Note67

GDPR overview

The site says nothing whatsoever about the GDPR. This is silence rather than a refusal: the words GDPR and data protection appear nowhere on any of the three pages of note67.com, nor in the project repository. No privacy policy, no terms of service, no data controller, no Article 27 representative and no DPO are published, and the site exposes no email address at all. Nothing therefore documents lawful basis, subject rights or transfers. In practice the architecture makes the point partly moot: processing is local, so the publisher receives no personal data and can hardly act as a controller over it. A professional recording third parties remains the controller of that processing on their own machine, and must handle consent, information and retention themselves, without help from any document supplied here.

Who owns the data?

No terms of service and no privacy policy are published, so nothing contractually states who owns the data. What the site does state is architectural: no accounts, no subscriptions, no data collection, and processing that happens entirely on the user's device. Recordings, transcripts, summaries and notes live in a local SQLite database on that machine, and no transfer to the publisher is described or technically required. In practice the user holds the data outright, because no one else ever receives a copy. That guarantee rests on the AGPL-3.0 source code, which anyone can audit, rather than on any legal undertaking — a distinction worth weighing before professional use.

Reuse rights

There is no contract to grant or restrict anything: the publisher issues no terms of service, so no clause claims a licence over what users record or write. Because audio, transcripts, summaries and notes never leave the device, the user can reuse them freely, without asking anyone's permission — they are simply files on their own computer. Notes export to Markdown, and audio files can be downloaded from within the app. The counterpart of that freedom is that the data is used for nothing else either: the site states it collects nothing, no telemetry is documented anywhere, and no remote model is called. The AGPL-3.0 licence governs the software itself, not the content produced with it.

Data retention & training

Hosting summary

There is no hosting of user data to describe: Note67 stores everything on the machine it runs on, in a local SQLite database, and images pasted into notes are kept locally and removed when the note is deleted. No jurisdiction, country or region is mentioned anywhere, and none applies, since no recording, transcript, summary or note is transmitted to a remote server. Transcription models run locally through Whisper, and AI summaries are produced by a model the user installs themselves via Ollama, so the AI layer adds no remote processing either. The only infrastructure involved is the marketing site itself, served behind Cloudflare from an anycast address geolocated in the United States; that concerns the three public web pages, not user content. One consequence is worth noting: since nothing is hosted elsewhere, there is also no remote backup, and the safety of the data depends entirely on the user's own machine.