Effective date: 27 August 2026 · App package: com.pwnall.note · App version: 2.9.2
Official downloads: Google Play · Xiaomi GetApps · Huawei AppGallery · Samsung Galaxy Store
INTERNET permission,
so it cannot transmit your notes anywhere. Everything you write stays in the app's private
storage on your device. Speech recognition happens inside the app itself, on your phone's
processor, with a model you install once — nothing is sent anywhere for it. Three things do
involve software outside the app and are described in full below: the browser that downloads
that model file, because the app cannot; a system speech engine, if you pick one instead of the
built-in recogniser — a separate application on the same phone, which for some engines works
over the network; and place reminders, where Android itself watches for your arrival on the
device. The one way notes leave
a device is a transfer you start yourself, from one screen straight into the camera of your
second phone, with no network in between.
PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C (“PWN-ALL”, “we”, “our”, “us”) is the data controller for the processing described in this Notice. Our registered address is: 145, Al Mustaqbal street, Iris Bay Tower 2101-11, Business Bay, Dubai, United Arab Emirates.
Commercial licence No. 1324553, Department of Economy and Tourism (DET) · D-U-N-S 571235572 · NCAGE 10G8W
Questions about the app: pub-android-dev@pwn-all.com. For privacy questions or to exercise your rights: legal@pwn-all.com.
None. We do not collect, receive, store, process, sell or share any personal data through this application. We have no servers that the application talks to, and we have no way to see your notes, your passwords or how you use the app.
Specifically, the application does not collect:
This section is about us. Where the app hands something to another application on your phone — your speech engine, your camera, your map — you are told so at the moment it happens, and sections 7 to 13 describe every such case.
Everything the application creates is written to the app's private storage, which other applications cannot read:
| Data | Where it is kept |
|---|---|
| Note titles, text, lists, checklists, tables, code, formulas and diagrams | Local database in app-private storage |
| Photographs, drawings, voice recordings and files you attach | App-private files directory. Attachments of a protected note are stored encrypted |
| Text transcribed from a voice recording | Inside the note itself, next to the recording — so it is encrypted along with the note when the note is protected |
| Files of the speech recognition model you install | One folder in app-private storage. The model holds no data of yours; deleting it in Settings, or uninstalling the app, erases it |
| Coordinates, altitude and accuracy of a pinned place | Inside the note itself, in the same local database |
| The place and radius a place reminder watches, and the time of a time reminder | Columns of the note's own row, so that a reminder can fire while the note is closed |
| Tags, folders and the links between notes | Local database |
| Version history — up to 20 previous versions of each note | Local database. For a protected note the stored version is the encrypted text, exactly as the note itself is stored |
| Deleted notes | The bin, for 30 days, after which they are erased along with their attachments. Deleting from the bin by hand erases them at once |
| Settings, the app PIN, the second (duress) PIN and the reveal password | App-private preferences, stored as salted hashes — never as plain text |
| Passwords of protected notes | Not stored at all. A wrong password simply fails to decrypt |
A few files exist briefly in the app's private cache, because Android needs a real file where the app would rather hold bytes in memory: audio decrypted to play back a recording from a protected note, audio decrypted to hand to a speech engine for transcription, an attachment of a protected note decrypted to open it in another application, and the PDF an export produces before you choose where to save it. Each is deleted as soon as the job is done — when playback ends, when transcription returns, when you leave the note.
Installing a recognition model reads the one archive you picked through the system file picker and unpacks it straight into that model folder; a cancelled or interrupted installation leaves nothing behind, and any remains are cleared at the next start.
Uninstalling the application removes all of it. Deleting a note also deletes its attachments, its version history and any text transcribed from its recordings.
