Privacy Policy

Effective date: 25 October 2026

This privacy policy applies to the Minutify (formerly My AI Notes) app ("the app", "we", "us") for iOS, together with any related services. It explains what data the app collects, where it is stored, who processes it, and the rights you have. We wrote it to match what the app actually does. If anything here is unclear, email us at gregory.timofeev@linked-robot.com.

1. Data Controller Information

The Data Controller responsible for processing your personal data is Grigorii Timofeev preduzetnik Beograd, Makenzijeva 37, 11000 Belgrade, Serbia. The Data Controller can be contacted at gregory.timofeev@linked-robot.com.

For data protection inquiries and to exercise your rights, please contact the Data Controller at this address.

2. What information the app obtains and how it is used

Your notes are stored in your Minutify account in the cloud, so they sync between the devices you sign in on. That covers audio recordings, transcripts, AI summaries, extracted action items, tags, note ratings, translations, and your Ask AI conversations. Text is stored in Google Cloud Firestore and audio in Google Cloud Storage, both under your user id (Section 11 says where). The app uploads the audio of every recording you make, and of every audio file you import, to your account. Notes you made before this version of the app, with their audio and your Ask AI conversations, are uploaded to your account the first time the updated app runs.

Each device you sign in on also keeps a working copy in a local database, so the app works without a connection; changes sync when you are back online. Search in the app runs on the device, over this local copy. Ask AI and the Daily Summary work differently: our server makes search vectors (embeddings) from your transcripts and summaries and stores them with your account's data, and uses them to find the notes that matter for a question or a day. If you delete the app, the copy on that device is removed; the copy in your account stays until you delete the note or your account (see Sections 16 and 17).

To use the app you sign in with Sign in with Apple or Sign in with Google, handled by Firebase Authentication. We store a small profile document for your account in Google Cloud Firestore, keyed to your user id. It contains:

• your account email (when your sign-in provider shares it) and display name,
• a user id and which provider you used to sign in,
• your subscription status and plan metadata,
• your answers to the onboarding questions (how often you take notes, what about, and how often you look back at them), and a profile label the app derives from your topic answers, if you gave them,
• created and updated timestamps.

Access to this document is restricted so that only you (your signed-in account) can read or write it. We use this information to run the app, keep your account signed in, apply your subscription, respond to support requests, and keep the service secure.

3. Legal basis for processing your personal data

Where the GDPR (or the UK GDPR) applies, we rely on one or more lawful bases to process your personal data:

• Contract performance: processing needed to provide the app and its features to you — for example, running your account, storing your notes and syncing them between your devices, transcribing your recordings, summarizing them when you ask, and managing your subscription.
• Consent: where you have given explicit consent — for example, sharing a thumbs-down note snapshot. You may withdraw consent at any time without affecting processing that happened before withdrawal.
• Legitimate interests: where processing is necessary for our legitimate interests, such as keeping the service secure, preventing fraud and abuse, fixing crashes, and understanding how the app is used at a high level, provided those interests are not overridden by your rights. We also rely on this basis to measure, in a privacy-preserving way, whether our ads lead to installs (see Section 8). You can object to this processing at any time (see Section 22).
• Legal obligation: to comply with laws or valid government requests.

4. Cookies and similar technologies

Minutify is a mobile app, not a website, so it does not use browser cookies or advertising cookies. It relies on third-party SDKs (Firebase for authentication, Firestore, Cloud Storage, Cloud Messaging, Crashlytics, and Analytics) to provide its features. For analytics and for privacy-preserving ad measurement (Apple's SKAdNetwork, Apple Ads attribution through Apple's AdServices framework, and Firebase's on-device conversion measurement, described in Section 8), the app uses device identifiers and similar technologies rather than advertising cookies. You can object to this non-essential measurement at any time (see Section 22).

5. Automated decision-making and profiling

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The AI in the app generates transcripts, summaries, and action items from the content you record — it does not make decisions about you, score you, or build a profile of you.

