us: support requests, emails, and feedback.

Information the App sends to our servers. The App has no account and no analytics. It contacts our servers only for the purposes below and sends only what is listed.

• License and trial: a one-way code made from your device’s hardware or install identifier (never the identifier itself), the platform, the App version, and a name for the device. On a Mac the name starts as the computer’s name from System Settings, and on a Windows PC as the PC’s name; on either you can change it in the App. On a phone it is the model, such as “Google Pixel 9”. With them go your license key, or the code you typed to add a phone, and the signed license or trial token the App already holds. We use these to start your 14-day trial, count the devices on your license, and let you remove one. Your Apple Watch or Wear OS watch never contacts us.
• The license check: when the App opens and about once a day, never while it is recording, it sends its token, a one-use challenge our server has just given it, the device code, the platform, and the App version and build. On iPhone it also sends evidence from Apple’s App Attest service that the request comes from the genuine App. We keep the version, the build, the time, and whether that evidence passed.
• Trial extension: if you accept the one-time offer of 14 more days on a computer or an Android phone, we record that the extension was given to that device, and when. On iPhone the extension is a free App Store item, so Apple records it.
• Trial feedback: if you answer “What would make KeptNote worth it?”, your words and the platform, kept with the date only, with no device code, license, or network address.
• Version check: the App asks which versions are supported and whether its version has a known problem, sending only its platform.
• Report a problem sends nothing itself. It opens an email in your own mail app, filled in with the App version, build, platform, and kind of device, which you can edit or not send.
• Speech model download (Windows): if you choose the larger speech model in Settings, the App downloads it from keptnote.com. The request carries nothing about you or your meetings.
• Network address: our servers see your network (IP) address on every request, as any server does. We do not store it with any of the records above. To limit abuse, some requests keep a one-way hash of it for at most a day. The waitlist and Teams forms on the Site are the exception: they keep a keyed one-way hash of it (not the address) with your entry, only to limit repeat sign-ups from one place, and it is deleted with the entry.

Sync, if you turn it on. Sync is off until you turn it on. It copies your notes, transcripts, and the organization of your library between your own devices through our relay server. Audio recordings are not synced. Each record is sealed on your device with AES-256-GCM under a key that exists only on your devices and in the recovery code you keep. We never receive that key, and we cannot read a title, a note, a transcript, or a speaker’s name. To deliver records, the relay necessarily sees: a public identifier for your library, one-way hashed record names, each record’s size and kind, the random meeting identifier it belongs to (never a title), when it was edited and which of your devices made the change, when each device syncs, your network address, and a one-way code for the license or trial device that made the library eligible.

Share links, if you make one. A share link needs a license. The App seals the note on your device and uploads only the sealed copy. The key is in the part of the link after the # sign, which browsers never send to a server. We store the sealed copy, its size, when it was made, and when it expires, and no network address or device code. Anyone who has the link can read the note until it expires or you revoke it.

Information the App keeps on your device (and what we cannot read):

• Meeting audio you choose to record, the transcripts produced by on-device transcription, your notes, templates, recipes, folders, and settings. They are stored in the App’s library on each device you use: your user folder on a Mac or Windows PC, and the App’s private storage on a phone. Apart from sync and share links, described above, they stay there.
• On Apple Watch and Wear OS, a recording made on the watch goes only to your own paired phone, and the watch deletes its copy once the phone confirms it has the meeting. The watch apps make no connection to us.
• Which features are on, including any Labs choices, is stored only on that device. It is never synced and never sent to us.
• Notifications, such as the Your month note on the 1st of each month that last month’s Reef map is ready, are scheduled on the device. None passes through us, and the Your month note names only the month. You can turn it off in Settings.
• Share cards and holiday cards are drawn on the device, with names left out unless you choose to show them. The App uploads none of them; an image leaves your device only if you share or save it yourself.
• If you turn on meeting reminders, the App reads your calendar on the device. Calendar events are never sent to us.
• Crash reports waiting for your decision stay on your device for up to 30 days and are then removed.
• If you turn on the optional AI enhancement, you choose an AI provider and supply your own API key. When it runs, the App sends your note and transcript directly from your device to that provider, under your own account and their terms. We are not a party to that transfer, we do not see the content, and the feature is off by default. Your key is stored only in your device’s secure storage: the Keychain on Apple devices, the Android Keystore, or Windows Credential Manager.