Automatic cloud backup and device-to-device transfer are switched off in the application manifest, so your notes are not copied into Google's backup service.
| Permission | Purpose | Optional |
|---|---|---|
RECORD_AUDIO |
Recording a voice memo inside a note, and dictating text into one. Requested only when you tap the microphone button; a recording is written straight into app-private storage. | Yes — refuse it and only voice memos and dictation are unavailable |
CAMERA |
Taking a photograph into a note, and reading the QR frames of the other phone when you transfer notes between your own two devices. The photograph itself is still taken by your camera application, but because this app declares the camera permission, Android will not start that application on our behalf until the permission is granted — so it is asked at the moment of the shot, and asked again if it was withdrawn since. For a transfer it is requested when you open that screen and start scanning; the camera is released the moment you leave it, and no frame is ever stored — each one is decoded and dropped. | Yes — refuse it and only the camera shot and the transfer are unavailable; pictures already on the phone are still attached through the photo picker |
ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION |
Pinning your current place into a note, and setting a place reminder. Requested only when you tap the pin button or set such a reminder. For a pin, the receiver runs only while the panel showing satellites, signal, accuracy and altitude is open, and stops the moment you pin or cancel. The reading is taken through the Android location service on the device, without Google Play Services. | Yes — refuse it and only place pinning and place reminders are unavailable |
ACCESS_BACKGROUND_LOCATION |
Making a place reminder fire while the app is closed — which is the only moment it is any use. Requested once, when you set your first place reminder, after a screen that says plainly what it is for. The app never asks Android for location updates itself: it registers a geofence and Android wakes it only on entry. See section 10. | Yes — refuse it and the reminder still works, but only while the app is open |
POST_NOTIFICATIONS |
Showing the reminder itself. Requested when you set your first reminder. | Yes — refuse it and reminders are set but stay silent |
RECEIVE_BOOT_COMPLETED |
Setting your reminders up again after the phone restarts — Android forgets alarms and geofences on reboot. Granted at install, and it does nothing else. | Not user-facing |
USE_BIOMETRIC, USE_FINGERPRINT |
Unlocking the application or a protected note with a fingerprint or face. Biometric data never reaches the application: Android performs the check and returns only a yes or no. | Yes — a PIN or password can be used instead |
Taking a photograph still hands the job to your camera application and receives the resulting file back. The app itself opens the camera only to read QR frames during a transfer.
Storage permission is deliberately not requested. Picking an existing photograph uses the Android photo picker, attaching a file and saving an export use the system file picker. The application only ever sees the single file you chose.
Above all, the app does not hold the internet permission, so it cannot open a network connection
at all. You can confirm that yourself on the published package with
aapt2 dump permissions com.pwnall.note.apk. That listing is now the whole truth about
the app: a Google AndroidX library used to add ACCESS_NETWORK_STATE to it, and since
version 2.7 we strike that line out of the merged manifest, because a permission we neither need
nor use only makes the list harder to read. No permission in the list allows sending anything
anywhere.
A note you mark as protected is encrypted on your device with AES-256-GCM. The key is derived from the password you choose using PBKDF2-HMAC-SHA256 with 210,000 iterations and a random salt unique to that note. Attachments of a protected note, its transcribed recordings and its version history are all encrypted with the same key.
What is not encrypted, so that the app can show you a list at all: the note's title, its tags and folder, its dates, and whether it has a reminder — including the coordinates a place reminder watches, which have to be readable while the note is closed for Android to watch them. Put nothing secret in the title of a protected note; the body is what is protected.
If you enable fingerprint unlocking for a note, the note's key is wrapped by a key held in the Android Keystore that only releases after a successful biometric check. Enrolling a new fingerprint invalidates that wrapped key, and the password remains the only way in.
The application exports in three shapes, each written to a location you choose through the system file picker:
Once a file leaves the application it is an ordinary file under your control. If you place it in cloud storage, send it to someone or leave it in a shared folder, its privacy becomes governed by wherever you put it — and by whether you encrypted it.
Since version 2.8 the application recognises speech itself, on your phone's processor, with the sherpa-onnx engine compiled into it. Your voice reaches no other application and no server — it could not, without the internet permission. That is what “Own model on this device” in Settings → Speech means, and it is the choice we recommend.
