Notes — Privacy Policy

The short version: Notes collects nothing. It has no accounts, no sync, no analytics and no advertising. The app does not have the Android INTERNET permission, so it cannot transmit your notes anywhere. Everything you write — including any location you pin — stays in the app's private storage on your device.

1. Who we are

PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C (“PWN-ALL”, “we”, “our”, “us”) is the data controller for the processing described in this Notice. Our registered address is: 145, Al Mustaqbal street, Iris Bay Tower 2101-11, Business Bay, Dubai, United Arab Emirates.

Commercial licence No. 1324553, Department of Economy and Tourism (DET) · D-U-N-S 571235572 · NCAGE 10G8W

2. What data we collect

None. We do not collect, receive, store, process, sell or share any personal data through this application. We have no servers that the application talks to, and we have no way to see your notes, your passwords or how you use the app.

3. What stays on your device

Everything the application creates is written to the app's private storage, which other applications cannot read:

Data	Where it is kept
Note titles, text, lists and checklists	Local database in app-private storage
Photographs and voice recordings you attach	App-private files directory
Coordinates, altitude and accuracy of a pinned place	Inside the note itself, in the same local database
Settings, the app PIN and the reveal password	App-private preferences, stored as salted hashes — never as plain text
Passwords of protected notes	Not stored at all. A wrong password simply fails to decrypt

Uninstalling the application removes all of it. Deleting a note also deletes its attachments.

Automatic cloud backup and device-to-device transfer are switched off in the application manifest, so your notes are not copied into Google's backup service.

4. Permissions and why they exist

Permission	Purpose	Optional
`RECORD_AUDIO`	Recording a voice memo inside a note. Requested only when you tap the microphone button; the recording is written straight into app-private storage.	Yes — refuse it and only voice memos are unavailable
`ACCESS_COARSE_LOCATION`, `ACCESS_FINE_LOCATION`	Pinning your current place into a note. Requested only when you tap the pin button. The receiver runs only while the panel showing satellites, signal, accuracy and altitude is open, and stops the moment you pin or cancel — there is no background tracking and no location history. The reading is taken through the Android location service on the device, without Google Play Services.	Yes — refuse it and only place pinning is unavailable
`USE_BIOMETRIC`, `USE_FINGERPRINT`	Unlocking the application or a protected note with a fingerprint or face. Biometric data never reaches the application: Android performs the check and returns only a yes or no.	Yes — a PIN or password can be used instead

Above all, the app does not hold the internet permission. You can confirm that yourself on the published package with aapt2 dump permissions com.pwnall.note.apk, or on your phone: Android Settings → Apps → Notes → App info lists every permission an app declares, and there is no network one among them.

5. Encryption of protected notes

A note you mark as protected is encrypted on your device with AES-256-GCM. The key is derived from the password you choose using PBKDF2-HMAC-SHA256 with 210,000 iterations and a random salt unique to that note. Attachments of a protected note are encrypted with the same key.

If you enable fingerprint unlocking for a note, the note's key is wrapped by a key held in the Android Keystore that only releases after a successful biometric check. Enrolling a new fingerprint invalidates that wrapped key, and the password remains the only way in.

6. Exporting your notes

The export feature writes an archive containing your notes and their attachments to a location you choose through the system file picker. You may protect the archive with a password, in which case the whole archive is encrypted with AES-256-GCM using the same key derivation as above.

Once the archive leaves the application it is an ordinary file under your control. If you place it in cloud storage, send it to someone or leave it in a shared folder, its privacy becomes governed by wherever you put it — and by whether you encrypted it.

7. Opening a place in a map application

A pinned place is stored as plain numbers: latitude, longitude, altitude and the accuracy the device reported. Nothing is drawn from the network, so a note with a place still opens with no connection at all.

When you tap the place, the application hands a standard geo: link to Android and Android shows you the map applications installed on your phone — Google Maps, Organic Maps, Yandex Maps, OsmAnd, Maps.me, HERE WeGo or any other. We do not choose for you and we do not bundle any of them.

From the moment you pick one, those coordinates are in that application's hands and its own privacy policy applies. If you would rather not hand them over, the menu on the place offers “Copy coordinates” instead.

8. Third parties

The application contains no advertising SDKs, no analytics SDKs and no third-party trackers. It uses only Google's AndroidX libraries, which run locally and send nothing anywhere.

Distribution happens through Google Play, and Google collects its own data about installs and purchases under Google's Privacy Policy. That processing is outside our control and is not something we receive.

Opening the links in the “About” screen launches your browser and, from that point, your browser's and the destination site's own policies apply.

9. Children

The application is not directed at children and contains no content intended for them. Because no personal data is collected from anyone, none is collected from children either.

10. Your rights

Legislation such as the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the EU General Data Protection Regulation and the California Consumer Privacy Act grants rights of access, correction, deletion and portability over personal data held by a company.

We hold no personal data about you, so there is nothing for us to disclose, correct or erase on your behalf. You exercise the equivalent control directly:

If you believe otherwise, write to legal@pwn-all.com and we will answer within 30 days.

11. Security

We apply the cryptographic and platform protections described above. No system is absolute: data on a device with an unlocked screen, a compromised operating system or root access obtained by an attacker can be exposed regardless of what an application does. Enabling the app lock, a device screen lock and a strong password for protected notes materially improves your position.

12. Changes to this policy

If this policy changes, the revised version will be published at this address with a new effective date, and the change will be described in the application's release notes on Google Play. Material changes affecting how data is handled will not be applied retroactively.

13. Contact