VelNotes Privacy Policy

Last updated: October 16, 2026

This Privacy Policy explains which categories of personal data are processed through the VelNotes mobile app and velnotes.com, why that data is used, where it may be stored or transferred, and which rights you may exercise. It covers the data-protection framework for core product flows, including note creation, audio/video transcription, local-first storage, iCloud notebook sync, iCloud safety backup, and data export.

1. Data Controller and Scope

Data controller: Yunus İşlegel, the individual developer who publishes VelNotes (App Store seller: YUNUS ISLEGEL), Türkiye. Contact: support@velnotes.com

In this policy, "VelNotes", "we" and "us" refer to this data controller. Scope includes the mobile app, marketing and support pages on the website, iCloud notebook sync, the iCloud backup / restore-check flow, data export, direct email communication, and Apple StoreKit subscription verification.

2. Categories of Data Processed

2.1 App, support, and contact data

The VelNotes mobile app is designed to work without a VelNotes account. It does not keep an in-app email/password account, Google sign-in session, or notebook-linked VelNotes profile. The app and website do not offer a support form that asks for a name, email address, or phone number. If a user chooses to email us from their own email app, the sender address and message content are processed as part of ordinary email delivery.

2.2 Device, website, and security data

The mobile app does not send a persistent remote user ID, device list, or notification/sync verification token for automatic notebook-content transfer. To check for a new version, the app sends Apple's App Store lookup service (itunes.apple.com) a request that contains only the VelNotes app ID; no notebook content or personal details are added. As with any internet request, Apple can see connection details such as the IP address. The website may process request timestamps, IP address, user-agent, and limited technical logs needed for abuse prevention. For website analytics, a country code inferred from request headers (and when needed Accept-Language fallback) may be processed for country/region distribution reporting. To preserve the selected website language (Turkish, English, Spanish, Portuguese, Japanese, Arabic or French), the page may read a language value from the URL and, where preference cookies are allowed, a local on-device preference record; this does not create a separate server-side language profile. Website admin access may use Google/Firebase authentication only for authorized administrators; that administrator session is not a mobile-app user account. Device-local biometric lock checks using Face ID / Touch ID or device passcode fallback are handled by the operating system on the device; VelNotes does not access, store, or transmit biometric template data to its servers.

2.3 Notebook and content data

Notebook/page titles, text, drawing payloads, shapes, stickers, sticky notes, text boxes, GIFs (including GIFs made on the device from a video you choose in GIF Studio), study tapes, math results, imported PDF-page backgrounds, cover/theme metadata, and deletion timestamps may be processed. This content is stored local-first in the app data area by default. When the user starts backup or export, a backup archive or export file may be created according to the selected destination. VelNotes does not edit text or objects inside a source PDF. An imported PDF page remains an immutable background; the app processes only the drawings, text, images, stickers, and shapes the user adds on top. Input preferences such as Finger Writing Mode are stored in on-device settings by default. Where voice and Video to Text features are used, user-approved transcription text may be added to notebook content. During local video import, the audio track of the supported media file the user chose may be extracted on device; VelNotes does not download videos from YouTube or third-party links. Pages captured through camera/document-scanner flows, images imported from the photo library, and image/video exports saved to the photo library at the user's request may also be processed as content data.

Handwriting assistance and personal style

Handwriting assistance and numerical math recognition run on this device. The My Writing profile includes confidently recognized word text and normalized stroke samples. My Writing builds a bounded profile from confidently recognized stroke samples on this device. The profile is not uploaded to a server or included in system backups. Reset it in pen settings without deleting notebook ink. Generated ink and math results may be backed up, synced and exported with the notebook. Words you confirm in the correction screen join an on-device personal dictionary; resetting your style clears it too.

Handwriting assistance uses a main model and an on-device fallback recognition system. On devices that require a download, the main model for your selected language is prepared automatically over Wi-Fi on first use and stored on the device. If the model is not ready or Wi-Fi is unavailable for the initial download, the fallback system continues recognition; accuracy can differ and results should be checked. When Wi-Fi becomes available, the app automatically resumes model preparation. A ready model is not downloaded again for each use; recognition works on the device without internet access.

