Privacy Policy

01Personal Information We Collect and Sources

The table below summarizes the categories of personal information YostNotes handles, the source of each, and whether it applies to the app.

02Personal Information You Provide to Us

Recordings, Transcripts, and Notes

When you record a meeting, the audio is sent to AssemblyAI to produce a transcript. The transcript is then sent to Anthropic to generate a summary. Both results are returned to the app and stored on your device. As soon as transcription completes, the app calls AssemblyAI's delete endpoint, which removes both the uploaded audio and the transcript from AssemblyAI's servers. Anthropic processes your transcript without storing a retrievable copy and keeps only short-term safety logs, described in How Long We Retain Data. Any notes you type are stored on your device and are sent to these providers only when you use a feature that processes them.

Support Communications

If you contact us for support — for example by emailing info@yost.group — we receive your name, email address, and the contents of your message. We use this only to respond to you. We do not add you to mailing lists or share support communications with third parties.

Beta Testing Interest

If you express interest in beta testing through the form on our website, we receive your name and email address solely to notify you when a beta becomes available.

CloudSync (Optional Encrypted Sync)

CloudSync is an opt-in, subscription-gated feature that lets you access your notes across multiple devices and platforms. When you enroll:

• What syncs. Notes, transcript text, summary text, flashcards, and folders — text and metadata only. Audio recordings and photos are never uploaded and remain device-local.
• How it is encrypted. All content is encrypted on your device before it leaves the app. Your passphrase is stretched using PBKDF2-HMAC-SHA256 (600,000 iterations) to derive a key-encryption key; this key wraps a random AES-256-GCM data key. The server receives and stores only the resulting ciphertext — it never sees your passphrase, your data key, or any plaintext note content.
• Recovery key. During enrollment a one-time recovery key is generated and shown to you once. Save it somewhere safe: if you forget your passphrase, the recovery key is the only way to restore access to your encrypted data on a new device.
• Where data is stored. Encrypted ciphertext is stored in a Cloudflare D1 database pinned to the EU West (WEUR) region. Synced data does not leave the EU.
• Sign-out behavior. Signing out of CloudSync stops future uploads and leaves your local notes intact. Your encrypted ciphertext remains on the server until you delete your account.
• Account deletion. Deleting your account removes all CloudSync ciphertext from the server.

03Personal Information We Collect Automatically

Beyond the audio and content described above, YostNotes does not collect personal information automatically. Specifically:

• We do not embed third-party product-analytics SDKs (for example Firebase Analytics, Mixpanel, or Amplitude).
• We do not collect crash reports through third-party services. Apple may collect crash data through its standard iOS process, and Google may collect crash data through Android Vitals, each governed by their respective privacy policies.
• We do not log behavioral telemetry such as feature-usage events or session durations.

04Personal Information We Collect from Third Parties

We do not buy or license personal information about you from data brokers or advertising networks.

AssemblyAI (Transcription)

AssemblyAI converts your meeting audio into a text transcript and returns it to the app, after which the app deletes the audio and transcript from AssemblyAI's servers. AssemblyAI encrypts data in transit (TLS 1.2+) and at rest (AES-128/256) and is SOC 2 Type 1 and Type 2 certified. It processes your audio under its privacy policy and data processing addendum.

Anthropic (AI Summaries)

Anthropic processes your transcript through its Claude Messages API to generate a summary, which is returned to the app. The Messages API is a stateless, zero-data-retention-eligible endpoint. Anthropic processes commercial API data under its privacy policy and commercial terms, and does not use it to train its models without our express permission.

Apple StoreKit

Apple's StoreKit framework processes your subscription transaction and communicates entitlement status to the app. We receive only whether your subscription is active. We do not receive your payment method, billing address, or Apple ID credentials.

Our Website

Our website uses Google Analytics (GA4) to understand aggregate traffic, subject to Google's privacy policy. The website and the app are separate systems, and website analytics are not merged with app data.

