Privacy Policy

1. Information we collect

We don’t collect payment details (Xinote is currently free), we don’t use advertising trackers, and we never sell personal information.

• Account details: your email address and, if you sign in with Google, the name and profile picture Google shares with us. We never receive your Google password. Guest mode creates an anonymous account without an email.
• Content you create: audio recordings, transcripts, AI-generated notes, your questions and the AI’s answers, the courses and stages you set up, materials you upload (PDF, PowerPoint, Word, images and similar), and the subjects and key terms you enter.
• Usage and technical information: your sign-in session (stored in a browser cookie), language preference, bot-protection checks, and basic server logs used to troubleshoot problems (such as request times and error messages).

2. How we use it

• To provide the service: storing recordings, transcribing, generating notes, answering your questions and organising course materials.
• To improve accuracy for you: your subject, key terms and the terminology in your materials are used only for your own transcripts and notes.
• For your account and security: signing in, sending verification codes and account emails, preventing abuse and fixing problems.
• To keep the service working well. We do not use your recordings or notes to train our own AI models.

3. Who processes your information

We rely on the following service providers. Each processes only what is needed to run Xinote, under its own privacy terms:

• Supabase — database, sign-in and file storage (servers in Sydney, Australia). Your recordings, notes and materials are stored here.
• Cloudflare — website hosting, domain, bot protection and email forwarding (global network, requests handled at the nearest location).
• ElevenLabs — speech-to-text. Recordings are sent to it for transcription (may be processed in the United States or other countries).
• Anthropic (Claude) — generating notes, correcting transcription errors, answering questions and reading uploaded materials (processed in the United States). Under Anthropic’s commercial terms, content sent through its API is not used to train its models by default.
• Resend — sending verification codes and account emails (may be processed in the United States or other countries).
• Google — only if you choose “Sign in with Google”.

4. Overseas processing

Your data is stored mainly in Australia, but content is sent overseas (mainly to the United States) when it is transcribed or processed by AI. By using Xinote you understand and agree to this. We choose providers with strong security practices and send only what each task requires.

5. How long we keep it

• Recordings, transcripts, notes, Q&A and materials are kept until you delete them or your account.
• Deleting a recording also deletes its audio, transcript, notes and Q&A. Deleting a course also deletes its materials and course Q&A.
• Guest accounts that stay inactive for a long time may be removed.
• Copies in server logs and backups expire automatically after a short period.

6. Your rights

• Access: you can view all of your content in Xinote at any time.
• Correction and deletion: you can edit titles, courses and key terms, and delete any recording, material or course.
• Account deletion: on the Account page, choose “Delete account” to permanently delete your account and all of its content (recordings, transcripts, notes and materials) straight away. You can also email support@xinote.app and we will do it for you.
• Complaints: if you are concerned about how we handle your information, contact us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

7. Young people

Xinote is intended for users aged 13 and over. Users aged 13 to 17 must have permission from a parent or guardian. We do not knowingly collect personal information from children under 13 and will delete it if we find it. Parents with questions can contact support@xinote.app.

8. Other people in recordings

Your recordings may capture the voices of teachers, classmates or others. Get any permission you need before recording and follow your school’s rules and the law (see the Terms of Service). Anyone who believes a recording affects their privacy can contact us.

9. Security

All data is encrypted in transit (HTTPS) and the database is separated per user, so each person can only access their own content. No online service can be perfectly secure; if a data breach is likely to cause you serious harm, we will notify you as required by law.

10. Cookies

We use only the cookies needed for the site to work: keeping you signed in, remembering your language and bot protection. We do not use advertising or cross-site tracking cookies.

11. Changes

If we make significant changes to this policy we will let you know on the website. The date at the top of this page shows when it was last updated.

12. Contact

For any privacy question, email support@xinote.app.