How NoteHand handles your information.

What the app stores on your Mac

NoteHand keeps meeting recordings and meeting information in its own sandboxed storage on your Mac. Your microphone and the meeting app's audio are saved as separate audio files. Transcripts, generated notes, Coach updates, tags and the search index are kept in a local database in the same place. Downloaded speech models and a rotating diagnostic log, kept for 7 days, live there too.

If you configure an export folder, the app also writes a Markdown copy of each meeting there. That folder is the only location outside its own storage the app can write to, and only because you chose it. If the folder is managed by iCloud Drive, Dropbox or another sync service, that service handles the copies under your account and its terms. NoteHand is not involved in that syncing.

Optionally, Settings › General can remove the audio files of completed meetings after a period you choose, which NoteHand applies when it next starts up. Transcripts and notes stay until you delete the meeting.

If you add an API key, it is stored in the macOS Keychain on this device only; it does not sync to iCloud Keychain.

Optional cloud processing

Coach suggestions and generated notes need a language model. You choose the provider in Settings › Models, separately for Coach and for post-call notes, and that choice decides whether text leaves your Mac.

What is sent: for notes, the meeting transcript text with a generation prompt. For Coach, the transcript text since the last update, Coach's own previous update, which is a rolling summary of the call so far, and any agenda or notes you typed into the Coach window. Audio is never sent. See your provider's own terms and privacy policy for how it handles what it receives.

Speech models are downloaded from Hugging Face when you choose one; that request is a normal file download and carries no meeting content.

Support and feedback

When you use Send Feedback in the app, BITSUMMIT receives what you submit: the feedback type and your message, and a reply-to email address if you enter one. For a bug report the app also includes its version and build, your macOS version and the names of your speech model and AI provider. If you tick the option to attach logs, up to about 32 KB of the app's most recent diagnostic log is included; the log does not contain transcript text, but window titles of meeting apps may appear in it. Submissions are stored in a database operated for BITSUMMIT on Supabase and kept for as long as they are useful for triage. To ask what we hold about a submission or to have it deleted, write to the address below and quote the date and reply-to address you used.

When you email us, we receive your message and address so we can respond, and we keep the thread in our mailbox. Ordinary support does not require recordings or transcripts. If you choose to send an excerpt, we use it only to resolve your request.

The app collects no analytics, crash reports, usage statistics or device identifiers.

This website

notehand.io sets no cookies and runs no analytics. It is hosted on Microsoft Azure Static Web Apps, which receives the standard information a browser sends to load a page, such as your IP address and browser type, in order to serve it. Fonts are served from notehand.io itself; no third party receives a request when a page loads. We attach nothing about you to either.

There is no sign-up and no account. The only information this site sends to BITSUMMIT is what you type into the download form, which is covered next, or the resend form on the support page, which sends your licence key again and is covered under the licence service below. Anything else here that behaves like a form runs entirely in your browser. The worked examples on the homepage and the feature pages are the ones worth naming: the search box that filters the sample meetings, the text area on the dictation page, and the choices on the privacy and pricing pages. They are illustrations rather than the app, they transmit nothing and they store nothing. Where an example offers to copy text or to save a Markdown file, that happens in your browser through the clipboard and a file your browser writes; nothing is sent to us.

Nothing is stored in your browser except on one page. After a direct purchase, the thanks page shows your licence key once and then takes the checkout id out of the address bar so it is not left in your history. To remember that the key has already been shown, it sets a single flag in the browser's session storage, named notehand.key.shown, with the value 1. Without it, reloading that page would tell you the checkout does not exist. It is not a cookie, it is never sent anywhere, and it goes when you close the tab.

The download form

Taking the direct download means giving us a name and an email address. The page hands you the link straight away rather than emailing it, but it records that you asked, and it tells us. Downloading the app collects nothing beyond what this section lists; buying and activating a licence is separate, and is covered in the next section.

What is recorded. One row per download:

Why. Three reasons, and no others. To give you the download link. To let us know a download happened, which is an email to our own support address carrying the name, the address, whether the box was ticked, the version and the time. And to stop the form being abused: the hashed address is the counter behind a limit of twenty download requests an hour from one network.

