PolyNotes is a study and note-taking app for students, published by PolySync. This policy explains what data the app handles, where it goes, and your choices. PolyNotes is local-first: most of your content lives on your own device and is never sent to us.
Your notes, whiteboard drawings, imported modules and PDFs, audio recordings, résumé/CV data, and course materials are stored locally on your device (in the app's on-device storage). When you're signed in, some of this is also kept on our servers so your other devices stay in step; section 6 lists exactly what. We do not upload or receive this content unless you actively use a feature that requires it (described below).
Microphone. PolyNotes uses the microphone only when you start dictation or record a voice note or lecture. Voice recordings are stored on your device. A lecture recorded on a phone keeps recording with the screen locked until you stop it, and is uploaded so it can reach your other devices (see section 6). On iPad and iPhone, dictation uses Apple's speech recognition, so Apple may process the audio to turn it into text (see Apple's privacy policy). On Android, dictation uses your device's own speech service, so Google or your device's maker may process the audio. On Windows, dictation uses Windows speech recognition, so Microsoft may process the audio when "Online speech recognition" is turned on in Windows Settings (see Microsoft's privacy statement). If that isn't available, the dictation clip is sent to our server instead, where Cloudflare's speech-to-text service (Whisper) turns it into text; the clip is used only for that and is not stored.
Transcription. Transcribing a voice note or recording runs on your device (a speech model that downloads once); the audio never leaves it. Recordings can include other people's voices, so make sure you're allowed to record and transcribe them.
This includes anything you sync from your learning-management system (Moodle). When you connect Moodle, your access token is stored in your device's operating-system keyring — never on our servers or in the app's web storage — and your course files download from your institution's Moodle server directly to your device. Your Moodle credentials and materials do not pass through PolySync.
Apple's on-device features. On iPad and iPhone, "Convert to text" reads handwriting with Apple's Vision framework, and the tutor's offline mode uses Apple's on-device language model (iOS 26 with Apple Intelligence). Both run entirely on your device; nothing is sent to us or to Apple. Class reminders and the wake-up alarm are scheduled on your device from your timetable.
Using PolyNotes requires signing in. We use third-party sign-in — Apple, Google and Microsoft — or an email-and-password account that we issue. When you sign in, we receive your email address, name, and a provider account identifier from that provider. We use these only to identify your account, keep you signed in, and meter your AI usage. We do not receive your provider password.
If you sign in with Apple and choose Hide My Email, Apple gives us a private relay address instead of your real email; that is all we receive and store.
When you use an AI feature (the study assistant, tutor, flashcard generation, and similar), the relevant text or content you ask about is sent to our secure proxy and forwarded to our AI model provider to generate a response. In plain terms: the content you put into an AI request leaves your device to be processed by the model provider.
On iPad and iPhone, paid subscriptions are sold and processed by the Apple App Store. On Windows they are sold and processed by Creem, our payment provider. In each case that company is the merchant of record and handles payment and sales tax. We never receive or store your card or bank details. We receive only a confirmation that a valid subscription exists, which we use to unlock your plan. For a Windows subscription we also send Creem your email address so your receipt reaches you, and we store the customer and subscription identifiers Creem gives us.
Each has its own privacy policy governing what it does with data it receives.
On our backend we store the minimum needed to run accounts and billing: your account record (email, name, provider id), your entitlement/plan and remaining AI credits, and subscription receipts. We do not store the contents of your AI prompts or responses beyond what is required to process a request in the moment. We do not log request or response bodies.
Syncing between your devices. When you're signed in, we also store what keeps your devices in step: your courses, module names, timetable, deadlines, quick notes, profile and CV; your Moodle site address (never your Moodle login); the notes, drawings and images you add to lectures; the photos and audio you capture in the phone app; the files you add to a module by hand (PDFs, PowerPoints, Word and Excel files), so they reach your other devices; and the text of your module slides, so that the phone's AI can answer questions about them. Files synced from Moodle or Canvas are not uploaded: each device downloads them from your university itself. All of this is private to your account, and it's what makes signing in with the same account on another device show the same data.
Photos and audio are deleted from our servers automatically about 30 days after you capture them, by which time your other devices hold their own copies. Everything else stays until you delete it or delete your account.
We keep your account data while your account exists. You can delete your account from inside the app (Settings → Account → Delete account); this removes your server-side account record together with your subscription receipts, your entitlement/credit data, and everything synced between your devices, including photos, audio and slide text. You can also email us at support@polynotes.me to make a request. Content stored locally on your device is under your control and can be deleted from the app or by uninstalling it.
Subject to applicable law, you can ask us to:
As we operate from Malaysia, we handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA), including acting on access and correction requests and notifying affected users and the authorities of a personal-data breach where required. If you are not satisfied with how we handle your data, you may complain to Malaysia's Personal Data Protection Commissioner (pdp.gov.my). Depending on where you live you may have additional rights (for example under the GDPR or similar laws), including the right to complain to your local data-protection regulator.
PolyNotes does not make automated decisions that produce legal or similarly significant effects about you: the AI features generate study aids on request and do not profile you or decide anything about your account.
PolyNotes is intended for students in higher education and is not directed at children under 16. We do not knowingly collect data from children under that age.
The AI provider key is held only on our server, never in the app. Traffic to our services uses HTTPS. No system is perfectly secure, but we take reasonable measures to protect account data.
PolyNotes does not use advertising or cross-site tracking cookies. The app keeps data in your browser/device local storage and IndexedDB — to remember your preferences and hold your local content — and stores a session token to keep you signed in. These are essential to how the app works and are not used to profile you or track you across other sites.
We may update this policy. Material changes will be reflected by the "Last updated" date above and, where appropriate, an in-app notice.
Questions about this policy or your data: support@polynotes.me · PolySync.