6. Information the app collects automatically

Beyond your account data, the app collects a limited amount of technical information automatically through Firebase:

• Crash reporting (Firebase Crashlytics): crash logs, non-fatal error reports, and technical details about the device and operating system (for example, device model and OS version). It does not collect your note content.
• Analytics (Firebase Analytics): high-level usage events — for example, when a recording starts or completes, when the paywall is shown, and when a subscription starts. Events carry only identifiers, category labels, counts, and durations. Analytics also stores install-level properties, such as the Apple Ads numbers described in Section 8.

Your note content is never sent to analytics. Note titles, transcripts, summaries, action-item text, tag names, and any free-text feedback are not included in analytics events.

7. Precise location

This app does not collect precise real-time location information about your device. It does not request location permission.

8. Advertising and attribution

To measure whether our ads lead to installs, we use Apple's SKAdNetwork, Apple Ads attribution, and Firebase on-device conversion measurement. With on-device conversion measurement, your account email is hashed on your device by the SDK — the plain email is never sent for this purpose.

Each time the app is installed from the App Store, it asks Apple, through Apple's AdServices framework, whether the install came from one of our Apple Ads ads. If it did, Apple gives the app a campaign number, an ad group number, and a keyword number for that ad, and the app stores them as analytics properties in Firebase Analytics. If it did not, the app stores only that Apple had no ad to attribute to the install. The app checks once per install; it asks again on a later launch only if Apple had no answer yet. These numbers describe the ad, not you as a person; like other analytics data, they are kept with your account's analytics profile. We do not share them for advertising (they are excluded from Google Ads audiences), and we do not use them to track you across other companies' apps or websites.

We do not use the Identifier for Advertisers (IDFA), we do not show the App Tracking Transparency prompt, and we do not track you across other companies' apps or websites. This measurement is on by default; we rely on our legitimate interest in measuring our advertising in a privacy-preserving way. You can object at any time by emailing us at gregory.timofeev@linked-robot.com. We will then stop the on-device conversion measurement tied to your account, and we will handle your request about the Apple Ads numbers under your rights in Section 22. Apple's SKAdNetwork reports are operated by Apple, are aggregated, and do not identify you.

9. Artificial Intelligence (AI) technologies

This is the part to read carefully. The app uses AI to turn your recordings into transcripts, summaries, answers, and translations. To do that, our own server (Google Cloud Run) sends content from your account to third-party AI providers. The app itself never talks to an AI provider directly.

• Transcription: when you stop a recording or import an audio file, the app uploads the audio to your account in Google Cloud Storage. If you have Minutify Pro or its free trial, our server sends the audio to xAI Speech-to-Text to transcribe it into text. The audio stays in your account until you delete the note or your account (see Section 16).
• Title and search vectors: right after transcription, our server sends the start of the transcript to the Google Gemini API to write a title. It also sends the transcript, and later the summary, to the Gemini API to make the search vectors that Ask AI and the Daily Summary use. Notes you made before this version of the app get their search vectors the same way when they are uploaded to your account, the first time the updated app runs.
• Summary and action items: when you tap Create on a note's Summary or Action Items tab, the transcript text is sent to the Google Gemini API, called by our server, to write the summary or extract the action items. Daily and multi-note summaries send the text of the notes they cover; a Daily Summary also sends related earlier notes it found with the search vectors.
• Ask AI: when you ask a question, our server sends the question and the note text it answers from to the Google Gemini API to write the answer. A question about one note sends that note's title, full summary, action items, and transcript. A question across your notes sends the best-matching excerpts, with the title and short summary of each note they come from. Your conversations are stored in your account and sync between your devices.
• Translation: when you translate a note, its summary, transcript, and action items are sent to the Google Gemini API, called by our server. The translation is stored with the note in your account.