05Subscriptions, Billing, and Purchases

YostNotes offers premium features through an auto-renewing subscription. Billing is handled entirely by Apple (iOS) or Google (Android) through your App Store or Google Play account respectively. We never see or store your payment details.

iOS (Apple App Store)

How auto-renewing subscriptions work on iOS, as required by Apple:

• Payment is charged to your Apple Account at confirmation of purchase, or at the end of the 14-day free trial if you do not cancel.
• The subscription renews automatically at $14.99 per month or $169.99 per year unless you turn off auto-renew at least 24 hours before the end of the current period.
• Your account is charged for renewal within 24 hours before the end of the current period.
• You manage your subscription and turn off auto-renew in your App Store account settings after purchase.
• Any unused portion of a free trial is forfeited when you purchase a subscription, where Apple offers a trial.

Pricing, billing, refunds, and payment records are handled by Apple under the Apple Privacy Policy and the App Store terms. Your license to use YostNotes on iOS is governed by Apple's standard Licensed Application End User License Agreement (EULA), and cancellations and refunds are handled through your App Store account.

Android (Google Play)

How auto-renewing subscriptions work on Android, as required by Google Play:

• Payment is charged to your Google Account at confirmation of purchase, or at the end of the 14-day free trial if you do not cancel.
• The subscription renews automatically at $14.99 per month or $169.99 per year unless you cancel at least 24 hours before the end of the current period.
• Your account is charged for renewal within 24 hours before the end of the current period.
• You manage your subscription and cancel auto-renew in your Google Play account settings after purchase.
• Any unused portion of a free trial is forfeited when you purchase a subscription.

Pricing, billing, refunds, and payment records on Android are handled by Google under the Google Privacy Policy and Google Play terms. Cancellations and refunds are handled through your Google Play account.

What this means for your privacy regardless of platform: the only purchase data we receive is your entitlement status (whether a subscription is active). We do not receive your payment method, billing address, or store account credentials.

06How We Use Your Personal Information

• To record and transcribe. Your audio is processed into a transcript so you can read and search your meetings.
• To generate AI summaries. Your transcript or audio is processed by our AI provider to produce summaries and related outputs.
• To run the app. Your notes and preferences are stored on your device to make the app work.
• To unlock subscription features. Entitlement status from StoreKit unlocks premium features while your Monthly or Annual subscription is active.
• To respond to support requests. We use your contact information to reply.
• To notify beta testers. If you opted in, to send a notification when a beta is available.

07Disclosure of Your Personal Information

We do not sell, rent, or trade your personal information. Personal information may be disclosed only in these circumstances:

• Service providers. To the AI and transcription providers and to Apple, acting on our behalf or as platform provider, as described in this policy.
• Legal requirement. In response to a valid court order, subpoena, or other binding legal process.
• Business transfer. If Yost Group LLC is acquired, merged, or its assets transferred, personal information would be subject to the successor's privacy policy. We would notify you before any such transfer.
• Protection of rights. Where we have a good-faith belief that disclosure is necessary to prevent fraud, protect safety, or enforce our terms.

08Third Parties We Share With

These are the only third parties that handle data in connection with YostNotes. We embed no advertising networks, analytics platforms, customer data platforms, or social login SDKs in the app.

09Recording, Consent, and Your Responsibilities

• Tell participants before you record, and obtain their consent where the law requires it.
• Do not record conversations you are not legally permitted to record.
• You are responsible for how you use transcripts and summaries you create.

Other People's Information

Recordings capture the voices and statements of other people who are not users of YostNotes. Where we process that information, we do so as a processor acting on your instructions. You act as the controller of the meeting content you choose to record.

Voice Data

YostNotes does not create or store voiceprints and does not perform biometric voice identification. Where a transcript labels different speakers, those labels come only from self or group identification spoken in the recording — such as a participant stating their name or being named by others — not from biometric analysis of voice characteristics. Because no biometric identifiers are created, biometric-specific laws such as the Illinois Biometric Information Privacy Act do not apply to this processing.

10Your Choices About How We Use Your Information

Recordings, Transcripts, and Notes

You choose when to record. You can edit, delete, or export your recordings, transcripts, and notes within the app. Deleting an item removes the copy on your device. The app already deletes your audio and transcript from AssemblyAI right after transcription. Anthropic does not keep a retrievable copy you can delete; it holds request and response data in temporary safety logs for up to 30 days, then deletes it.

Microphone Permission

You can revoke microphone access at any time in your device's Settings app (iOS Settings or Android Settings > Apps > YostNotes > Permissions). Without microphone access, recording features will not function.

