Privacy

Your notes #

Two kinds of thing get confused on pages like this, so here they are apart. Your notes are files in a folder on your device; the app opens, writes and closes them the way a text editor does. The measurements are about the app — one of our screens was reached, a vault took this long to open, a write failed here in our code, the app stopped there. The code that sends those does not read the notes folder. On the crash-and-diagnostics side it could not if it tried: every word we put in a report comes from a fixed list compiled into the app, and anything not on that list is dropped before it reaches the network. Two things ride along that we do not author, and they are named here rather than glossed over — the crash itself, which is a stack trace the system produced out of code we shipped, and a set of facts about the phone that Sentry attaches to everything it sends. Both are itemised below.

When you write a note, a model running on your device reads it and proposes what it understood. The text is not sent anywhere to be interpreted, and nothing enters your pages until you confirm it. Where the model is unavailable, writing and organising by hand is a complete path rather than a fallback.

You will be able to check that rather than take our word for it. Put the phone in Airplane Mode and write a note: on a device that can do the reading, it is still read and still filed. Or put it behind a proxy for a week — you will see the requests listed below, and your notes in none of them. Expect traffic on an ordinary launch and not only after something breaks: the app opens a diagnostics session and records that it started before you have typed a character. That is on the list below too.

We do not log the content of your notes. Not the text of one, not a person’s name, a place or a date taken from one, not the name of a file in your vault — a filename here is somebody’s name — not a quoted phrase, and not a shortened, hashed or summarised version of any of it. None of it reaches an analytics event, a crash report, or a breadcrumb on the way to one.

What we do measure is counted rather than quoted, and we would rather list it than imply there is nothing. How long a vault took to open and roughly how big it is; whether a write worked; which of our screens you reached; how many facts a confirmation wrote and whether it wrote anything at all. Those are numbers about our software doing its job, and none of them can be turned back into a sentence you wrote. There is no advertising identifier, no advertising network and no data broker; nothing is sold, and nothing you write trains anybody’s model.

A note moves off your device only when you start it moving: iCloud sync, or an export you make yourself. Neither route passes through us, and we have no way to open what arrives at the other end.

What the app sends, and who receives it #

Relational is not on the App Store yet, so most of this has not happened to anybody. It is published before it ships rather than after, and it is deliberately in more than one tense: Sentry and PostHog are in the app and sending today, both to servers in the European Union; RevenueCat is in the app and started on every launch; and Apple has nothing to sell you yet. Every line below says which of those it is. All of it is about the app rather than about what you write in it.

• Sentry — crashes and diagnostics. In the app and sending today. Hosted in the European Union: the address compiled into the app is ingest.de.sentry.io. It hears from the app on an ordinary launch and not only when something breaks — a session opens and the app records that it started. After that it receives the same twenty-six events PostHog does — the list is under PostHog below, and it is one list rather than two on purpose — and, because crashes are the reason Sentry is here at all: crashes; freezes longer than two seconds; terminations the system made while the app was in the background; and a trail of the last hundred of those steps to give the next one context. A crash also carries the stack trace the system produced, which is function names and file paths of code we wrote and shipped. With every one of those the SDK attaches its own picture of the phone, and it is longer than a sentence: your device model and hardware family, whether it is a simulator, the processor architecture, how much memory the phone has and how much is free, the screen size in pixels, the battery level and whether it is charging, low-power and thermal state, which way the phone is being held, the iOS name, version, build and kernel version, whether the phone is jailbroken, the language, region, calendar and time zone it is set to, and our app’s name, identifier, version, build and how long it took to start. None of that is read out of a note; all of it is what a proxy will show you. No screenshot, no view hierarchy, no attachment, no request body and no performance trace — every one of those is switched off by name rather than left at a default, because the defaults were wrong and once put a vault filename into a report. Every word we put in a report is on a list compiled into the app, and anything not on that list is dropped before it leaves the device — which is a rule about our own code, not about the two things named above that we do not author.
• PostHog — how the app is used. In the app and sending today. Hosted in the European Union: the address compiled into the app is eu.i.posthog.com. It receives the same twenty-six events Sentry does, from the same place in our code, because one list is checkable and two lists drift. They are: the app started; the app came back to the front; a vault was created, opened, checked, or failed to open; a fault was found in one; a write failed; edits you made in the Files app were taken up, or could not be; two of your devices disagreed about a note and how many disagreements there were; whether your device can do the reading; the reading was already worked out before, finished, or failed; a note was confirmed; a confirmation was undone; a fact was retracted; your people list was loaded; a person’s page was opened; a purchase was started or finished and how it ended; purchases were restored and whether you had ever owned one; the list of plans was fetched; your subscription standing was worked out; and one of our screens appeared. Each carries counts, timings, yes-or-no answers, version numbers, and words from a list compiled into the app — how many facts a confirmation wrote, deferred or hid and whether it wrote anything at all; how many pages changed; how many people are on your list and how many share a name; how many facts, roles, happenings and notes are on a person’s page; how many people, relationships and events the reading found; how long something took; and, when something fails, which kind of failure it was. Alongside those, PostHog’s own observer records four things about the app’s lifetime — it was installed, updated, opened, backgrounded — and stamps every event with the app version, your device model, your iOS version, your language and region, and a session number. Autocapture is switched off by name: no screen names taken from our view controllers, no recording of taps by their accessibility label, no session replay, no surveys, no push-notification capture, and no profile of you as a person. No event has a free-text field, and none carries anything taken out of a note.
• RevenueCat — whether you have paid. In the app and started on every launch. Purchasing.start() runs from AppEnvironment as the app comes up, so it configures itself and asks the store what you are entitled to. It receives the receipt Apple hands the app, which product you bought, when it renews, and a random identifier made on your phone. It is given no name, no email, and no attribute taken from a note. It answers one question: is this subscription active. That is how a subscription follows you to a new device. Nothing on that path is given a note, a name out of one, or a way to reach your vault.
• Apple — payment. Not yet: there is nothing to buy. There is now payment code in the app and a test configuration for it, but no product exists on the App Store and nothing in the app offers to sell you anything. When it does, Apple is the seller and takes the money. We never see your card, your name, your billing address or your Apple Account, and Apple’s sales reports count purchases without naming buyers.