Summaries and action items are created only when you tap Create. Without a tap from you, the only AI work is on a recording you stop or an audio file you import (the transcript, its title, and its search vectors), and, once, on the notes you made before this version of the app: when they are uploaded, their text goes to the Gemini API to make their search vectors. Daily and multi-note summaries, Ask AI answers, and translations also run only when you ask for them.

The AI generates content from what you record; it does not make automated decisions about you (see Section 5). Your use of these AI features is subject to the providers' own privacy policies, linked in Section 12.

10. Do third parties see or access your information?

We do not sell your information, and we do not share it for advertising. We share data only with the service providers listed below (our sub-processors), who process it on our behalf to provide the app's features, and only as described in this policy. In addition, if you send feedback from the app, we receive the message you write so we can respond and improve the app. When you give a note a thumbs-down rating, you can choose — with an explicit consent toggle — to share a text-only snapshot of that note to help us diagnose the problem. Only if you turn that consent on do we upload the snapshot to Firestore under your account; it is removed when you delete your account.

11. International data transfers

The Data Controller named in Section 1 is established in Serbia, which is outside the European Economic Area (EEA) and the UK and is not covered by a European Commission adequacy decision. Account data, support correspondence and requests you make under Section 22 are therefore handled outside the EEA and the UK. Separately, the sub-processors below are based in the United States, so storing your notes in your account, using AI features, and using the Firebase services transfers personal data there.

Your account's notes and other text are stored in Google Cloud Firestore in the United States. Your audio is stored in Google Cloud Storage in us-east1 (United States). Our server runs on Google Cloud Run in us-east1 (United States).

Countries outside the EEA and UK may not provide the same level of data protection. Where such transfers occur, we rely on an appropriate transfer mechanism, such as:

• adequacy decisions by the European Commission (or the UK equivalent), where they apply;
• Standard Contractual Clauses (SCCs) approved by the European Commission, with the UK addendum where applicable;
• other safeguards or derogations recognized under GDPR Chapter V, including your consent where legally permitted.

12. Third-party sub-processors

The app uses the third-party services below. Each has its own privacy policy that governs how it handles the data it receives.

13. Disclosure

We may disclose your information:

• as required by law, such as to comply with a subpoena or similar legal process;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• to the trusted service providers listed in Section 12, who work on our behalf, do not have independent use of the information we disclose to them, and have agreed to the protections described in this policy.

14. Data Processing Agreements

Where the GDPR applies, we enter into Data Processing Agreements (DPAs) with the third-party service providers that process personal data on our behalf, as required by Article 28 of the GDPR. These agreements impose data protection obligations consistent with this policy.

15. Your opt-out rights

The app uploads every recording to your account so it syncs, and our server transcribes it if you have Minutify Pro or its free trial. Summaries, action items, Ask AI answers, and translations are made only when you ask for them. You can stop further collection of information by uninstalling the app; uninstalling stops the app from collecting data from your device, but it does not delete your account, the notes stored in it, or information already sent to the providers in Section 12. To delete your data, use the in-app account deletion described in Section 17, or contact us at gregory.timofeev@linked-robot.com.

16. Data retention

We keep data only as long as needed for the purposes described in this policy:

• Notes, audio, transcripts, summaries, action items, tags, translations, and Ask AI conversations (Firestore and Cloud Storage): kept in your account until you delete them. A deleted note waits in Deleted for 30 days. The next time the app runs on one of your signed-in devices after those 30 days, the note is erased from your devices and from our servers, with its audio and search vectors; deleting it permanently from Deleted erases it sooner. Small markers stay for about 30 days so your other devices learn about a delete: a deleted note's marker holds no content, and a deleted tag's marker keeps the tag's name. When you clear your Ask AI history, the questions and answers are erased. Each conversation leaves a marker for about 30 days that holds no questions or answers, only its settings: whether it was about one note or all your notes, the id of that note or of the tag it was limited to, its time filter, and when it started. Deleting your account erases all of it (Section 17).
• The working copy on each device: kept until you delete the note, delete the app, or delete your account.
• Account profile and subscription metadata (Firestore): kept while your account exists and deleted when you delete your account.
• Usage counters (Firestore): per account and per month, the minutes transcribed and the number of AI calls and tokens used, with no content. Kept while your account exists and deleted when you delete your account.
• Push-notification tokens (Firestore): kept while you are signed in on that device; removed when you sign out of that device, when Firebase reports that the token no longer works, or when you delete your account.
• Consent-gated feedback snapshots (Firestore): kept until you delete your account; deleting your account removes them.
• Feedback messages (Firestore): the messages you send from the app are kept until you delete your account; deleting your account removes them.
• Crash and analytics data (Firebase): retained per Firebase's standard retention for these services.
• Account deletion marker: after you delete your account, a record with no content, keyed to your user id, stays for about seven days so that no server job still running can recreate your data.

