Skip to main content

​
Our Privacy Promise

At Cleft, your privacy is not just a priority; it is a key part of how we operate. We help you keep your thoughts safe and private.
Key Commitments:
  • We do not train on your data
  • We do not sell your data
  • We adhere to GDPR and CCPA standards
  • We maintain transparency about data handling
Our service aims for:
  • Strong data management controls
  • Robust protection against unauthorized access
  • Consistent availability
  • Risk minimization
We collect and process:
  • Account information
  • Audio notes
  • Transcription data
  • Summary notes
  • Language preferences
  • Usage data
  • Device information
  • Communication records
This information is used to:
  • Deliver and manage services
  • Improve user experience
  • Communicate with users
  • Ensure security
Using Cleft means you have checked to confirm you are okay with our privacy policy. You can always stop using Cleft if you disagree.

​
Your Data Rights

You (our customer) own your data, including:
  • Prepared notes
  • Transcripts
  • Audio files
  • Generated summaries
  • Voice recordings are captured and saved on your device
  • Audio Storage controls what happens next. Upload audio is off by default, so new recordings stay on this device. Upload audio is part of Cleft Plus. With Plus, turn it on to add future recordings to synced notes for cross-device and shared playback. Cleft v1.15.0 turned it off once on every device, including devices that uploaded audio before. Keep audio on this device separately controls whether Cleft retains a playable local copy
  • While upload is off, or you do not have Plus, your recordings stay on that device only. Local retention then stays on, so every recording keeps one durable home
  • Recordings that do upload are stored by Cleft for cross-device access and sharing
  • Download original audio files anytime, and delete a single note’s audio permanently with Delete Audio
  • See Audio Storage settings and Delete a note’s audio
  • All transcription happens on your device, whichever model you choose
  • No audio is sent to external servers for transcription
  • Transcripts are stored locally and synced securely
  • See Transcription settings for the available models
  • Only text (not audio) is processed by our AI systems
  • Custom instructions are processed securely
  • No data is used for model training
  • AI processing follows privacy-first principles

​
Diagnostics and crash reports

Cleft collects nothing about how you use the app until you turn it on. On a new install the usage tool and the crash reporter never start, so there is nothing to send and no ID to send it with.Two separate switches live in Settings → Privacy. Both start off. Cleft asks about them once during setup, and asks once more if you installed Cleft before the question existed. Closing that question records nothing, and Cleft asks again another day.
  • Share how you use Cleft. Turn this on to send bounded counts of which features run and which fail. Cleft creates a fresh random ID for this installation at that moment and sends it with those counts, so a count adds up devices instead of taps. The ID is not linked to your Cleft account and contains no name, email address, or account ID.
  • Add crash and error reports. Turn this on to add technical crash details and join them to those counts, so the team can follow one problem across sessions. It needs Share how you use Cleft on, because the link has nothing to point at otherwise.
  • Device-local. Neither choice syncs through iCloud. Make them separately on each iPhone, iPad, or Mac.
  • Immediate. Turning crash reports off stops the crash reporter while leaving your chosen counts on. Turning Share how you use Cleft off also turns crash reports off, stops new Cleft diagnostics in the same session, and destroys the stored random ID. Turning it back on later creates a new ID rather than restoring the old.
Once you opt in, what Cleft holds is pseudonymous, not anonymous: the random ID stays stable on this installation while the switch is on. Your notes, transcripts, audio, filenames, and email address are never included, whichever way the switches are set.Crash reports keep their technical grouping. Cleft sends crash frames only to the crash-reporting service; usage counts receive a failure count and fingerprint, not the call stack.Automatic network, file, and screen-tracking records are disabled in crash reports. Cleft also removes note identifiers, email addresses, absolute file paths, and overly long values before a diagnostic leaves the app.Older versions of Cleft created a device ID before diagnostics became a choice. If you updated from one of those versions, Cleft deletes that leftover ID at launch and checks it is gone. Your privacy answer stays as it was, and an ID you created by opting in is untouched, so nobody is asked again and no opted-in history restarts. What a provider already received before that change is a separate matter, covered below.A diagnostics provider may retain information it accepted before you turned a choice off, according to its retention policy, and a request already in progress may finish. Turning a choice off is not a promise of remote deletion. Apple-controlled crash and TestFlight sharing follows your device and Apple settings. Apple Watch starts no direct Cleft diagnostics provider and does not inherit the phone’s choice.When you need help with a specific problem, Report a problem in Help & Support writes a plain text file you read before you send it anywhere. Cleft does not collect your notes, transcripts, recordings, or attachments for it, but text you type or paste stays in the file, so review the preview first. See Report a problem.

