Privacy Policy

Last updated:

Summary

GitNotēs (the “App”) is published by Xaventra (Pvt) Ltd, Level 26, East Tower, Echelon Square, World Trade Center, Colombo 01, Sri Lanka (“we”, “us”).

Your notes, todos, journals, templates, and canvases live in two places only:

  • On your device, as a local cache. iOS Keychain holds your GitHub access token; AsyncStorage holds a copy of files for offline access.

  • In the GitHub repository you choose, under your own GitHub account. GitHub’s privacy policy governs that storage: GitHub General Privacy Statement .

App telemetry does not intentionally attach note data, but automatically captured error messages and stacks may contain sensitive values if app code embeds them. We do not sell data or share it for advertising. Expo and Cloudflare act as service providers and process the diagnostics or usage-counter data described below when those features are included in an App build.

App builds that ship the telemetry feature have two optional telemetry paths, and both are covered by a single switch in Settings. One is Expo’s EAS Observe service, which reports startup performance and crashes from production builds. The other sends two kinds of anonymous usage counters that feed the public statistics page. Neither path intentionally attaches your notes, repository data, account data, or authentication data. Automatically captured error messages and stacks may nevertheless contain sensitive values if app code embeds them. The sections “Optional diagnostics” and “Optional usage counters” below state exactly what each path collects, how long it is kept, and how to turn it off.

What the App stores on your device

  • GitHub access token — a personal access token (PAT) you generate, or an OAuth token from the GitHub sign-in flow. Stored in the iOS Keychain via expo-secure-store. Never transmitted to any server we operate.

  • Local cache of your notes — copies of the files in your linked repository so the App works offline and feels fast. Stored in your app sandbox; removed when you uninstall the App.

  • Settings and preferences — theme, sync interval, last-used repository, the telemetry preference itself, and the version of this notice you have already seen. Stored in AsyncStorage. Never leaves your device.

  • AI provider configuration — if you enable AI features, the API base URL and (for BYO providers) the API key you enter. Keys are stored in the iOS Keychain.

What the App does NOT do

  • We do not run a backend that stores your notes, todos, journals, templates, canvases, or any other personal data.
  • We do not bundle advertising or third-party analytics SDKs such as Google Analytics, Mixpanel, Amplitude, Firebase Analytics, Crashlytics, or Sentry.
  • We do not use any data for advertising, and we do not track you across apps or websites.
  • We do not sell or share data with advertisers.
  • We do not send marketing email or push notifications.
  • We do not collect location data.
  • Worker events have no fields for note content, repository names or URLs, account identifiers, tokens, or exact hostnames. EAS automatic error capture can include sensitive values embedded in error messages or stacks; see “Optional diagnostics” for details.
  • We do not run our own user tracking. The counters behind the statistics page are plain event counts with no identifier attached, so we cannot tell one person’s reports apart from anyone else’s.

Optional diagnostics (Expo EAS Observe)

The App can use EAS Observe, Expo’s production monitoring service, to report startup performance and crashes from released builds in versions shipping the feature. It is enabled by default and you can turn it off in Settings. A missing preference defaults to enabled only after storage loads successfully; if the preference cannot be read, telemetry stays off. If the preference is off before import, the SDK is not imported. After import, it cannot be unloaded; dispatch is disabled and Worker requests stop, while local automatic error capture may continue until process exit.

What the diagnostics contain

  • Startup performance — cold launch time, warm launch time, bundle load time, time to first render, and time to interactive.

  • Device and network state at startup — low power mode, battery level, whether the device is charging, thermal state, and network facts such as connection type, whether the connection is metered, and Low Data Mode or Data Saver.

  • Startup network activity — how many requests the App made during launch, with bytes sent and received and the total time they took. Request bodies and response contents are not collected.

  • Update and navigation timings — EAS Update download time, and per-screen render and interactive timings. Route names are reported; configured route parameters that may contain note, repository, path, or authentication data are filtered.

  • Memory warnings — iOS low-memory warnings, with a snapshot of memory usage at that moment.

  • Errors — JavaScript errors and native crashes, including the error message and the stack trace.

The installation identifier

EAS Observe identifies an installation with an pseudonymous, install-scoped identifier. Its legal classification depends on context and applicable law and must be reviewed by the operator. It is generated on first install, survives app updates, and is reset if you uninstall and reinstall the App. It is never published on this site or on the statistics page.

Automatic error capture

The diagnostics library installs a global error handler as soon as it is loaded, so unhandled JavaScript errors are captured automatically without any code of ours choosing to report them. The error message and stack trace are dispatched off the device. If app code ever places a sensitive value in an error message or stack trace, that value travels with it. App telemetry does not intentionally attach note, repository, account, or authentication data, but we cannot rewrite what an error thrown from app code happens to contain.

How long diagnostics are kept

EAS Observe deletes collected data after 90 days. Deletion runs in monthly batches, so a given record can remain for up to 120 days. After deletion, Expo keeps only per-app event counts for billing.

Optional usage counters (public statistics)

A second and separate pipeline feeds the public statistics page. It is not connected to EAS Observe and it carries no installation identifier.

What the counters contain

There are exactly two event categories. app_open is sent once per successful app start. git_host_action is sent once after a successful Git-host operation that you triggered, tagged with one host from a fixed set (GitHub, GitLab, Gitea, Forgejo, other).