Where it goes. The row is stored in Microsoft Azure Table Storage, in the storage account BITSUMMIT runs for NoteHand, in Azure's East US 2 region, which is in the United States. The notification to ourselves is not sent while you wait: your name, your address, whether you ticked the box, the version and the time are put on a queue in that same storage account, and a background job takes them off the queue and sends the mail. If the mail cannot be sent after retries, the message is parked on a companion queue, still holding those fields, until we look at it and clear it by hand. The email itself is sent through Azure Communication Services, whose data location for this service is Canada. Nothing from the form is sold, shared with anyone else, or used for advertising, and there is no profiling of any kind.

The tick box is optional. It is unticked when the page loads, and the download behaves identically whether you tick it or not. Ticking it is your express consent for BITSUMMIT Corporation to email you about new versions of NoteHand, which is why the box is stored with a timestamp: Canada's anti-spam legislation requires a sender to be able to show when consent was given. You can withdraw it at any time, through the unsubscribe link in any message we send or by writing to the address at the bottom of this page, and we act on that without asking why.

The link itself. The download link is signed and stops working fifteen minutes after it is issued. It is not stored anywhere and cannot be reissued; if it lapses, use the form again.

How long it is kept. We keep download records for up to 24 months and then delete them. Deletion is done by hand, so if you want yours removed sooner, ask and we do it. The counter behind the twenty-an-hour limit is a separate row and is not covered by that 24 months: it holds the hashed address, the hour it counts and the count, nothing removes it, and the storage expires nothing on its own, so it stays until we clear it by hand.

Having it removed. Write to support@notehand.io, from the address you used or quoting it, and we delete the row and take the address off the update list. You can also ask what we hold about you.

The licence service

The direct download is unlocked with a licence key instead of an Apple Account, and a service at api.notehand.io issues those keys and checks them. This section is about that service. It applies only to the direct download: the Mac App Store version never contacts it, because Apple handles that purchase.

Paying for it. The direct purchase is taken by Stripe, which is the payment processor. The checkout page is Stripe's, your card details go to Stripe and never reach BITSUMMIT or this service, and what Stripe does with your payment information is governed by Stripe's own terms and privacy policy. What comes back to us is the email address on your receipt and Stripe's identifiers for the customer, the checkout and the payment, which is what the licence record below holds. Buying through the Mac App Store instead means Apple takes the payment and none of this applies.

What the app sends, and when. When you paste your key into Settings › About, the app sends the service four things: the licence key, a hash of this Mac's hardware identifier, the name of this Mac and the app's version number. The service answers with a signed activation token, which the app stores on your Mac. About once a day, while the app is running, it sends that token back so the service can say whether the licence is still active. That daily request carries the token and nothing else. When you deactivate a Mac from Settings › About, the app sends the token and that Mac's hash. If the app cannot reach the service it keeps working for a while, so an outage or a spell offline does not lock you out.

What the service keeps. A licence record holds an identifier for the licence itself, the email address from your Stripe receipt, Stripe's identifiers for the customer, the checkout and the payment, a hash of your licence key, the licence's status, how many Macs it covers, and the dates it was created and, if it stopped being active, when that happened. The status is active, refunded, or revoked; refunded is set automatically when Stripe tells us a payment was refunded, and revoked is a state we can set by hand. Your key is also held in plain text against your checkout, which is what lets the thanks page and the resend form give it to you again. Then one activation record per Mac, holding the licence it belongs to, that Mac's hash, its name, the app version, when it was first activated, when it was last seen and, if you deactivated it, when. Alongside those the service keeps the rate-limit counters described below, and a note of which Stripe notifications it has already handled so a repeat cannot issue a second key. Nothing about your meetings, recordings, transcripts or notes reaches this service at any point.

