Privacy policy
Last updated: 23 October 2026 (account active in the app)
This policy explains which personal data the QuickMemo app for Wear OS and for phones (Android, and iOS once available), the quickmemo.it website and the QuickMemo online services process, why, for how long, and what your rights are. It is written under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). The Italian version is the reference text.
In short
- Your voice notes stay on your devices. They go straight from your watch to your phone and never reach us, unless you turn on sync or online transcription.
- You can use the app without an account. The account and sync with our server are optional.
- No ads, no selling of data, no profiling and no usage analytics.
- The only data the app sends on its own is the technical report of a crash, through Google's Firebase Crashlytics, so that we can fix bugs.
- You can delete your notes and your account at any time, and write to us to exercise your rights.
1. Data controller
The data controller is Giuseppe Sorce.
For any question about this policy or your data, write to privacy@gisourcestudio.com. We reply within one month, as the GDPR requires.
We have not appointed a data protection officer (DPO), as it is not required for the size and type of processing.
2. Features active in this version
QuickMemo is being tested. The version distributed to testers today includes recording on the watch, transfer to the phone, note management on the phone, local reminders, crash reports and the optional account (sign-up, email confirmation, sign-in, password recovery).
Syncing notes with the server and online transcription are not active in the app yet: today no note, audio or transcript is sent to our servers. On-device transcription and deleting the account from the app will arrive in a later version; until then you can ask for deletion as explained in section 10. The sections about features not yet active apply once they are available; if the way they handle data differs from what is written here, we will update this policy before turning them on.
3. Data processed, feature by feature
3.1 Recording on the watch
- The microphone turns on only when you press the record button, and stops after at most 30 seconds or when you stop it. The app never records in the background or without you knowing.
- The audio (16 kHz) and the note details (date, time, duration) are saved in the app's private storage on the watch, which other apps cannot read.
- You can play back or delete the recording before sending it. The note goes to the phone only after you confirm it, and the copy on the watch is deleted once the phone confirms it has saved it.
3.2 Transfer from watch to phone
- The note goes from the watch to its paired phone through the Wearable Data Layer of Google Play services, with no need for internet and without passing through our servers.
- When the devices are close, the transfer uses an encrypted Bluetooth channel. When Bluetooth is not available, Google Play services may route it through Google's servers with end-to-end encryption: according to Google's documentation, only your two devices can read the content.
- We do not receive or see the notes being transferred.
3.3 Notes on the phone
- The phone keeps the audio, the title, the tags, the transcript (when there is one), the edits you make and the reminder dates. Everything is saved in the app's private storage.
- Android automatic backup is turned off for QuickMemo, so this data does not end up in your Google Drive backup.
- If you do not turn on sync, this data never leaves the phone.
3.4 On-device transcription
Once available, standard transcription will run entirely on the phone, with a Whisper model included in the app and no internet connection. Neither the audio nor the text is sent to anyone.
3.5 Reminders
Reminders are local notifications scheduled on the phone. The date and time stay on the device (and on the server only if you sync that note). To show them the app asks for the notification and exact alarm permissions, and reschedules them after a restart.
3.6 Account (optional)
You can use QuickMemo without an account. If you create one, we process:
- email address, to sign in, confirm the account, recover the password and send service messages;
- name (optional), to show it in the app;
- language for emails (Italian or English), taken from the device language when you sign up;
- password: handled by our authentication server (Keycloak), which keeps only a hash, never the plain password;
- the version of the terms you accepted and when (by signing up you accept the Terms of Service and this policy, as the sentence at the bottom of the screen says), the date your email was confirmed, and when the account was created and changed;
- the technical session data (access and refresh tokens) that keep the app signed in. For links sent by email we keep only a cryptographic fingerprint (hash), not the link itself.
On the phone the app keeps your email and name, so it knows who is signed in even offline. The token that keeps you signed in is encrypted with a key held in the Android Keystore (or the iOS Keychain), is not included in backups and is not moved to another device; the access token, valid for 10 minutes, stays in memory only. When you sign out, the app forgets this data at once and also ends the session on the server as soon as it is online. The app talks only to our server api.quickmemo.it, always over HTTPS.
Confirmation and password recovery emails are sent from noreply@quickmemo.it through the Brevo service. We do not send newsletters or promotional emails.
3.7 Sync with the server (optional)
If you have an account and turn on sync (for all notes automatically, or one note at a time), our server stores, for the notes you sync: the audio, title, recording date, duration, file format and size, a file checksum, the transcript and its language, the tags and the reminder date. This keeps your notes safe and lets you find them on your other devices. When you delete a synced note, the server keeps only a deletion marker (without audio), so that your other devices delete it too.
Each account has a storage limit (150 notes or 500 MiB of audio). To enforce it the server keeps a count of notes and bytes used.
3.8 Online transcription (optional, for subscribers)
If you have a paid plan and choose online transcription, the note's audio is sent to our server, which transcribes it with a Whisper model running on our own systems. The audio is not sent to third-party transcription services and is not used to train models. The audio stays on the server with the note and is deleted completely when you delete the note or the account: audio files are not copied into backups, so no copy remains.
3.9 Crash reports
The Android phone app uses Firebase Crashlytics, a Google service. When the app closes because of an error, it sends a technical report with:
- the error trace (which part of the code failed) and the state of the app at that moment;
- device information: model, operating system version, orientation, free memory and storage;
- a random installation identifier, used to count how many devices are hit by the same error.