Nothing else is sent. There is no note content, no repository name or URL, no account or user identifier, no token, no exact hostname, no location, and no free-form extra field. The server timestamps every event itself.

How the counters are stored and published

  • Events are kept only as daily aggregate counters bucketed in UTC, and are retained for 13 months. No event log and no per-user record is kept.

  • The published numbers are client-reported and unverified. A client that repeats a valid report has it counted again, so the figures are a count of reported events. They are not a count of people and not a count of unique users. Treat the statistics page as an indication of activity rather than an audited figure.

  • Any cell with fewer than 20 events is withheld, and related totals are withheld as well so that a hidden number cannot be reconstructed by subtraction.

Turning the counters off

Turning telemetry off stops new reports. If the preference is off before startup, EAS Observe is not imported. If it is turned off after import, future EAS dispatch and Worker submissions are disabled, but the SDK cannot be unloaded and its local error-capture handler remains installed until process exit. Previously collected counters are not erased, and already published totals cannot be retracted. We keep only aggregate counters, so there is no per-person record to erase.

Authentication

The App authenticates with GitHub via OAuth or a personal access token that you generate yourself. The token is stored in the iOS Keychain on your device and is sent only to api.github.com when you load, view, or modify your notes. You can revoke the token at any time from your GitHub settings.

AI features (optional, off by default for new accounts)

The App offers optional AI assistance. You can disable AI entirely from Settings → AI; every other feature works without it.

  • Apple Intelligence — on supported Apple devices, runs on-device using Apple’s foundation models. No data leaves your device.

  • Bring-your-own provider — if you configure an OpenAI-compatible endpoint, the App sends your prompt and any selected note context directly from your device to the URL and API key you configured. We do not proxy, log, or inspect this traffic. The provider you choose is bound by its own privacy policy.

Permissions the App may request

  • Camera — only when you choose to take a photo to attach to a note.

  • Photo Library — only when you pick an existing image to attach to a note. Selected images are uploaded to your linked GitHub repository under notes/images/.

  • Microphone — only when you tap voice-to-text. Speech is processed by expo-speech-recognition (on-device by default on iOS).

  • Face ID / Touch ID — only if you enable App Lock in Settings. Verification happens in the Apple Secure Enclave; biometric data never leaves your device and is never seen by the App.

  • Background fetch / processing — keeps your notes synced with GitHub when the App is closed. Network traffic is between your device and api.github.com only.

Network endpoints the App contacts

  • api.github.com — to read and write the notes in your repository, using your token.
  • github.com — to authorise the OAuth flow.
  • Any AI provider URL you configure — only when you actively use an AI feature.
  • The Expo EAS Observe ingestion endpoint — only while diagnostics are enabled, to deliver startup metrics and error reports.
  • The GitNotēs statistics endpoint — in builds shipping the feature, only while usage counters are enabled, to deliver the two aggregate event types.
  • Apple servers (App Store updates, push token registration) — standard iOS platform traffic that we don’t control or observe.

A Cloudflare WAF per-address rate-limit rule before the statistics endpoint is a production prerequisite; its active configuration has not been verified. Cloudflare may process a source IP address for that edge rule. Worker application code does not read or persist the IP address.

Children’s privacy

GitNotēs is not directed at children. We do not knowingly collect personal data from anyone under the age of 13 (the US COPPA threshold) or under the age of 16 in the EU/EEA (GDPR Article 8). The pseudonymous installation identifier and aggregate usage counters are subject to applicable legal classification, which the operator must review. If you believe a child has used the App and provided personal information, contact us and we will assist in removing any local data.

Your rights

GitNotēs does not maintain a user account database. Expo processes diagnostics that may contain a pseudonymous installation identifier, whose legal classification requires operator review; Worker usage data is held as aggregate counters. Requests under GDPR / CCPA / equivalent regimes may therefore depend on the applicable classification and data flow:

  • Access — your notes are already accessible to you in the GitHub repository you chose, in the App, or via any Git client. There is no separate copy we hold.

  • Erasure — deleting a note in the App removes it from local storage and pushes a delete commit to your repository. Uninstalling the App removes every local cache. To delete history beyond that, manage the GitHub repository directly.

  • Diagnostics — diagnostics data is held by Expo under its own policy and its 90-day retention window. Turning diagnostics off stops future EAS dispatch. After the diagnostics module is imported, local error capture may continue until process exit. The App cannot remove Expo records it has already received.

  • Usage counters — we keep daily aggregate counters with no identifier attached, so there is no record that belongs to you individually and nothing for us to identify or delete on request. Turning the counters off stops further submissions; it does not delete counts that were already recorded.

  • Portability — your notes are Markdown / Org-mode / Neorg files in a Git repository. Portability is the default state.

  • Token revocation — revoke the GitHub access token from GitHub settings at any time.

Security

Tokens and BYO API keys are stored in the iOS Keychain. The App speaks to GitHub over HTTPS only. No method of electronic storage is 100% secure; we cannot guarantee absolute security of data on your device. For sensitive notes we recommend a private GitHub repository and enabling the in-App Face ID lock.

Third-party services

Changes to this policy

We may update this Privacy Policy as the App evolves. Updates are posted to this page with a new “Last updated” date. Material changes will be highlighted in-App on the next launch. The in-App notice appears once for each material change and can be dismissed, and your choice to dismiss it is stored on your device.

Contact