AI Note Privacy Policy

1. Operator and scope

AI Note (com.onsimdangai.ainote) is operated by Onsimdang AI Company (주식회사 온심당에이아이컴퍼니). Contact ceo@onsimdang.com for privacy questions or data deletion requests. This policy covers AI Note and its transcription, organization, usage and purchase-verification APIs, not unrelated services on onsimdang.com.

2. Accounts and local storage

AI Note has no ordinary email/password account registration or sign-in. Section 13 explains its iOS anonymous service identity. A Google Play payment account is not an AI Note account. Note text, titles, creation times, recordings, recording length and file size, transcripts, summaries, key points, to-dos, decisions and processing states are kept in app-private SQLite databases and files on your device. The app relies on operating-system storage protection; separate app-level file encryption is not implemented. Android automatic backup is disabled. Local records are not uploaded as a whole or synchronized across devices.

3. Optional cloud processing

You can write and save notes and recordings without cloud processing. On Android 1.0.0, accepting transcription submits the recording and later saved recordings through the AI Note server to AssemblyAI. From Android 1.1.0, recordings are saved on the device first. After consent, pressing the transcription button sends only the selected audio segment through the AI Note server to AssemblyAI. The app reads only an audio or video file selected by the user through the Android system document picker. Video audio is extracted locally; video images and the entire original video are not sent to the STT server. Originals are neither modified nor deleted. Imported file references, names and durations, and separate audio notes for selected ranges, are stored locally. No broad storage or media-read permission is used. A user-started microphone foreground service, notification and bounded wake lock support automatic stop and saving for recordings of 1 to 30 minutes while locked or in the background. Complete file recovery after OS force-stop or power loss is not guaranteed. Original recordings remain on your device. These version-specific Android descriptions do not change existing iOS processing or authentication. After separate consent, selecting AI organization sends that note text or transcript through the AI Note server to OpenAI. Consent choices are stored locally. The current app has no separate consent-revocation settings screen. Contact us for guidance on stopping processing or deleting transmitted data. Clearing app data also removes local notes and recordings; do not do so if you need to preserve them.

4. Data processed and purposes

Transcription uses recorded audio, server-measured duration and the resulting transcript. AI organization uses your selected note or transcript and the resulting organization. Allowance accounting and duplicate-request prevention use a transformed device identifier, hashed request identifiers, HMAC content fingerprints, operation type, time, outcome and usage. Purchase verification uses the Google Play product ID, purchase token, subscription state, expiry and token hash. Our server does not directly receive card numbers or payment-method details. Your text or audio may contain personal information; avoid submitting unnecessary sensitive information.

5. Device identifiers and security

On Android, the app creates a SHA-256-derived identifier from Android ID (SSAID), stores it locally and sends that value for allowance queries and purchase verification. Startup and app resume attempt Play purchase restoration and allowance refresh; the Pro panel also refreshes allowances. This does not automatically transmit note contents or recordings. The raw Android ID is not sent to the app server. The derived identifier links allowances and purchase rights on the same device; it is not an advertising ID and is not described as anonymous. A random installation identifier is used if the platform identifier is unavailable. The server stores further hashed/HMAC-derived identifiers. Google Play Integrity is operating now, with successful verification confirmed on the Play Store internal-test installation. It checks app and device integrity, version, signing, Play license and request hash. Google Play processes app metadata, license and device-attestation information for this service. The app does not use contact, SMS, location or advertising-ID access functions.

6. Google Play Billing SDK diagnostics

The app initializes Google Play Billing on startup. Billing connection and error diagnostics may therefore be processed even if you do not consent to STT/AI or buy Pro. The included Google DataTransport library attaches Android version, device model, manufacturer, hardware and OS build, app version, network type, time zone, language/country settings and carrier MCC/MNC to diagnostic events for transmission to Google. OS build fingerprint describes an OS build, not a person’s biometric fingerprint. The app has no switch to disable only these SDK diagnostics. Google processing and retention follow its policies; we do not promise an unconfirmed fixed retention interval. No advertising SDK, Firebase Analytics or Crashlytics is included, but Firebase serialization encoders are transitive Billing dependencies. These diagnostic events do not use the advertising ID.