Each of them is reached over the network, so each one sees the IP address your device connects from, the way every server you talk to does. Sentry is configured not to attach it to a report. PostHog’s server sees it the same way, and it is set to discard the address rather than store it on the event. The location lookup that used to run before that discard, turning an address into a country and a city, is switched off. Neither of those is a line in our code, so neither is something you could check by reading the app: both are settings in our PostHog account, and we would rather name them than let the app imply a promise it cannot keep. The connection still arrives from your address either way, and a proxy will show you that.

Four identifiers leave the phone today. Two of them are Sentry’s. The first is random: the app makes a value the first time it runs, keeps it in its own cache folder, and sends it with the session that opens at launch. Delete the app and install it again and a new one is made. The second is not random and we would rather you heard it here than found it — Sentry fingerprints the phone, mixing the per-developer identifier iOS gives us with the hardware model and our app’s name, and attaches the result to everything it sends, crash reports included. It is the same value every time on the same phone, so it is the one that could follow you between two reports. Neither is your name, your email or your Apple Account, and neither is joined to anything we hold. We intend to strip the second one rather than describe it forever; until that ships, this is what a proxy will show. The app also does not yet show you any identifier it sends, which it must before the deletion route below is worth anything; both are owed, and both are written down as owed in this page’s own source. PostHog makes a third, and it is the mildest of them: a random value for this installation, deliberately not reused if you delete the app and install it again, and attached to no profile — the app never tells PostHog who you are, and is configured never to create a person record at all. RevenueCat makes a fourth: an anonymous app user id the SDK mints itself the moment it configures, which happens on every launch rather than only when you subscribe. Restoring a subscription lets RevenueCat match that identifier, through Apple’s receipt, to the purchase you already made.

Catch the app talking to a company that is not named here and we have made a mistake we want to hear about: contact@relationalnotes.com.

Where your notes live #

Relational stores your notes as plain files in the app’s own folder, visible in the Files app. That is what makes exporting them real rather than a promise, and why you are not locked in to us.

It has a cost and we would rather you heard it from us. Anyone holding your unlocked phone can open that folder, and any app you grant Files access to can read it. The security boundary for your notes is the device itself — your passcode, Face ID, and who you hand the phone to. The app adds no second password on top, and does not claim to.

iCloud sync is off until you turn it on. If you do, your notes are copied to your iCloud account rather than to us, and we have no way to open what arrives there. Apple can read what is in iCloud unless you have Advanced Data Protection switched on, and most people do not. That is Apple’s setting rather than ours, and we would rather say so than let you assume otherwise.

Your notes stay readable and exportable as plain text in every payment state, including after you stop paying.

This website #

relationalnotes.com counts nothing. This site loads no script and sets no cookie: the only things your browser fetches here are the page, one stylesheet, and on the home page four screenshots, all from this domain. Check it in View Source or your browser’s network panel, which is the point of saying it. Vercel, which serves the site, keeps the ordinary server logs any web server keeps.

This section used to describe a page-view counter, and that counter never ran. The script tag sat on every page and the path it pointed at returned 404. It is named here rather than quietly corrected, because a page that asks to be checked has to say when it was wrong.

What you can ask us for #

Depending on where you live, you may have the right to see, correct, export or delete the personal data a company holds about you. Your notes are not part of it: they are on your device, and you export or delete them yourself without asking us.

What we will hold is the list above. There are four identifiers today — two Sentry’s, one PostHog’s, and one RevenueCat mints on your phone — and the app shows you none of them — so for now the honest answer is that we cannot look you up, and neither can you. The first release must show you what it sends, and then you can quote it: send it to contact@relationalnotes.com and we will tell you what is stored under it, or delete it.

One more thing we hold is worth naming. If you email us, we have your address and whatever you wrote, for as long as it takes to help you and to keep a record of the conversation. You can ask us to delete that correspondence and we will.

Relational is not directed at children, and we do not knowingly collect anything from one.

Who we are #

Relational is made and published by Aaron Internet, a sole proprietorship registered in Ontario, Canada. This policy is written under Canadian privacy law. For anything about privacy, write to contact@relationalnotes.com.

When this changes #

The list under What the app sends is closed: those companies, those events, and no others. Adding one is an edit to this page and a new date at the top before it is anything else, and this section says what changed. The same goes for a tense: a vendor moving from not yet to sending is a change to this page, and the last time it happened the page did not notice for a day.