Privacy Policy
Effective date: October 17, 2026 · Updated: October 27, 2026
Stun Labs LLC, a United States company, operates StunNote's app, website and web workspace. Contact us about privacy or support at support@stunnote.com.
1. Information and purposes
- On-device content: titles, images, recordings, OCR text, notes, review material and preferences can remain on your device. Local OCR uses device-side recognition. Operating-system or device backups may also contain this information under your backup settings.
- Accounts: email, internal account ID, password-derived authentication information, membership status and any display name or avatar you provide are used for authentication and account functions. Passwords are not stored as plain text. If you choose Google sign-in, Google provides a verified email, stable account identifier and available display name to authenticate or link your account. We do not receive your Google password or request access to Gmail or Drive.
- Cloud features: when you choose sync, we receive the session information and media included in that sync. Cloud OCR can send selected images to our infrastructure and OpenAI. Slide redrawing sends the selected image, session title and reviewed page text to OpenAI. AI summaries can send relevant page titles, OCR text and your notes to OpenAI. We store cloud content, generated slide images, processing results and summaries to provide the features you request. We send a hashed internal account identifier for image-processing abuse prevention; this is not your email address.
- Payments and referrals: we handle subscription identifiers, purchase verification receipts/tokens, entitlements, usage and referral codes/click IDs to verify access, enforce allowances, prevent fraud and manage referrals. Payment providers handle card details; the app does not ask you to enter card numbers into StunNote.
- Analytics and diagnostics: when enabled in a build, core actions, results, durations, counts, app version, platform, language, plan, and anonymous or internal account identifiers help improve the product. Diagnostics include error types, code stacks and standard app/system/device information. Hosting/network providers receive technical request information, including IP addresses, in order to serve requests.
- Support: we handle information you send to our support email to respond to your request. Do not send passwords, payment credentials or unnecessary sensitive material.
2. Service providers
| Provider | Service and information involved |
|---|---|
| Cloudflare | Hosting, APIs, cloud media storage and image-processing infrastructure; necessary request information and cloud content. |
| Neon | Database storage of account, session, content metadata, usage and subscription records. |
| OpenAI | Requested cloud OCR, slide redrawing and AI summaries using selected images or relevant text described above. Provider retention terms apply; we do not promise zero retention by every AI provider. |
| Mixpanel | Core product analytics and standard SDK technical properties. Our custom events exclude note/OCR/summary text, images, recordings, email addresses, media paths and purchase receipts. IP-based geolocation and automatic interaction capture are disabled in our app integration. |
| Sentry | Error/crash diagnostics. The Dart-event filter removes original error messages, request contents and arbitrary extra data. Screenshots, replay, view hierarchy and interaction breadcrumbs are disabled. Native crashes may still contain standard OS/device and binary diagnostics. |
| Superwall | Remote subscription screens, where enabled; paywall interactions, SDK technical information, internal account ID, subscription state and referral attributes. |
| Apple, Google, Stripe | Payments, subscriptions, purchase verification and fraud prevention for your purchase channel. |
| Google Sign-In | Optional account authentication, including a verified email, account identifier and available display name. Google's sign-in services also process necessary authentication and technical information under Google's Privacy Policy. |
Providers process information under applicable service agreements and policies. We may disclose information when reasonably necessary to comply with law, protect safety or legal rights, prevent fraud, or complete a business transfer with appropriate safeguards. We do not sell personal information or use the current app integration for cross-app advertising tracking.
3. Permissions, browser storage and sharing
Camera/photo permissions support capture/import; microphone permission supports recording. Optional trial reminders use notification permission for a local reminder. You can change permissions in device settings. Browser local storage maintains sign-in state and language preferences. Referral information may be stored locally for up to 30 days before attribution; attribution expiry is not a promise that all related server records are deleted then.
Publishing a summary creates a link accessible to people who have it and can include selected images. You can revoke publication, but cannot remove copies others have downloaded or shared. Only upload or publish content you have permission to share, particularly other people's confidential or sensitive information.
4. Retention and deletion
Local information remains under your device/backup controls until deleted or the app is removed, subject to operating-system behavior. We retain cloud account/content information while needed for your account and cloud features, until relevant content/account deletion, or for justified security, legal or accounting purposes. Subscription expiry does not automatically purge your content.
Account deletion initiates removal of associated cloud records and media. Backups, provider retention systems or legally required records may retain copies for their applicable retention periods. Analytics and diagnostics are managed separately under project/provider retention settings: deleting an account does not mean every historical event disappears immediately. You may contact us to request review/deletion of account-linked analytics or diagnostics. Retained information is limited to the purpose that justifies retention.
5. Your choices and requests
You can use local features without uploading content, choose cloud features, change permissions, export supported content, delete sessions, revoke shared summaries and delete your account from the app's account settings. Cloud account deletion does not automatically erase local copies or cancel Apple/Google subscriptions; manage store subscriptions with that store.
Depending on your location, you may have rights to access, correct, delete or obtain a copy of information, object to/restrict processing, withdraw consent where relied upon, or appeal a denied request. Email support@stunnote.com. We may verify account ownership and handle requests under applicable law. You can also contact your local data-protection authority. We do not discriminate for exercising applicable privacy rights.
6. International processing and security
Stun Labs LLC is based in the United States. Our analytics/diagnostic projects are configured in the United States; hosting and other providers may process information in the US or other locations. Applicable transfer safeguards depend on the provider and service arrangement. We use measures including encrypted transport for production services, access controls and password hashing. No transmission/storage system is completely secure.
7. Children
StunNote is not directed to children under 13 and we do not knowingly collect their personal information. Contact us if you believe a child has provided information so we can investigate and take appropriate action. Additional age/consent rules may apply in your location.
8. Updates and contact
We may update this policy as services or legal requirements change. The effective date identifies the current version; we provide additional notice for material changes where required.
Stun Labs LLC
Privacy and support: support@stunnote.com