Legal

Banora Privacy Policy

The short version

• Your thoughts live on your device. If iCloud Backup is on (it is on by default), they are also mirrored to your own private iCloud — a space we cannot access. Our servers never store your notes, your topic names, or your audio.
• Voice is turned into text on your device, and the recording is then deleted. Audio never leaves your device.
• If you allow AI sorting, the text of a thought is sent — anonymously, with no account identifier — to OpenAI to find its topic. OpenAI does not use it to train models, but may keep it for up to about 30 days for abuse monitoring before deleting it. We will never tell you it is "never stored," because that would not be true.
• We collect no analytics, show no ads, and do no tracking.
• You can export your data and delete your account from inside the app.

The rest of this policy explains everything in detail, including the small print most apps leave out.

1. Who is responsible (the controller)

The controller under the EU General Data Protection Regulation (GDPR) is:

Ala Eddine Bannour (sole proprietor)
Email: hi@banora.dev

(No data protection officer is appointed; as a small sole proprietorship, Banora is below the thresholds of § 38 BDSG — lawyer to confirm.)

2. Where your data lives

Banora is on-device-first. Your thoughts, their topics (categories), and rooms are stored on your device. The only cloud location that ever holds your full note content and topic names is your own private iCloud (Apple CloudKit) — governed by your agreement with Apple, and not accessible to us. (Forensic audit §1, §2.5, §3.)

iCloud Backup is ON by default. You can turn it off anytime in Settings; turning it off removes the iCloud copy (the change applies after you restart the app). The AI toggle and the iCloud toggle are independent: turning AI off keeps thoughts on device, but iCloud Backup still mirrors them to your private iCloud unless you also turn it off — the app tells you this in Settings.

Our own backend (Supabase) holds no content. It stores account, consent, and billing-related metadata only — never your notes, topic names, embeddings, audio, or corrections (§2.2, §5: the legacy content tables were dropped and the deployed relay functions are stateless).

The share extension makes zero network calls — it saves what you share locally, and the main app processes it later (§2.5, ShareViewController.swift).

3. AI sorting (OpenAI)

3.1 What happens, step by step

Everything except the final naming/classification step happens on your device: transcription, semantic embeddings, and the clustering that groups thoughts into rooms are all computed locally and never leave the device (§3, §6).

When AI sorting is on and you have given consent, exactly two kinds of calls go out, both via our stateless relay (device → Supabase edge function → OpenAI); the relay stores nothing (§2.1, §6):

1. Classification — the text of the new thought, your topic names (as the list of options), up to a few short excerpts (≤ ~500 characters) of your other filed thoughts used as examples, and short correction snippets (see 3.4).
2. Room naming — only the cluster member labels (titles / short snippets your device already holds). The grouping itself was computed on-device; only the labels needed for a name are sent.

3.2 Anonymous, not stored by us — but retained briefly by OpenAI

• The requests carry no user identifier — no user ID, no email, no name (§2.1, verified at classify.ts:58-65, openai.ts:13-33). From OpenAI's side the content is pseudonymous.
• The requests are sent with store:false, and your content is not used to train AI models (per our account configuration).
• However: OpenAI does not offer zero retention for this usage. OpenAI may retain the submitted text for a limited period (about 30 days) for abuse monitoring, then deletes it (§2.1). We deliberately do not claim your notes are "never stored" — that claim would be false.

3.3 Turning AI off later does not un-send the past — and old thoughts can still be sent later

This is subtle and we want you to understand it (§4.1, disclosed by founder ruling):

• With AI off, a newly captured thought is not sent at capture time.
• But the app computes on-device embeddings for all thoughts, including those captured while AI was off (a background step that runs at launch regardless of the AI setting).
• If you later turn AI on, a thought you filed into a topic during the AI-off period can be picked as a "nearest example," and a short excerpt of it (up to ~500 characters) sent — anonymously — to OpenAI to help sort a new thought.
• This only applies to thoughts you filed into a topic, only if they rank among the few most similar, and always without any identifier.

The in-app consent screen states this same behavior before you decide.

3.4 Corrections as examples

When you move a thought to a different topic, the app may keep a short snippet of that correction on your device and send it — anonymously, alongside a later classification request — as an example that improves future sorting (§2.1, §4).

3.5 Your choice, and how it is enforced

AI sorting requires your explicit consent on first run, and can be switched off anytime in Settings (AI categorization toggle). Content-bearing calls run only when both the consent flag and the toggle are on — enforced in code on every capture path, including the share extension and Siri (ConsentStore.swift:20-24). Declining changes nothing else: capture, transcription, and storage keep working; thoughts simply stay unsorted until you opt in.

4. What our servers store (Supabase)

Production holds exactly six tables (§2.2), none of which contain note content:

5. Subscriptions (Apple and RevenueCat)

Payments are processed by Apple through your Apple ID; we never receive your payment card details (§2.3). RevenueCat manages subscription state for us and receives your subscription ID (which equals your Banora user ID) and purchase/subscription data.

Three things worth knowing plainly:

• Deleting your Banora account (or signing out) does not cancel your Apple subscription. Subscriptions are managed and cancelled in your Apple ID settings. If you delete your account without cancelling, Apple will keep billing you. (The in-app deletion flow removes your data; it makes no subscription-cancellation call — see the Terms, section "Cancelling".)
• "Restore purchases" re-attaches an existing, still-active subscription bought with your Apple ID — it does not charge you again. Use it instead of buying again on a new device or a re-created account.
• If you restore while signed into a different Banora account than the one that bought the subscription, the entitlement moves: the new account gains Pro and the previous account loses it (revenuecat-webhook/index.ts:48-50).

