OxNotes1.Data controller
This policy applies to the OxNotes app for Android and to this website. Data controller: Banse Bruno, an independent developer based in Abidjan (Côte d’Ivoire). Contact: contact@oxnotes.site.
It is drawn up in accordance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) for users in the European Union, with Ivorian law no. 2013-450 of 19 June 2013 on the protection of personal data, and with the rules that apply in countries where the app is distributed through Google Play.
2.Principle: local first
Your notes are saved on your device. The Publisher does not receive them: there is no notes server. Notes, photos, drawings, voice memos, transcripts, text recognized in photos, organization and settings stay on the phone.
The app contains no advertising, no analytics and no crash reporting, and does not sync notes. The Internet is only used for the Pro purchase (Google Play) and for the Google Drive backup that you start. No data is sold.
3.Data processed
| Data | Where | Who can access it |
|---|---|---|
| Notes, photos, drawings, voice memos, recognized text, preferences, reminders, widgets | Device | You only |
| Protected notes | Device, encrypted | You, after authentication |
| Recovery key | Never stored in clear by OxNotes | You only |
| Google account e-mail (optional) | Device | You; Google |
| Drive backups (Pro, optional): encrypted notes, media as you choose, device model, date, note count | The app’s private folder in your Drive | You; Google (encrypted content) |
| Pro purchase | Google Play; signed receipt on the device | Google; the Publisher (Play order data) |
| Support messages | The Publisher’s mailbox | The Publisher |
Purchase. Payment is handled by Google Play: the Publisher does not receive your bank details. The receipt is verified on the device, with no Publisher server.
Drive. Without signing in to a Google account, no backup takes place. OxNotes only accesses its reserved folder (drive.appdata), the sign-in identity and the account e-mail, to display it. New copies are encrypted on the phone before upload with a key protected by your recovery key.
Microphone, dictation, photos. Microphone access is used to record a memo when you ask. Dictation uses Android’s on-device recognition engine (Android 13 or later, language installed); a voluntary language-pack download may go through the Android service provider. Text in photos is read by an ML Kit model embedded in the app, without uploading images; the ML Kit diagnostics upload path is disabled.
4.Purposes
- Run the app and protect your notes.
- Back up and restore your notebook, at your request.
- Sell, verify and restore the Pro purchase.
- Answer your support requests.
5.Legal bases
| Processing | Legal basis |
|---|---|
| Local operation and Pro features | Performance of the contract (the terms of use) |
| Drive backup | Explicit consent, revocable at any time |
| Pro purchase | Performance of the contract; accounting and tax obligations |
| Support | Your request; the Publisher’s legitimate interest |
6.Recipients
Your data is never sold, rented or handed over for commercial purposes. Depending on your choices:
- Google LLC (Google Play Billing): distribution, payment, purchase verification.
- Google LLC (Google Drive and Google sign-in): storing backups in your own account, restricted
appdatafolder. - Support mailbox: the messages you send to contact@oxnotes.site.
See Google’s privacy policy. Content you share to another app falls under that app’s rules.
7.Transfers outside your country
The Publisher is based in Côte d’Ivoire. Data entrusted to Google may be processed in other countries, including the United States, under Google’s safeguards (EU-US Data Privacy Framework, standard contractual clauses or an equivalent mechanism).
8.Retention periods
- Notes and preferences: on the device until deleted. Trash: 30 days. Uninstalling the app or clearing its data deletes the notebook.
- Drive backups: several generations per installation; they stay in your Drive until you delete them (“Delete Drive copies” button or Google Drive settings). Copies created by preview versions may not be encrypted; they are not changed retroactively and can be deleted.
- Pre-restore copy: one only, encrypted, on the device.
- Proof of purchase: kept by Google Play for the legal accounting and tax periods.
- Support exchanges: at most 24 months after the request is closed.
9.Security
- Data isolated in Android’s private space; Android automatic backup disabled.
- Protected notes: AES-256-GCM, non-exportable Android Keystore key, usable after authentication. OxNotes never receives your fingerprint or face.
- Screenshots blocked; generic notifications and widgets for a protected note.
- Exchanges with Google Drive and Google Play use HTTPS.
- Google Drive scope limited to
drive.appdata: OxNotes can neither read nor modify your other Drive files.
Limits. Encryption does not hide the number, colors or dates of notes, nor label and folder names. An export or a shared copy is no longer protected. A compromised device can bypass these protections. Without the key, a protected note or an encrypted backup cannot be recovered, including by the Publisher.
10.Android permissions
| Permission | Use |
|---|---|
| Internet, network state | Pro purchase and Drive backup only |
| Microphone | Voice memos and dictation, when you ask |
| Notifications | Reminders and displayed notes |
| Exact alarms | Reminder at the scheduled time, if allowed |
| Boot | Reschedule reminders after a restart |
| Biometrics | Open protected notes |
| Foreground service, wake lock | Finish an ongoing Drive upload |
| Google Play billing | Purchase and restore Pro |
No access to contacts or location, nor to the camera (taking a photo goes through the system app).
11.Your rights
In accordance with the GDPR and Ivorian law no. 2013-450, you have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent.
- Notes: view, export and delete them in the app; the Publisher does not hold them.
- Drive: “Disconnect” stops backups; “Revoke access” removes the authorization; “Delete Drive copies” erases the copies.
- Publisher data: write to contact@oxnotes.site (a personal reply to every request).
If you believe your rights are not respected, you may complain to the competent supervisory authority: ARTCI in Côte d’Ivoire, the CNIL in France, or the authority of your country of habitual residence.
12.Minors
Use of OxNotes is reserved for people aged 16 or over (or the legal age of consent to data processing in your country). A minor must obtain prior permission from their parents or legal guardians before using the app or making a purchase.
13.This website
This site uses no cookies, no analytics and no third-party content. Your language choice stays in your browser and is not transmitted. Like any host, the site’s host may keep standard technical logs (IP address, date, requested page) for security and operation.
14.Changes
The update date is shown at the top of the page. Any significant change will be announced in the app or on this site.
15.Contact
Banse Bruno — independent developer, Abidjan, Côte d’Ivoire.
E-mail: contact@oxnotes.site