Handwriting recognition and Math help run on your iPad. VelNotes uses Apple's on-device recognition and Google ML Kit Digital Ink for this. ML Kit is used in two cases: when Math help is on, to read handwritten digits and operators (always the same en-US model, whatever the app language), and to recognize handwriting on device/language combinations the operating system does not support directly. The model it needs is downloaded once from Google, over Wi-Fi only, and kept on the device; recognition then runs on the device without internet access. Your handwriting and the recognized text are not sent to Google or VelNotes. ML Kit sends Google technical diagnostics: a random per-installation ID, device and app information (model, OS and app version), the configured recognition language, and usage events with performance and error data (such as model downloads, recognitions, latency and error codes). Google says it uses this data for diagnostics and usage analytics and that the installation ID is not meant to identify you or your device; VelNotes does not receive it. Details: Google's ML Kit data disclosure.

In VelNotes 2.1 and later, iCloud Sync is on by default when iCloud Drive is available. Your notebooks and folders are copied to your own iCloud Drive and reach only your other devices that use the same Apple Account; they are not sent to VelNotes servers and are governed by your Apple Account and iCloud security settings. Sync also keeps earlier versions of your notebooks in the sync folder in your iCloud Drive. You can check sync or turn it off from the cloud icon on Home. Sync is not a backup: changes and deletions made on one device also reach your other devices. Safety backup and data export are separate operations.

2.4 Feature usage and limit data

On-device usage counters, operation timestamps, and technical status records may be processed for notebook creation/editing, export, backup/restore, and plan-limit enforcement. These records are used for service continuity, anti-abuse controls, and limit management. To protect the Free plan notebook creation allowance and prevent limit bypass through repeated reinstall/reset behavior, VelNotes may keep a device-local lifetime free-notebook creation counter in secure on-device storage (Keychain). This counter is not used for cross-app or cross-site tracking.

2.5 Subscription and payment verification data

The current app reads product identifiers and verified subscription entitlements on device through Apple StoreKit 2. Apple performs the transaction; the app does not send StoreKit transaction IDs, receipts, or a subscription profile to a VelNotes/Firebase server and does not create a separate payment account.

2.6 iCloud backup and data export data

When iCloud Backup is enabled, the app may write a notebook backup archive to the user's iCloud Drive area automatically after local changes or when the user requests a manual backup. In VelNotes 2.0 and later, when iCloud Drive is available, automatic iCloud Backup is on by default for new installs and can be turned off in Settings. A restore check is enabled by default so the latest iCloud backup can be used when no active local notebook exists; it can be turned off in Settings. When the user starts data export, a portable archive may be created with notebook/page data and limited technical metadata needed for restore safety. VelNotes does not send the backup archive to its own server. Apple protects the archive in transit and on its iCloud servers under the user's Apple Account and iCloud Drive security settings; end-to-end encryption depends on whether the user enables iCloud Advanced Data Protection.

2.7 Support and contact data

Contact Us / Report Issue in the app and the website contact link open support@velnotes.com in the device's default email app. VelNotes does not show name, email, or phone fields on these screens, submit an HTTPS support form, or create a Firebase/Firestore contact_messages record. If the user chooses to send the email, its sender address, subject, and message content reach us through the user's email provider and may remain in the support mailbox for the time needed to answer the request. The app creates a random Support ID and stores it in the device Keychain. It contains no name or email address, is not automatically sent to a server, and is included only if the user sends the prepared email; it can then be associated with that support correspondence. The prepared email also adds the app version, iPadOS version, device model and app language along with the Support ID; you can see and remove them before sending.

2.8 Voice recording and transcription data

When voice recording starts, an audio file may be created in app-local recording storage (VoiceRecordings folder, as an .m4a file). These files may remain in that storage until deleted by the user; cleanup flows or technical maintenance can remove them when needed. Recording length limits and local audio/video import vary by plan. If the user exports the file to Files, retention is governed by the selected destination. Audio/video transcription uses on-device speech recognition provided by the operating system when supported; on unsupported devices this feature cannot be used. Video to Text works only with supported local media files the user chooses and within the in-app duration limit. Transcription output is generated automatically and may contain mistakes; users should review results before use. In the default flow, raw audio/video files are not uploaded to VelNotes servers as notebook content, while generated transcript text may be stored on device like other notebook content and included when the user starts backup/export.

2.9 Account and cloud data left from earlier versions

Earlier account-based versions of VelNotes (1.x) may have created the following in Google Firebase: email address, display name, username, profile-photo link, sign-in provider, last sign-in time, device/session IDs, a push token and subscription status; for accounts that used Pro cloud sync, also notebook and page content, uploaded images/PDFs and sharing records. These records are stored on Google Firebase servers (Firestore: EU; Storage and Authentication: USA), and a backup copy is kept in an archive in the EU. The current app does not use these records or create new ones, and it does not upload notebook content to Firebase. Publishing a new release does not delete these records or notebooks stored on your device. We will delete them after giving former users advance notice so they can export their data, and we will announce the deletion date on this page. To have yours deleted sooner or to get a copy, email support@velnotes.com from your account's address.