Data already sent to the AI providers in Section 12 is governed by their own retention policies, linked there.

17. Data deletion

You can delete your account from inside the app: Settings → Account → Delete Account. Deletion removes:

• your notes in your account: transcripts, summaries, action items, tags, translations, and the search vectors made from them,
• your audio recordings in Cloud Storage,
• your Ask AI conversations,
• your usage counters and the push-notification tokens of your devices,
• your feedback snapshots and the feedback messages you sent from the app,
• your Firestore profile document,
• your authentication account,
• the data on the device you delete from (notes, audio, transcripts, and the rest).

The app erases the copy in your account first, then your authentication account, then the data on the device. Another device still signed in to the account erases its own copy and signs out the next time it opens with a connection.

For step-by-step instructions, see Delete Account. If you cannot use the in-app option, email gregory.timofeev@linked-robot.com and we will process your request within the time required by applicable law.

18. Children

Minutify is not intended for children under 13 (or under 16, or a higher age, where a higher age of digital consent applies under local law). We do not knowingly collect personal data from children. If you believe a child has provided personal information, contact us at gregory.timofeev@linked-robot.com and we will remove it.

19. Security

Your notes and audio are stored in your account on Google Cloud. Firestore and Cloud Storage security rules limit them to your signed-in account: no other user can read or change them. Our server reaches them only to do the work this policy describes. We apply standard technical and organizational safeguards. No security system can prevent all possible breaches, but we work to protect the information we process and maintain.

20. Data breach notification

If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, with information about the nature of the breach, the data affected, and the steps taken to address it.

21. Changes to this policy

We may update this policy as the app changes. When we do, we update the effective date at the top. Material changes will be reflected here before they take effect, and where required by law we will seek your consent. This policy is effective as of the date shown at the top of this page.

22. Your GDPR data protection rights

If the GDPR or UK GDPR applies to you, you have the following rights:

• Access: request access to your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data (the "right to be forgotten").
• Restriction: request that we limit how we use your data.
• Portability: request a copy of your data in a structured, commonly used, machine-readable format.
• Object: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where processing is based on consent, withdraw it at any time — for example, by leaving the feedback-snapshot toggle off.
• Automated decision-making: we do not carry out automated decisions with legal or similarly significant effects (see Section 5).

You also have the right to lodge a complaint with your local Data Protection Authority. If you are in the UK, you can contact the Information Commissioner's Office at ico.org.uk.

23. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the CCPA and CPRA give you additional rights over your personal information:

• Right to know: request the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of personal information we collected from you, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at gregory.timofeev@linked-robot.com. You may designate an authorized agent to make a request on your behalf.

24. How you give your consent

Where processing is based on consent, you provide it by affirmatively opting in to the relevant feature or action — for example, turning on the feedback-snapshot toggle. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases (contract, legitimate interests, or legal obligation) is carried out as described above.

25. Contact the Data Controller

The Data Controller for the app is Grigorii Timofeev preduzetnik Beograd, Makenzijeva 37, 11000 Belgrade, Serbia. For any privacy question, or to exercise your rights, email gregory.timofeev@linked-robot.com. We will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.