The model is not built in, and the app cannot download it. Weights run from 20 MB to several hundred and every language needs its own, so you install one once, and the downloading is done by you:
github.com/k2-fsa, or a model page on
huggingface.co. From that moment it is an ordinary download: your browser's privacy
policy applies to it, and those sites see the request as they see any other. We are not part of
it and receive nothing;If you would rather use a speech engine installed on your phone, the same setting still offers that, and says the consequence in one line: audio goes to the engine you pick; if it works over the network, the recording leaves the device.
Until you have made this choice — your own model or an engine — dictation does not start at all.
Dictated words are written into the note as the engine returns each phrase, at the cursor or at the end of the note; the audio of a dictation is not saved anywhere.
Transcribing a recording never happens on its own: not when you open a note, not when you stop recording. It runs only when you tap “Transcribe” on that recording. With your own model it is done entirely on the device, for any recording, whatever phone made it. With a system engine it is offered only for one that accepts a file rather than a live microphone, which in practice means a local one you installed for the purpose.
For a recording inside a protected note, the audio is decrypted into the app's private cache just long enough to be read — by the built-in engine, or handed to an external one as a file — and that file is deleted the moment the answer comes back. The resulting text is written into the note itself, which means it is encrypted along with the note.
Search can look inside transcribed recordings, on your device, against that text. Protected and hidden notes are excluded from it, exactly as they are excluded from ordinary text search.
Reading aloud is done by the speech synthesis engine installed on your phone — Google's, RHVoice, eSpeak NG or whichever you use. We do not bundle one. When you tap “Read aloud”, the text of that note is handed to that engine, which is a separate application on the same device, and from that moment its own privacy policy applies to what it does with the text.
Because several engines can speak either locally or through a server, the application asks the engine for a voice that does not require a network connection and selects it when one exists. If your engine offers only network voices, that engine — not this application — may send the text to its own service. You can see and change the engine in Android Settings → System → Languages & input → Text-to-speech output.
A note can remind you at a time or at a place. Both are local: the alarm is set by Android on your phone, the notification is built by the app, and there is no server or account involved — there could not be, without the internet permission.
The reminder appears as an ordinary Android notification carrying the note's title and the beginning of its text, so mind what a glance at your lock screen would reveal. A protected note shows its title and the words “protected note” instead of any content — we cannot read it either. After the phone restarts, the app sets your reminders up again from the same local database.
A place reminder brings a note back when you return somewhere: the shopping list near the shop, “take the keys” at the front door.
The comparison is done by Android's own location service on your phone. The app registers a geofence — the coordinates already stored in the note, plus a radius — and Android wakes it only at the moment you enter that circle. The app never subscribes to your location, keeps no location history, and has nowhere to send one; no map tile and no network is involved, and Google Play Services is not used.
Android 10 and later will only deliver that wake-up to a closed app if you have granted location
“all the time”. That is the sole reason the app declares
ACCESS_BACKGROUND_LOCATION, and it is requested only when you set your first place
reminder, after a screen explaining exactly this. Refusing costs you nothing else: the reminder is
still created, and it fires while the app is open. The app says so rather than failing quietly.
Notes can be moved from one phone to another without any network, account or server. One phone shows a sequence of QR frames on its screen; the other reads them with its camera. Nothing is uploaded anywhere, nothing passes through us, and neither phone needs a connection — this works in aeroplane mode.
How a transfer is protected:
Understand the limit of this, because it is a screen: the inventory frames carry note identifiers, hashes, modification times and attachment file names in the clear, and they carry the key that opens the payload. Encryption protects you from someone who catches a fragment of the exchange — it does not protect you from someone filming both phones from beginning to end. Do the transfer where nobody is recording you, as you would when typing a password.
A pinned place is stored as plain numbers: latitude, longitude, altitude and the accuracy the device reported. Nothing is drawn from the network, so a note with a place still opens with no connection at all.