Subscriptions

You can turn off auto-renew or cancel at any time in your App Store account settings (iOS) or Google Play account settings (Android). Cancelling stops future charges; it does not delete data you created in the app.

Support and Beta

You may request that we delete any email you have sent us, and you may opt out of beta notifications at any time by emailing info@yost.group.

11How Long We Retain Your Personal Information

• Recordings, transcripts, summaries (no CloudSync): stored on your device until you delete them or delete the app. We hold no copy on our own servers.
• CloudSync encrypted data (if enrolled): encrypted ciphertext of your notes, transcripts, summaries, flashcards, and folders is stored on Cloudflare D1 (EU West) for as long as your account is active. Deleting your account removes all ciphertext from the server. Audio recordings and photos are never part of CloudSync and are never stored on our servers.
• Notes and app preferences: retained on your device until you delete them or delete the app.
• Data held by AssemblyAI: as soon as transcription completes, the app calls AssemblyAI's delete endpoint, which removes both the uploaded audio and the transcript from AssemblyAI's servers. AssemblyAI retains certain metadata for logging and billing. If a delete call fails, it is not retried, and in that rare case the audio and transcript remain subject to AssemblyAI's standard retention until removed.
• Data held by Anthropic: the Anthropic Messages API is stateless. Each call is an independent request and response, with no stored, retrievable document and no conversation history. Under Anthropic's standard commercial retention, request and response data is retained for up to 30 days, then deleted, and is never used to train Anthropic's models without our express permission. If a request is flagged for a Usage Policy violation, or where required by law, Anthropic may retain it for up to 2 years.
• Subscription records: Apple retains your transaction and billing records per its own schedule. We hold only a live entitlement status, refreshed from StoreKit.
• Support email: retained as long as reasonably necessary to resolve your issue, then deleted.
• Beta interest: retained until you opt out, until release, or for a maximum of two years — whichever comes first.

12How We Secure Your Personal Information

• On device. On iOS, iOS Data Protection encrypts app storage at rest and the iOS app sandbox isolates YostNotes data from other apps. On Android, data is encrypted using Android's file-based encryption and isolated within the app's private storage directory.
• In transit. Audio and text sent to our AI providers are transmitted over encrypted connections (TLS). CloudSync data is also transmitted over TLS, and is encrypted on-device before transmission — the transport layer carries only ciphertext.
• At our providers. AssemblyAI encrypts data at rest (AES-128/256) and in transit (TLS 1.2+), is SOC 2 Type 1 and Type 2 certified, and offers a data processing addendum with Standard Contractual Clauses. Anthropic processes data under its commercial terms and security program.
• CloudSync end-to-end encryption. When CloudSync is active, note content is encrypted on your device with AES-256-GCM under a key only you possess (derived via PBKDF2-HMAC-SHA256 at 600,000 iterations). Cloudflare D1 stores and transmits only ciphertext and never receives your passphrase, data key, or any plaintext. Encrypted data resides in the EU West (WEUR) region.

No method of transmission or storage is completely secure. We recommend not recording highly sensitive conversations you would not want processed by a cloud service, and not including highly sensitive details in support emails.

13Third-Party Websites or Platforms

YostNotes may include links to external websites. Once you leave the app or the yost.group website, this policy no longer applies. We are not responsible for the privacy practices of third-party sites.

14Children's Privacy

YostNotes is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us personal information, contact info@yost.group and we will delete it promptly.

15Jurisdictional Rights

Depending on where you live, you may have specific rights regarding your personal information. The sections below address California (CCPA/CPRA) and the EEA, Switzerland, and UK (GDPR). Users elsewhere may contact info@yost.group to exercise equivalent rights.

16California — CCPA / CPRA

This section applies to California residents under the CCPA as amended by the CPRA.

Exercising Your Rights

Email info@yost.group with "CCPA Privacy Request" in the subject line. We will verify your identity and respond within 45 days, extendable as the CCPA allows.

17EEA, Switzerland & UK — GDPR

This section applies to users in the European Economic Area, Switzerland, and the United Kingdom.

Automated Decision-Making

AI summaries are content tools and do not produce legal or similarly significant effects about you. We do not subject you to automated decisions that produce such effects.

Complaints

You may lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

18Changes to This Policy

We will update this page when we make material changes and revise the Last Updated date. For significant changes, we will surface a notice inside the app on its next launch.