The report contains no audio, note text, email or name. We do not use Google Analytics or any other usage analytics tool.
3.10 Website and servers
When you visit quickmemo.it or the app talks to our servers, the web server records in its technical logs the IP address, date and time, requested page, result and browser type. The authentication service also uses the IP address and email to limit repeated sign-in attempts (protection against attacks), with counters kept in memory only. The website uses no cookies, loads nothing from other sites and has no tracking tools.
4. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Recording, transferring, playing back, transcribing on the device and managing notes | This data stays on your devices and we have no access to it. It is used at your request, to provide the service you chose (Art. 6(1)(b)). |
| Creating and managing the account, sending service emails | Performance of the contract, that is the terms of service you accept (Art. 6(1)(b)). |
| Sync and online transcription | Performance of the contract (Art. 6(1)(b)): you turn them on and can turn them off at any time. |
| Crash reports | Legitimate interest in fixing bugs and keeping the app stable and secure (Art. 6(1)(f)). The data is technical and kept to a minimum; you can object by writing to us. |
| Server logs and sign-in attempt limits | Legitimate interest in the security of the service and in preventing abuse (Art. 6(1)(f)). |
| Answering requests or complaints, meeting legal obligations | Legal obligation (Art. 6(1)(c)) and legitimate interest in defending our rights (Art. 6(1)(f)). |
We make no decisions based solely on automated processing that produce legal effects on you (Art. 22 GDPR).
5. Providers and recipients
We do not sell or hand over your data. These providers process it on our behalf, as processors (Art. 28 GDPR), and only for the purposes above:
- Server provider: Hostinger, with its data centre in the Netherlands. It hosts the website, the authentication service, the database and, if you use them, your synced notes.
- Brevo (Sendinblue SAS, France): sending confirmation and password recovery emails. It receives your email address and the content of the email.
- Google (Google Ireland Limited and Google LLC): Firebase Crashlytics for crash reports; Google Play for distributing the app. The transfer between watch and phone goes through the Google Play services on your device, under Google's terms.
We may have to disclose data to authorities where the law requires it.
6. Transfers outside the EU
Our server is located in the Netherlands and Brevo processes data in the European Union. Google may also process crash report data in the United States: in that case the transfer relies on the EU-U.S. Data Privacy Framework adequacy decision, which Google has joined, and on the European Commission's standard contractual clauses.
7. How long we keep data
| Data | Period |
|---|---|
| Notes on the watch | Until the phone confirms it received them, or until you delete them. |
| Notes on the phone | Until you delete them or uninstall the app. |
| Account never confirmed | Deleted automatically after 7 days. |
| Links sent by email | The confirmation link is valid for 24 hours, the password reset link for 30 minutes; their fingerprint is deleted 7 days after they expire. |
| Confirmed account and synced notes | Until you delete the note or the account. Audio is deleted at once and completely, because it is not included in backups. The profile, titles, tags and transcripts are deleted at once from the database; the nightly backup copies that contain them expire within 14 days. |
| App sessions | Expire after 60 days without use, or when you sign out or delete the account. |
| Crash reports (Crashlytics) | 90 days. |
| Web server logs | 14 days |
| Sign-in attempt counters | In memory only, for a few minutes or at most one day. |
8. Security
- All communication with our servers is encrypted (HTTPS with TLS 1.2 or 1.3).
- Passwords are handled by Keycloak and stored only as hashes. Email links are stored only as hashes and temporary tokens are encrypted.
- The database cannot be reached from the internet; nightly database backups (without audio files) stay on the server and are deleted after 14 days.
- On the devices, data lives in the app's private storage, protected by the operating system.
No system is 100% secure. If a data breach affecting you occurs, we will notify the Italian data protection authority and, where the law requires it, you as well.
9. App permissions
- Microphone (watch): to record notes, only when you press the button.
- Notifications and exact alarms (phone): for the reminders you set.
- Run at startup (phone): to reschedule reminders after the phone restarts.
- Internet access (phone): for the account and crash reports and, once you use them, for sync and online transcription.
You can revoke permissions at any time in the device settings; the features that depend on them will stop working.
10. Deleting notes and your account
- A note: delete it in the app. If it was synced, it is deleted from the server too.
- All data on the device: uninstall the app, or clear the app's data in the Android settings.
- The account: write to privacy@gisourcestudio.com from the account's address, as explained on the Delete your account page; we delete it within 30 days and confirm by email. In a coming version you will also be able to do it in the app, in the account section, confirming your password. Deletion removes the profile, credentials, all sessions and the synced notes on the server. Notes on the phone stay until you delete them.
11. Your rights
Under the GDPR you can ask us at any time to:
- know whether we process your data and get a copy (access, Art. 15);
- correct it (rectification, Art. 16);
- delete it (erasure, Art. 17);
- restrict its processing (Art. 18);
- receive it in a structured, machine-readable format (portability, Art. 20);
- object to processing based on legitimate interest, such as crash reports (objection, Art. 21).
Write to privacy@gisourcestudio.com. We may ask you to confirm your identity, for example by writing from the account's address. It is free, and we reply within one month.
You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work.
12. Children
You must be at least 14 years old to create an account. QuickMemo is not meant for children and does not knowingly collect data from minors below this age. If you believe a minor has given us data, write to us and we will delete it.
13. Changes to this policy
We will update this page when the app or the services change, in particular before turning on the account, sync and online transcription. The date at the top shows the last change. If a change significantly alters how your data is used, we will tell you in the app or by email.