Your network address. The service writes no address into its own records: none of the records above carries one, and where it has to tell one caller from another it uses the keyed one-way hash described under the download form. What the platform underneath keeps is a separate matter. api.notehand.io is reached over the internet, so Microsoft Azure, which hosts it, receives the standard request data a connection carries, your address among it, in order to answer. Azure's own telemetry for this service, Application Insights, is switched on: it records each request with the address masked and an approximate location derived from it, and keeps that for 90 days before deleting it. We do not use it to identify anyone, and it carries nothing about your meetings.

The resend form. If you lose your key, the form on the support page sends it again. The only thing the form sends is your email address, and the page shows you the same answer whether or not that address bought anything, so it cannot be used to find out who has. If the address does hold a licence, the key is emailed to it. That send does not happen while you wait: your address and the checkout it matched are put on a queue in the same storage account, and a background job takes them off the queue and sends the key. The queue message never carries the key itself. If the mail cannot be sent after retries, the message is parked on a companion queue, still holding your address, until we look at it and clear it by hand. Apart from that queue the address is not stored: it goes into none of the records above. Two counters are written so the form cannot be used to send mail at someone: one against a keyed one-way hash of your email address, allowing three requests an hour, and one against the same kind of hash of your network address, the one the download form uses, allowing ten an hour. Both keys are derived from a secret only the service holds, and each from a different purpose, so neither hash can be read back, matched against the other, or tested against a guessed address by anyone without that secret. Each counter is a count inside an hour and holds nothing else.

Where it runs. The service and its records are on Microsoft Azure, in the same storage account as the download records and in Azure's East US 2 region, which is in the United States. Key emails are sent through Azure Communication Services, whose data location for this service is Canada. Nothing here is sold, shared with anyone else, or used for advertising, and there is no profiling of any kind.

How long it is kept. A licence record and its activation records are kept for as long as the licence exists, because they are what makes your key work, and afterwards as a record of the purchase. Deactivating a Mac marks its record deactivated; the record, with that Mac's name and hash, stays until it is deleted. Deletion is done by hand. The rate-limit counters are kept indefinitely: each is one row holding a hash, the hour it counts and the count, nothing in the service removes them, and the storage they sit in expires nothing on its own, so they stay until we clear them by hand.

Having it removed. Write to support@notehand.io, from the address you bought with or quoting your key, and we tell you what we hold and delete what we can. Deleting the licence record cancels the key, so we will say so before we do it.

Permissions, and what NoteHand uses them for

Deleting your data

A meeting. Delete it in the Library and NoteHand removes its recording, transcript, notes and search entry from the app's storage, and the Markdown file from your export folder.

Exported files. Files you moved or copied elsewhere, and copies a sync service or backup already holds, stay until you remove them there.

The app. Deleting NoteHand from Applications does not remove its storage. To remove everything, also delete the folder ~/Library/Containers/ca.bitsummit.CallIntelligence, then open Keychain Access and remove what NoteHand keeps there under the service name ca.bitsummit.CallIntelligence: any API key you added, and, if you bought the direct download, the licence activation token the app stores after you enter your key. Keychain items sit outside the container, so they survive deleting both the app and that folder. Apple's guidance on deleting apps explains why documents and data are kept.

Information you sent us. Write to the address below to ask about, or ask us to delete, a feedback submission, an email thread, a download record, or a licence and its activations. Deleting a licence record cancels the key, so we will say so before we do it.

Recording consent

Recording laws differ by country, state and province. During setup the app asks you to confirm that obtaining consent from the other people on a call is your responsibility. Detected meetings start recording automatically, and the app does not announce itself to other participants, so tell them before the call begins.

Children

NoteHand is a work tool and is not directed at children. We do not knowingly collect information from children through the feedback form or support email.

Changes to this policy

If a future version changes what the app sends or stores, we will update this page and say so in the release notes for that version. The date at the top is the last time the text changed.

Contact

Questions about this policy, or requests about information you sent us: support@notehand.io. BITSUMMIT Corporation is headquartered in Oakville, Ontario. Our mailing address, which is where post should be sent, is BITSUMMIT Corporation, 710 Dorval Drive, Unit 601, Oakville, Ontario L6K 3V7, Canada. The terms of use cover the licence, and the Security page sets out the same handling for technical evaluation.