Information collected automatically:

• Server logs: when you visit the Site, our hosting provider, Cloudflare, processes your network (IP) address, browser type, and the page requested, to deliver it and to protect the Site from attacks. We do not use them to build a profile of you.
• No analytics and no trackers: the Site and the App use no analytics, no advertising trackers, and no tracking pixels, and the Site sets no cookies of its own. A few pages remember a choice, such as whether sound is on or which step of a purchase you reached, in your browser’s own storage, which is not sent to us.
• The payment page: when you press Buy, or pay for a gift, on the Site, the page loads the checkout of Paddle.com, which may set its own cookies and collect information about your device to complete the payment and prevent fraud. These are strictly necessary for the purchase. Until you do, and on the rest of the Site, nothing from Paddle.com is loaded.

3. How we use information

We use personal information to:

• Provide, operate, maintain, and improve the Site and the Service;
• Run the waitlist and tell you when KeptNote is available or meaningfully updated;
• Issue, check, and support licenses and trials, process payments, and send transactional messages;
• Run sync and share links for you, without being able to read what they carry;
• Find and fix problems in the App, using the crash reports and feedback you choose to send;
• Provide customer support;
• Monitor for security, prevent fraud and abuse, and enforce our terms;
• Comply with legal obligations.

Gifts. We use a gift’s details only to deliver it, to remind the recipient before it ends, and to tell the buyer what happened to it. Gift emails carry no tracking pixels and no tracked links. The buyer is told when the gift is delivered (which means the recipient’s mail server accepted it), if it bounces, if the recipient says it is not for them, and, if the buyer asked, when it is redeemed. The buyer is never told whether the recipient opened an email, clicked a link, or looked up the code.

AI processing. We run no AI processing on your meeting content. Transcription and the built-in note writer run entirely on your device, using models that come with the App or with your device’s operating system. We cannot read sealed sync or share-link copies, so they cannot be used for AI either. We train no models on your content. The optional bring-your-own-key enhancement, when you enable it, is a direct relationship between you and the provider you chose; their privacy terms govern that processing. We do not sell personal information.

4. How we share information

We share personal information only with:

• Subprocessors and service providers that help us deliver the Service (hosting, email delivery, payments, and security). Each is bound by contractual obligations to protect the information and use it only to provide services to us. Our servers, databases, and storage, including the sync relay, share links, and crash reports, run on Cloudflare, and our email is sent through Resend. None of them can read your meeting content (except text you choose to send us, such as a note you include with feedback): they hold sync and share-link copies only in sealed form.
• Paddle.com, our reseller and Merchant of Record. It sells you the license, so for your purchase it is an independent controller under its own privacy policy at https://www.paddle.com/legal/privacy, not a service provider acting for us. We tell it which checkout a payment is for, using an internal reference, and it tells us whether a payment, refund, or chargeback happened. We tell it whether a purchase is a gift, but never the recipient’s name or email address, or your message.
• Apple, Google, and Microsoft, which run the App Store, Google Play, and the Microsoft Store. When you get the App through one of them, or buy a license through Apple or Google Play, it acts under its own terms and privacy policy and decides what it collects. Apple and Google tell us about a purchase so we can issue your license, and about a refund or chargeback so we can end it. Microsoft delivers the Windows App and its updates; licenses for Windows are bought on the Site.
• The other person in a gift. The recipient sees the name the buyer typed, the message, and the card. The buyer receives the notices described above and any thank-you note. The buyer never sees the email address the recipient redeems with, and the recipient never sees the buyer’s email address, unless the recipient chooses to let the buyer reply to a thank-you note, which shares the recipient’s email address with the buyer.
• Legal and safety recipients, where required by law, subpoena, or to protect rights, safety, or the integrity of the Service.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. Data retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Waitlist emails are kept until you unsubscribe or ask to be removed, or until launch communications end. License records (your email address, the customer and transaction numbers Paddle.com gives us, and the price, tax, and currency of the sale) are kept for as long as the license exists, and after that for as long as tax, accounting, and consumer law requires us to keep records of a sale. Payment notification records are deleted after about 13 months. Paddle.com keeps its own purchase records under its privacy policy. For a gift, the sale record (the buyer’s email address, the numbers and amounts above, and the gift’s status and dates) is kept like a license record and holds no details of the recipient. The recipient’s email address is deleted as soon as the gift is redeemed or ends, whether it expires, is cancelled, or is refunded. The recipient’s first name and the message are deleted 90 days after the gift is redeemed, ends, or is refunded, and a thank-you note no later than 90 days after it is sent. Gift details for a purchase that was never completed are deleted after 7 days. Where we must stop gift email to an address, such as after a bounce or a complaint, we keep only a hashed form of the address. The email address you redeem a gift with is the email address of your license, and is kept like any license record. Device records (the device code, platform, device name, App version, and when the device was first and last seen) and any trial extension are kept while the device is on your license or trial, and for 30 days after it is removed or the trial ends. License check records are kept for 90 days. Trial feedback is kept for 1 year. A trial reminder email address is deleted when you unsubscribe, or 30 days after the trial ends, whichever is first. A Teams waitlist or trial reminder sign-up that you never confirm by email is deleted after 30 days. Feedback sent from the App, with its files, is deleted after 1 year, except the words and name of a quote you allowed us to use, which we keep until you withdraw it. Crash reports are deleted 90 days after we receive them. A share link’s sealed copy is deleted within about an hour after it expires or you revoke it. A one-way hash of a network address, used to limit abuse, is kept for at most a day, except the one kept with a waitlist or Teams entry, which goes when the entry does. With sync on, a meeting you delete moves to Recently deleted on every device that syncs and is removed for good after 90 days, or sooner if you empty it; the relay then deletes its sealed records. If your license ends, your library on the relay becomes read only and is deleted 180 days later (30 days for a trial library). A library deleted at your request is kept for 7 days in case it was a mistake, and is then deleted. Your devices keep their own copies either way. Retention of your meeting content on your devices is in your hands: deleting a meeting there, and emptying Recently deleted, removes it from that device.

6. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit, encrypted credential storage, access controls, and logging. The App stores your meetings inside your own user account on each device, protected by that device’s own protections, such as FileVault, BitLocker, or your phone’s passcode. Your license, your sync key, and your optional AI key are kept in the device’s secure storage. Sync and share-link copies are sealed with AES-256-GCM before they leave your device, and every sync request is signed with your library’s key. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Receive a portable copy of your information;
• Object to or restrict certain processing;
• Opt out of the sale or sharing of personal information (we do not sell or share as those terms are defined under applicable US state laws);
• Not be discriminated against for exercising these rights.

To exercise any of these rights, email support@keptnote.com. We will verify your request and respond within the timeframe required by applicable law. You may also authorize an agent to act on your behalf. If we deny your request, you may appeal by replying to our decision.

Because the App has no account, we find your records from what you give us: your license key or purchase email for license and device records, and the library code shown in the App’s sync settings for your sync library. The App cannot delete your sync library from our relay in this version: write to support@keptnote.com and we will delete it within 30 days. Crash reports and trial feedback carry nothing that identifies you, so we cannot find a particular one; they are deleted on the schedule above.

Residents of the EEA, UK, or Switzerland may also lodge a complaint with their local supervisory authority.

8. International transfers

We are based in the United States, and information is processed in the United States. Paddle.com processes the information it collects for a purchase in the United Kingdom, the United States, and other countries where it and its payment partners operate, under its own privacy policy and safeguards. Our servers run on Cloudflare’s network. It answers each request from a location near you and may store our records outside your country. Apple, Google, and Microsoft process store data under their own policies and safeguards.

9. Children

The Site and the Service are intended for adults and business use and are not directed to anyone under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact us at support@keptnote.com and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and for material changes we will provide additional notice (such as email to account holders). Continued use of the Service after changes take effect constitutes acceptance.

11. Contact us