7. IP, User-Agent and logs

The server receives IP addresses and HTTP request information during network connections. IP addresses are HMAC-transformed for rate limiting and abuse prevention; they are not used to infer location. Nginx and Uvicorn access logging is disabled for the AI Note API. The app server does not store User-Agent as a separate database field. Service errors and verification failures may generate logs. The operating-system journal has a 14-day maximum-retention setting and storage-size limits. Infrastructure error logs follow separate rotation policies; not every log is guaranteed to have the same 14-day retention. No advertising SDK, Firebase Analytics or Crashlytics is included, but the Billing SDK diagnostics described above are present.

8. Hosting, providers and international processing

Our own AI Note server runs on a Vultr cloud virtual server in the Republic of Korea (KR region). STT uses AssemblyAI's default US-region API (api.assemblyai.com), so recordings are processed in the United States. AI organization sends text to OpenAI's Responses API (api.openai.com); no separate configuration guarantees Korea-only processing or storage. OpenAI's international processing and Google Play billing and Integrity processing are governed by those providers' service and data-processing policies. Cloud content is sent when you choose cloud processing; purchase data is sent for purchases, restoration and subscription re-verification over HTTPS. Billing connection and diagnostic processing may begin at app startup. Providers process data for service delivery, security, abuse prevention and applicable contractual purposes. The app implements no advertising-data sale or advertising-profile feature.

9. Retention on your device and our server

Local notes, recordings and results remain until you delete them or app data is removed. Our server deletes temporary audio when STT finishes or fails; the processing deadline is 30 minutes. Files left after a crash are cleaned at service startup. Transcript and AI-response caches are removed after a one-hour retention interval, with cleanup running approximately every 60 seconds. Request metadata, per-device usage and content fingerprints retain the current and previous UTC calendar months. IP-derived rate counters retain about one day; aggregate daily operation/status counts retain seven UTC days. Integrity anti-replay token hashes expire after approximately 180 seconds. Purchase tokens are stored encrypted with AES-GCM to recheck subscription status. The encryption key is separately derived from a server secret kept outside the database; token plaintext is not stored in SQLite. Token hashes, encrypted tokens and entitlements are cleaned more than 35 days after expiry or revocation. Paid access is rechecked with Google Play before cloud operations and allowance queries, and periodically on the server at approximately five-minute intervals. Cleanup timing and service outages can delay actual removal.

10. Provider retention and model training

Deleting data on our server does not simultaneously delete provider copies. Current STT code makes no automatic AssemblyAI transcript-deletion call. AI Note currently uses an AssemblyAI Free account. AssemblyAI's official documentation reviewed on 2026-10-07 states that Free users cannot use Data Controls to opt out of model improvement, set a time-to-live (TTL), or sign a BAA. Recording audio is sent to AssemblyAI's US region for STT, and AssemblyAI produces and returns the transcript. Certain submitted or processed data, as permitted by the applicable contract, may be used for AssemblyAI model improvement after a process designed to redact personally identifiable information. In view of this possibility, STT audio and transcribed user content are disclosed as data shared with an external provider. No separate agreement excluding training or limiting retention has been confirmed, so no training or zero retention is not guaranteed. For asynchronous production processing without a TTL or BAA, the default deletion process for uploaded audio begins at 24 hours and proceeds within the 24-48-hour window; deletion of final transcripts and linked audio URL references begins after 30 days. Intermediate processing artifacts enter deletion within 48-72 hours. Actual completion may be delayed by the provider's asynchronous deletion process. These are defaults for the asynchronous production environment, not a guarantee of identical retention in the model-training environment. Certain logging and billing metadata may be retained separately. OpenAI requests specify store:false, which does not itself disable abuse-monitoring logs. OpenAI API inputs and outputs are not used for model training by default. Data can be shared for model improvement only when the customer explicitly opts in. Default abuse-monitoring logs may be retained for up to 30 days. Production-account data-sharing opt-in and special zero-retention arrangements have not been confirmed. Consult the official policies linked below.