​
Note titles on an Apple Watch face

Watch complications show the voice mark and optional writing style. They show no note titles or content. An existing Continue complication now starts a new recording, and Cleft clears its retired note-title cache when the Watch app launches. Custom style names remain hidden unless you enable Show Custom Style Name.

​
What your subscription provider sees

Cleft uses a subscription service to check one thing: whether your Plus subscription is active. Cleft does not send that service your name or your email address. In place of your Cleft account number, Cleft moves to a random billing reference made for your account, and uses the account number only as a fallback while that change rolls out so no existing subscription or restore breaks. Plus and Restore Purchases work exactly as before.

​
Features & Security

Free features include:
  • On-device transcription
  • End-to-end encryption
  • Audio storage you control: recordings stay on your device
  • Full data ownership
  • Manual data export
  • Custom AI processing
Additional features:
  • Everything in Basic
  • Extended recording time (30 min)
  • Recording upload for playback on your other devices and in shared notes
  • Advanced integrations
  • Priority support
For account data held directly by Cleft:
  • The current account-retention period is described in the published privacy policy
  • Request earlier deletion through the data-rights process
  • Diagnostics you chose to share follow the separate provider-retention boundary described above
Export your data anytime:
  • Request export through Settings
  • Receive complete .zip file
  • Download individual audio files
  • Export specific notes
  • Save a readable copy of your notes, with a manifest, when you close your account

​
Privacy Controls

  • Secure email authentication
  • No password storage
  • Session management
  • Device authorization
In v1.15.0 or later:
  • Your sign-in, and any AI provider key you added yourself, are kept in the Keychain, the protected store your iPhone, iPad, or Mac already uses for passwords
  • They are tied to that one device. They do not travel through iCloud settings or a device backup, so restoring a backup onto a new device does not carry them across. You sign in again instead
  • Updating Cleft checks the secure copy is safely in place before removing the older one
  • Signing out keeps your session visible until your credentials have actually been removed, so you are never left half signed in
Apple documents the underlying protections in Keychain data protection, part of its Platform Security guide. That guide is written for security professionals.
  • Granular app permissions
  • Selective sync options
  • Integration management
  • Access control
Email me my notes is off until you turn it on. When it is on, each new note’s title and text go through Cleft’s email provider to your account address, and your mail provider stores them like any other email. Email is not end-to-end encrypted. Cleft keeps a record that you agreed, which wording you saw, and when. That record holds a protected fingerprint of your address, not the address itself. Unsubscribe in Cleft under Settings > Integrations > Email me my notes, which Manage or unsubscribe in Cleft in each email opens, or with your mail app’s own Unsubscribe button. Learn more.
  • Export controls
  • Deletion requests
  • Storage preferences
  • Sync settings

​
Compliance & Support

Cleft maintains compliance with:
  • GDPR (General Data Protection Regulation)
  • CCPA (California Consumer Privacy Act)
  • EU AI Act requirements
  • Industry security standards
Jonathan Cosgrove Founder, COO and Data Protection OfficerContact: DPO@Cleftnotes.com
Data Portability Email hello@cleftnotes.comSubject Access Request Submit through our SAR form

​
Updates & Vendors

Version 1.2 - September 18, 2024
  • Updated privacy policy language
  • Standalone Cookie Policy
  • Added vendor documentation
Version 1.1 - February 22, 2024
  • Revised for product features
  • Added SAR form
  • Public release alignment
Version 1.0 - December 27, 2023
  • Initial privacy policy
  • Data protection standards
  • Handling procedures
  • Amazon Web Services (AWS): Cloud infrastructure
  • Amazon SES: System emails
  • OpenAI: Primary LLM provider
  • Groq: Backup LLM provider
  • Anthropic: Additional LLM provider
  • Apple: iOS development
  • Figma: Product design
  • GitBook: Documentation
  • SoFriendly: Design partners
  • Screen Studio: Video creation
  • GitHub: Code repository
  • Google Workspace: Collaboration
  • Slack: Team communication
  • Stripe: Payments
  • RevenueCat: Checks whether your Plus subscription is active, without your name or email address
  • TelemetryDeck: Privacy-bounded product usage counts, in the apps only after you turn usage counts on
  • Sentry: Technical crash reporting for the Apple apps, only after you link crash reports to usage counts; current region and retention are verified during release review
  • Fathom: Privacy-focused documentation website analytics
  • Hubspot: Customer management
  • Mailerlite: Email communications
  • Social Media: Various platforms
View our complete Privacy Policy and Terms of Service on our website.
Last modified on October 16, 2026