2.10 Children and students

The VelNotes app asks for no account, name, email address or age, and has no ads or tracking. Google ML Kit receives technical diagnostics for the recognition feature (see 6.1). If your child has emailed us and you want that email deleted, write to support@velnotes.com.

3. Purposes of Processing

Data is processed to provide subscription checks, notebook creation/editing and recovery flows, plan-limit enforcement, iCloud notebook sync, iCloud backup and data export operations, new-version notices, subscription verification, device-permission-based local notifications, anti-abuse and security controls, support handling, and service-quality monitoring.

4. Local-first Processing and Backup Scope

Notebook content you own is local-first by default. When iCloud Backup is enabled, a safety copy may be refreshed automatically after local changes or manually by the user; the restore check for the latest iCloud backup can be managed in Settings. Data export is user-initiated and governed by the destination the user selects. In VelNotes 2.1 and later, iCloud Sync is on by default when iCloud Drive is available and can be turned off from the cloud icon on Home; sync does not replace a backup.

5. Legal Bases

For each purpose we rely on the legal basis below under the GDPR (Article 6(1)). For users in Türkiye, the KVKK legal bases are described in the Turkey Privacy Notice.

Providing the app features you use (notebooks, iCloud sync and backup, data export, transcription, plan limits, Pro access checked through StoreKit, and local notifications you allow): performance of our contract with you (Art. 6(1)(b)). Most of this processing happens on your device or in your own iCloud account.

Answering emails you send us: performance of a contract where your message is about the app you use; otherwise our legitimate interest in replying to you (Art. 6(1)(b) and (f)).

Google ML Kit technical diagnostics (see 6.1): our legitimate interest in offering on-device handwriting and math recognition through Google's SDK (Art. 6(1)(f)).

App Store new-version check: our legitimate interest in telling you about updates (Art. 6(1)(f)).

Operating and securing the website (loading live site content, rate limiting and abuse prevention, including processing of IP addresses, the fonts and icons described in the Cookie Policy, and administrator sign-in to the admin panel): our legitimate interest in running a working and secure website (Art. 6(1)(f)). Storing your cookie choice is part of this.

Remembering your website language and counting visits (optional preference and analytics storage): your consent (Art. 6(1)(a)), which you can withdraw at any time via Cookie settings.

Account and cloud data left from earlier versions (see 2.9): our legitimate interest in an orderly transition and in answering requests about this data (Art. 6(1)(f)).

Meeting legal obligations, such as answering data-protection requests and reporting personal data breaches: legal obligation (Art. 6(1)(c)).

6. Third-Party Services, Sub-processors, and International Transfers

VelNotes uses Apple services (StoreKit, iCloud Drive, operating-system speech recognition, and the App Store version check) and website/admin infrastructure services. The website, administrator-only admin panel, live site configuration, and consented web analytics may use Firebase/Google infrastructure. Support and issue-report messages are not sent to Firebase; emails the user sends reach us through the user's email provider. This Firebase use does not create an iOS app account or automatic notebook-content transfer. Audio/video transcription does not require transfer to a separate third-party speech provider; it relies on supported on-device capabilities. Cross-border data transfer may occur through these infrastructure providers.

6.1 Service Providers and Recipients

The following providers receive personal data in connection with VelNotes:

Apple Inc. — Subscription verification (StoreKit 2), iCloud Drive sync and backup area, on-device speech recognition (Speech.framework), and an App Store new-version check (only the app's ID is sent). Location: USA. Processed under the Apple Developer Program License Agreement.

Google LLC (ML Kit Digital Ink) — Model download and basic technical diagnostics (random installation ID, device model, OS and app version, recognition language, and usage events with performance and error data) for reading handwritten digits and operators when Math help is on, and for handwriting recognition on device/language combinations not directly supported by the operating system. Handwriting and recognized text are not transferred. Location: USA. Google processes these diagnostics for its own diagnostics and usage-analytics purposes, so it is a separate recipient rather than a processor acting for VelNotes.