11. Deletion, access and support

Deleting an individual note removes that local note, saved results and any recording exclusively linked to it. It does not immediately erase copies already sent to providers or server usage/purchase records. Request access, deletion or processing cessation at ceo@onsimdang.com with the app name, request and processing time, using only the minimum information needed to identify records. Without an app account, identifying a specific record may be difficult. We will explain the identifiable scope, security/settlement information that must remain and provider-deletion handling. Do not email entire notes, raw purchase tokens or device-attestation tokens. The home app menu opens AI Note Pro, where purchase restoration, subscription management, current status and the privacy policy are accessible. Cancel Pro separately in Google Play subscription management; data deletion does not automatically cancel a subscription. For iOS anonymous service-identity deletion requests, see Section 13 below.

12. Security and updates

External transmission uses HTTPS. Provider secret keys stay on the server and are not embedded in the app. Access-log settings avoid routine note/token logging; the server limits request sizes, time and usage. Changes to this policy or actual processing are reflected on this public page. Google Play Integrity and Google Play purchase verification are operating now. STT and AI organization have been confirmed to work on the Play Store internal-test installation. Google Play Billing test purchases, Pro activation, purchase restoration, automatic renewal and return to Free access after subscription expiry have also been confirmed to work.

13. iOS anonymous service identity, subscriptions and deletion

There is no ordinary registration, sign-in, email/password or user-profile feature on iOS. However, App Attest registration creates a random anonymous service identifier (principal) and appAccountToken on our server. This identity links authentication, usage, subscriptions and purchase recovery, and can survive an authentication-key replacement when separate recovery ownership is proven.

iOS uses Apple App Attest and StoreKit instead of Android-only Play Integrity and Play Billing. Apple handles app/device attestation and purchases. Our server processes public authentication keys, opaque key references, replay counters, challenges and verification hashes; anonymous identifiers and appAccountToken; product, transaction and original transaction identifiers, verification environment, entitlement state, expiry time, transaction-signature hashes and normalized subscription-notification state. These support app authentication, usage accounting, abuse and duplicate-entitlement prevention, transaction verification and restoration. We do not store Apple Account passwords, card details or App Attest private keys on our server.

A random purchase-recovery secret and pending processing journal are stored in this app’s Keychain using WhenUnlockedThisDeviceOnly, without iCloud Keychain synchronization. The secret is sent over HTTPS when proving recovery; our server stores its domain-separated hash. Keychain persistence after reinstallation or a device change is not guaranteed. An Apple-signed transaction alone does not transfer ownership to another anonymous identity.

In AI Note Pro, ‘Delete anonymous service identity’ initiates deletion of the server identity and associated personal data using existing app authentication, without a new account or email submission. ‘Deletion request status’ displays the result. Receiving a request is distinct from completing deletion. The existing company contact ceo@onsimdang.com remains available for privacy questions, deletion or processing-stop requests. Do not email passwords, recovery secrets, raw attestation or signed transaction evidence.

iOS authentication, usage, transaction and recovery records are retained while needed to provide the corresponding service. Android retention periods are not automatically applied to iOS ledgers. Our existing privacy contact reviews deletion requests and deletes associated data except records whose retention is required by law. Under Article 43(3) of Korea’s Personal Information Protection Act Enforcement Decree, we provide a result or retention reason and objection procedure within 10 days of a request. Any legally required transaction retention is separated from ordinary service data; its legal basis and period are specified in the result. No unconfirmed blanket period is assigned to all iOS records.

A request does not delete notes/recordings on your device or cancel Apple subscriptions. Manage renewal and cancellation separately in Apple subscriptions. After server-identity deletion is completed, its authentication and purchase-recovery information cannot be reused. Deletion does not enable another identity to take over someone else’s purchase. Use the existing note-deletion function for local notes/recordings. Copies held by external AI processors follow the provider policies and separate deletion handling described above.

Monthly (1 month) and annual (1 year) Pro subscriptions renew automatically. Apple’s localized price and billing period appear before purchase. The app provides Restore Purchases, Manage Subscriptions and the Apple standard EULA. This section describes iOS processing and does not change Android operating policy.