1. Information We Collect & How We Use It

NestNote is designed with a "local-first" privacy model. When you create an account via Firebase Google Authentication, we access your basic profile information (Name, Email, Profile Picture) to identify your account. This information is stored locally on your device. Your actual note content (text, images, audio) is encrypted locally using AES-256 and is never transmitted to our servers.

Home Screen Widgets: Features like NestNote widgets read your encrypted database entirely locally on your device to provide quick shortcuts and previews. This data is strictly local and never transmitted off your device.

2. Google Drive Data (Limited Use Disclosure) & Web Vault

To provide secure cloud backups, NestNote requests access to your Google Drive via the appDataFolder scope. NestNote's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use this permission to create, update, and restore a hidden backup file of your encrypted notes inside a dedicated app folder on your Google Drive.
• We cannot see, read, or access any other personal files or folders in your Google Drive.
• To maintain background syncing, your OAuth Refresh Token is encrypted and securely stored on our backend infrastructure. It is strictly used for app functionality and is never shared with third parties.
• Notes Web Vault & Kill Switch: When you open the Notes Vault on our website, your encrypted Drive archive is downloaded directly to your browser and decrypted purely in local browser memory using WebCrypto AES-256-GCM. You can disable Web Vault access at any time from your mobile app's security settings, and web sessions automatically wipe decrypted data from memory after 3 minutes of inactivity.

3. Android Permissions

We request the following device permissions only when required for core app functionality:

• Microphone (RECORD_AUDIO): Required only when you actively choose to record a voice note. Audio files are saved locally to your device.
• Storage/Media: Required only to allow you to select and attach images to your notes, use Stego Vault, or save downloaded Shareflow files.
• Alarms (SCHEDULE_EXACT_ALARM): Required to deliver precise notifications when you schedule an alarm for a specific note.
• Biometrics: Required only if you enable the "App Lock" feature. Authentication happens locally on your device; we do not collect or transmit your biometric data.

4. Third-Party AI Integrations (Google Gemini)

NestNote allows you to integrate the Google Gemini API for features like grammar correction and text rewriting. To use this, you must input your own personal API key. When you trigger an AI feature, only the specific text you have selected is sent directly to Google's API. NestNote does not store your AI queries or use them to train our own models.

5. Shareflow File Transfer & Per-File Password Lock

NestNote includes "Shareflow," an integrated service for temporary, cross-device file sharing.

• Temporary Storage & Deletion: Files uploaded via Shareflow are temporarily stored on our secure cloud storage servers. Both the files and their associated access codes automatically self-destruct after a temporary period managed dynamically by our servers.
• Authentication & Limits: Uploading files requires you to sign in via Google Authentication. This is required to enforce dynamic data pool limits and prevent server abuse. Downloading and receiving files is completely open and requires no login.
• Data Privacy: Because Shareflow is designed for temporary, link-based file transfer rather than permanent private storage, standard unlocked files do not use the same client-side AES-256 encryption as your personal notes. However, we do not monitor or inspect these temporary files unless required by law or to investigate severe violations of our Terms of Service.
• Per-File Password Lock (Zero-Knowledge v2): You can optionally lock individual Shareflow files with a password. When you lock a file, its storage path and download URL are encrypted on your device using a 256-bit key derived from your password via PBKDF2-HMAC-SHA256 (100,000 iterations) + AES-256-GCM, and the plaintext path is stripped from the database. Your password itself is never stored—not in plaintext, not encrypted, and not hashed. Only you and the recipient you share the password with can unlock the file location.
• Local Wi-Fi Transfer: When using Shareflow's Local Wi-Fi Server mode on the mobile app, files are transferred directly between your phone and PC over your local network without touching external cloud servers.

6. Stego Vault (On-Device Image Steganography)

NestNote includes "Stego Vault," a privacy tool that allows you to hide up to 3 secret files inside a cover photo and extract hidden payloads from steganographic images.

• 100% On-Device Processing: All file embedding, extraction, and optional passcode encryption inside Stego Vault happen entirely offline on your device.
• Zero Cloud Transmission: Neither your cover images, your hidden secret files, nor your Stego passcodes are ever uploaded to or processed by NestNoteLab servers.

7. Advertisements (Google AdMob)

To support the development of NestNote, we use Google AdMob to display native and rewarded advertisements. AdMob may automatically collect and use certain data, such as your device's advertising ID and general location data, to serve non-personalized or personalized ads depending on your region and consent.

• We have configured our Ad requests to serve non-personalized ads by default where applicable.
• For more information on how Google uses this data, please review Google's Advertising Privacy Policy.

8. Account & Data Deletion Request

You have the right to request the deletion of your account and all associated data at any time. To initiate a deletion request, please contact us at nestnotelab09@gmail.com Send Email

Upon request (or when triggered directly in the app), we will delete your account metadata, purge any active Shareflow files and lock records, and revoke all OAuth tokens from our servers. Because your notes are stored in your personal Google Drive, you may also manually delete the "NestNote" backup folder from your Google Drive settings for immediate and total data removal. Any active Shareflow files are automatically purged from our servers once their dynamic timer expires.

9. Contact Us

If you have any questions regarding this privacy policy or your data, please contact us at nestnotelab09@gmail.com Send Email