6. Sign in with Apple, and the one-Apple-ID model

Signing in sends Apple's identity token and a one-time nonce — nothing else. We never request your name; your email is present only if you chose to share it with us via Apple (§2.4).

Banora assumes one Apple ID = one account = one person. Signing in with the same Apple ID always returns the same Banora account (AuthService.swift:78-81), and your iCloud backup lives in the iCloud of the device's Apple ID. If you share an Apple ID with someone, they can reach your account and your iCloud copy; Banora is not designed for shared Apple IDs.

7. Sync between your devices — honest edge cases

If iCloud Backup is on, your devices sync through your private iCloud. Sync is "last write wins," per whole record (accepted product policy, hardening ruling T11): if you edit the same thought on two devices, the edit with the newer timestamp replaces the other one entirely — the two are not merged, and the older edit is lost.

• Clock skew: the winning edit is chosen by your devices' own clocks (each edit stamps a last-updated time; the newer stamp wins — ThoughtDetailView.swift:562-566, DedupReconciler.swift:174-179). A device with a wrong clock can therefore make an older edit win over a newer one, or vice versa.
• Deleted thoughts can come back ("resurrection"): if one of your devices is offline when you delete a thought on another device, the offline device can re-introduce that thought into iCloud when it next syncs (hardening ruling T37 — accepted single-device deletion scope). If a deleted thought reappears, delete it again while your devices are online; removing the app from a device you no longer use also prevents this.
• Offline first run: during onboarding, the step that sorts your first thought needs the network. If you are offline (or the classifier is busy), the screen visibly waits and retries — it does not silently skip (OnboardingFlowView.swift:21-23, 548-549). Connect to the internet to continue.

8. How long we keep things (retention)

9. Deleting your account, exporting your data

9.1 Deletion — in the app, today

Profile → Delete Account & Data (two confirmations). What happens:

• Our servers delete your account row and everything cascading from it (profiles, usage_events, client_events; v4_rate_events purged explicitly). Only the sanitized purchase records survive, because tax law requires it (§ 147 AO).
• The deleting device wipes its local copy and your iCloud zone.
• Your other devices: any device that is signed in and comes online detects the deletion (a verified server proof, not a guess) and then wipes its own local copy too — this is device-verified behavior.
• Dormant devices lag: a device that is offline, or whose sign-in token has expired, cannot confirm the deletion and deliberately does nothing destructive until it can — so deletion on such a device may lag until you next launch the app on it with a network connection. Until then, the data on that device is untouched (kept, not deleted). This caution exists so that a temporary sign-in glitch can never destroy the only copy of a live account's data (AccountDeletionPropagation.swift:41-53).
• If the deleting device's local wipe fails midway, the app offers Try again, or Sign Out Anyway — which keeps the device copy and says so explicitly.

9.2 Export — in the app, today

Profile → export. You receive a JSON file built from your device (it works offline), containing your profile metadata, topics, entries (transcripts, titles, timestamps), rooms, corrections, and nudge dismissals. The file itself lists what is included and what is excluded, with reasons. Excluded, and why (AccountService.swift:295-320):

• Raw audio — transcribed on-device and never stored; your transcripts are included instead.
• ML embeddings — derived on-device metadata, not your content.
• Seed/catalog exemplars — bundled app content, not your data.
• Routing/telemetry internals — internal diagnostics, not your content.
• Purchase/tax audit records (revenuecat_events) — sanitized purchase records German tax law requires us to keep server-side for 10 years; they also survive account deletion.
• Usage metering records (usage_events) — timestamps and entry IDs used to meter free recordings; auto-deleted after 180 days and removed immediately when your account is deleted.

9.3 Signing out

Signing out keeps everything on the device: "Your thoughts stay on this device — and in your iCloud backup if it's on. You can sign back in anytime." (the app's own sign-out dialog). Unsent compose drafts are also kept — they are stored per-account on the device, survive sign-out, and reappear when the same account signs back in (PreferenceKeys.swift:42). Account deletion, by contrast, wipes them with everything else.

10. Who receives data (recipients and processors)

We do not sell personal data, and no third party receives it for advertising or analytics. There are no third-party analytics, advertising, or crash-reporting SDKs in the app (§1, §2 — verified; the app's privacy manifest declares tracking = false).

11. International transfers

OpenAI and RevenueCat process data in the United States. Transfers rest on an adequacy decision (EU–US Data Privacy Framework, where the recipient is certified) and/or EU Standard Contractual Clauses. Note that what reaches OpenAI carries no identifier (§2.1), which materially limits transfer risk. Apple processes data under your own agreement with Apple. Our backend involves no international transfer: it is hosted on Supabase in Frankfurt, Germany (EU).

12. Legal bases (Art. 6 GDPR)

Withdrawing consent (turning AI sorting off) is as easy as giving it and does not affect the lawfulness of prior processing. Note the honest limitation in §3.3 about previously filed thoughts becoming examples if you later turn AI back on.

13. Your rights

You have the right of access (Art. 15 — the in-app export covers this in practice), rectification (Art. 16 — edit your thoughts directly), erasure (Art. 17 — in-app account deletion, §9.1), restriction (Art. 18), data portability (Art. 20 — the export is machine-readable JSON), and objection (Art. 21, in particular against the legitimate-interest processing in §12). Contact us at hi@banora.dev for anything the in-app tools don't cover.

Complaint: you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — in Germany, the authority of your federal state or ours — or the authority where you live or work.

14. Children

Banora is not directed at children. AI sorting relies on consent; in Germany, consent in the context of information-society services requires a minimum age of 16 (Art. 8 GDPR).

15. Changes to this policy

We will update this policy when the app's data handling changes and indicate the new effective date. Material changes to what is sent off-device will additionally be surfaced in the app before they apply.

This document is undergoing legal review; it will be updated if that review requires changes.