Google/Firebase — Works on behalf of VelNotes for authorized administrator Google sign-in, the website admin panel, live site configuration, admin media management, storage of the account and cloud data left from earlier versions (see 2.9), and consented web analytics. It is not used by the current iOS app for notebook-content synchronization. Location: Google Firebase servers (USA and EU).

6.2 International Data Transfers

The servers of these providers are outside Türkiye, mainly in the USA and the EU, so personal data is transferred abroad when the services above are used. For transfers from the EU/EEA to Google LLC in the USA, Google LLC's certification under the EU-U.S. Data Privacy Framework applies. Data you keep in iCloud and purchases you make through the App Store are handled by Apple under your Apple Account and Apple's own privacy policy.

7. Retention and Deletion

Data is retained only for as long as needed to provide the service safely and to satisfy applicable legal obligations. When retention is no longer necessary, technical deletion, anonymization, or access-removal processes are applied. After a data deletion request, relevant support/operational records enter cleanup flows. Each time an item is moved to Trash, a new deletion timestamp is written. Restoring the item clears that timestamp; if it is deleted again, the 30-day period restarts from the latest deletion. Unless permanently deleted earlier, an item may remain in the local database and, when enabled, the iCloud safety copy until the 30-day boundary. On the first eligible app maintenance run at or after expiry, it is removed locally, excluded from new backups, and removed from the iCloud archive when that archive is read or refreshed. If the device is off, the app is not running, or iCloud is unavailable, the operation completes on the next eligible run. In VelNotes 2.1 and later, iCloud Sync keeps earlier notebook versions in the sync folder in your own iCloud Drive; these versions are currently not deleted automatically and are not sent to VelNotes servers. Turning sync off does not delete these files. You can remove them by deleting VelNotes data in your iCloud storage settings (Settings > [your name] > iCloud > Manage Account Storage > VelNotes); this also removes the iCloud safety backup. Security and anti-abuse logs (including IP address and user-agent) may be kept for limited periods under legitimate-interest and legal-obligation grounds. Sent support emails may remain in the VelNotes mailbox and the ordinary retention or backup systems of the email providers for the period needed to answer the request and meet legal obligations; they enter deletion flows when no longer needed. Voice recordings are stored in app-local recording storage by default; users can delete them, and cleanup actions may remove them where applicable. If a file is exported by the user, retention depends on the selected destination. Free-tier local notebook data may be lost on uninstall or device loss unless a backup exists. Exported archives remain under the selected destination's control and can be manually removed by the user.

8. Cookies and Similar Technologies

velnotes.com uses strictly necessary technical storage and preference mechanisms. Website analytics, used only with your consent, counts visits by page, referring site and country/region, using a random visitor ID stored in your browser; country/region is evaluated via country code inferred from request headers without requesting client geolocation access. Optional categories (preferences and analytics) are consent-based; you can change or withdraw your choice at any time via Cookie settings in the footer. See Cookie Policy for details.

9. Security Measures

Security controls include the app sandbox and file protection, on-device Keychain use, StoreKit verification, website rate limiting and abuse monitoring, and authorized-account/role checks for the admin panel. Absolute security over internet transmission cannot be guaranteed.

10. User Rights and Requests

You may request access to your personal data, correction of inaccurate records, deletion, objection to processing, and permission-management actions, including managing local/iCloud backups and turning iCloud sync on or off, and managing notification permissions through operating-system settings. Contact: support@velnotes.com.

You also have the right to restrict processing, to data portability, to withdraw consent at any time without affecting earlier processing (for website cookies, via Cookie settings in the footer), and to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live or work, or with the UK Information Commissioner's Office. In Türkiye you may complain to the Personal Data Protection Board after first applying to us.

11. Data Breach Notification Procedure

In the event of a personal data breach, VelNotes follows the procedure below:

72-hour rule: In accordance with GDPR Article 33 and KVKK Article 12/5, if unauthorized access to or processing of personal data is detected, notification will be made to the relevant Data Protection Authority (and where applicable, the relevant EU Supervisory Authority) within 72 hours at most.

User notification: If the breach poses a high risk to users' rights and freedoms, affected people whose contact details are available will be contacted directly; where they are not available, notice will be provided through an appropriate method such as the website or an in-app notice, as soon as reasonably possible. The notification will include the nature of the breach, affected data categories, potential consequences, and measures taken or planned.

Contact: If you suspect a data breach, please contact support@velnotes.com.

12. Policy Updates

VelNotes may update this policy when product features, infrastructure providers, or legal requirements change. The updated text becomes effective on the publication date and remains available on the website.