When you tap the place, the application hands a standard geo: link to Android and
Android shows you the map applications installed on your phone — Google Maps, Organic Maps,
Yandex Maps, OsmAnd, Maps.me, HERE WeGo or any other. We do not choose for you and we do not
bundle any of them.
From the moment you pick one, those coordinates are in that application's hands and its own privacy policy applies. If you would rather not hand them over, the menu on the place offers “Copy coordinates” instead.
Four more places where data crosses the app's boundary, each of them at your request:
If you turn on “hide in recents”, the app also blocks screenshots and the preview Android shows in the task switcher.
Notes can read export files from Evernote, Google Keep, Standard Notes, Bear, Notion, Obsidian, Joplin and plain Markdown or text folders. You pick the file through the system file picker; the app reads that file and writes the notes into its own storage. It contacts no service belonging to those applications — it could not — and it needs no account with any of them. Every import ends with a report of what came over and what could not, because no format converts without loss.
The application contains no advertising SDKs, no analytics SDKs and no third-party trackers. Besides Google's AndroidX libraries — Compose, Room, CameraX, Biometric — it is built from four pieces of third-party code: the speech recognition engine sherpa-onnx and the ONNX Runtime it computes with, a QR encoder and decoder (ZXing), and Apache Commons Compress, which unpacks the model archive. Each is compiled into the application and runs locally; none has a network code path available to it, because the application holds no permission that would open one. Diagrams and formulas in notes are drawn by our own code rather than by a bundled JavaScript engine, for the same reason. The full list with its licences is in the app itself, under “About” → “Licenses”.
A recognition model you install is third-party work as well — Vosk, icefall, Kroko, Whisper, Moonshine, GigaAM, Omnilingual ASR, Dolphin or SenseVoice, each under its own licence and listed on that same screen. It is a file of weights that the app runs on your phone; it has no network path of its own, and downloading it is your browser's doing, as section 7 describes.
Applications already on your phone can receive data from this one, and only when you ask: your camera application when you take a photograph, your speech recognition engine when you dictate or transcribe, your speech synthesis engine when you have a note read aloud, your map application when you open a place, and whatever you choose in the share sheet or to open an attachment. Each is covered above.
Distribution happens through Google Play, and Google collects its own data about installs and purchases under Google's Privacy Policy. That processing is outside our control and is not something we receive.
Opening the links in the “About” screen launches your browser and, from that point, your browser's and the destination site's own policies apply.
The application is not directed at children and contains no content intended for them. Because no personal data is collected from anyone, none is collected from children either.
Legislation such as the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the EU General Data Protection Regulation and the California Consumer Privacy Act grants rights of access, correction, deletion and portability over personal data held by a company.
We hold no personal data about you, so there is nothing for us to disclose, correct or erase on your behalf. You exercise the equivalent control directly:
If you believe otherwise, write to legal@pwn-all.com and we will answer within 30 days.
We apply the cryptographic and platform protections described above. No system is absolute: data on a device with an unlocked screen, a compromised operating system or root access obtained by an attacker can be exposed regardless of what an application does. Enabling the app lock, a device screen lock and a strong password for protected notes materially improves your position.
If this policy changes, the revised version will be published at this address with a new effective date, and the change will be described in the application's release notes on Google Play. Material changes affecting how data is handled will not be applied retroactively.
Since version 2.0 the application gained reminders by time and by place, a home screen widget, import from other note applications, export to Markdown and PDF, drawings, tags, folders, links between notes and a version history — and speech recognition changed twice. Version 2.0 recognised speech with a model built into the app; from version 2.5 that job belonged to an engine you chose on your device, which could be one that works over the network; and since version 2.8 the app recognises speech itself again, with a model you install once and that runs on your phone, while the external engines remain available as a choice. Sections 3, 4, 7, 9, 10, 13 and 14 describe all of it. We still collect nothing.
Questions about this policy or about the application: legal@pwn-all.com · t.me/pwn_all · +971 58 594 6337.
© 2026 PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C. ·
Notes for Android · com.pwnall.note