Privacy Policy

Who we are, and how to reach us

Quern (“the app”) is run by <<COMPANY_LEGAL_NAME>>, whose registered office is <<REGISTERED_OFFICE>> (“we” or “us”). We decide why and how your personal data is used, so under India’s Digital Personal Data Protection Act we are its data fiduciary.

Our privacy and grievance contact answers questions about this policy and your rights, and complaints about the app or a note. Write to <<PRIVACY_CONTACT_EMAIL>>. The same address is in the app, under Settings → Privacy → Privacy questions and complaints.

We confirm we’ve got your message within 24 hours.
We settle it within 15 days.
A request to remove content is dealt with within 72 hours.

The short version

You save things (links, videos, PDFs, photos, voice notes, your own writing) and the app turns them into notes. Your notes are yours.
To do that, your saves and notes go to our servers and, for the AI steps, to AI services that run outside India: while Quern is being tested, Google’s Gemini (free tier), Groq, Cerebras, OpenRouter and Mistral (named below).
We don’t sell your data or show ads.
While Quern is being tested, its AI steps use free tiers that may use what they’re sent to improve their own services. Don’t save anything you wouldn’t want an AI service to see; a locked note is never sent.
Delete any note, or your whole account, from the app. Export everything, any time.
The app is for adults (18 and over).

What we collect, and why

What	Why	Kept
Your email address, if you sign in with one (a guest has none until they add one)	To send your 6-digit sign-in code, and to keep your notes with your account on every phone	Until you delete your account
Your Google account’s name, email, picture and id, if you continue with Google	To sign you in with one tap, and to keep your notes with your account on every phone	Until you delete your account
An account id (a random identifier made when you start, as a guest or with an email)	To keep your notes yours, and to check it’s you when the app asks our server for something	Until you delete your account
Your saves and notes: the links you share, the notes written from them, your edits, folders, spaces, tags and settings that sync	So your notes are on every phone you sign in on, and so search and Ask can find them	Until you delete them (see the bin, below), or your account
Your files: voice notes, PDFs, photos, documents and code files you add	To keep them with their notes and to read their words into the note. A photo you add while writing is read on your phone first, by Gemini Nano – the AI built into Android on phones that have it – so nothing leaves the phone (you can turn this off: Settings → Privacy → AI on this phone; Google may receive anonymous usage metrics about it, never your photo or its words). Otherwise it’s read by our AI services (Gemini or Groq, free tiers that may use what they’re sent – see The AI, and where it runs) for its words only; when that isn’t available either, it’s read on your phone by ML Kit	As your notes
Your questions to Ask, text you send to rewrite, plan or translate, and fact-check claims	Only when you ask, to answer you	Not kept by us beyond answering (your saved answers are notes). A verdict on a claim from a public page is kept, with no one’s id. The AI services keep what we send under their own terms; their free tiers may use it to improve their services
Your AI history, on your phone only: what the AI did for you (“Answered a question”, “Read the words in a photo”), where it ran (online, on your phone) and when – never what you gave it	So you can see where AI was used for you (Settings → Privacy → AI history)	On your phone, at most its last 300 uses; Clear forgets them, and signing out removes them. The notes an AI wrote are listed from your notes themselves
A random install id (not your phone’s hardware or advertising id) on each change	So your phones put your changes in the right order	As your notes
Anonymous crash reports and usage counts (no account, no note, no words, no identifier)	To fix crashes and see whether the app works (for example, how many shares became notes, and how fast)	180 days
A problem report, if you send one: what you typed, the app’s version, the kind of phone (Android, for example) and the app’s last log lines; sent by your email app, so with your email address	To fix the problem you report	[To be set when the support address exists]

What never leaves your phone: a locked note’s words and files (sealed on your phone before they sync; we only ever hold ciphertext); the words of a picture you share or save on its own (read on your phone); your AI history; how alike your notes are in meaning (worked out on your phone by a small text model built into the app, kept only while the app is open); your fingerprint or face (your phone’s own check); and read aloud (your phone’s own voice).

The AI, and where it runs

The app’s AI steps (writing a note from what you saved, transcribing a voice note, reading the words of a photo you add while writing, answering a question, rewriting, planning, fact-checking) are done, while Quern is being tested, by these services, tried in this order until one answers: Google’s Gemini (free tier), Groq, Cerebras, OpenRouter (which passes the request to the company that hosts the model it picks) and Mistral. These are free tiers: each may use what it’s sent to improve its own services, under its own terms, and may keep it for a time. They process data outside India (the United States and other countries). A locked note is never sent to any of them. A photo’s words and a voice note’s audio go only to Gemini or Groq.

When you fact-check a note made from a public page you saved (a link you shared), its claims may also go to Google Fact Check Tools, which looks for fact-checks already published. Its terms don’t promise that Google won’t use what it’s sent, so a claim from your own notes (anything you wrote, recorded or uploaded) never goes to it.

AI notes are labelled as AI notes. They can be wrong: check anything that matters.

Other companies that help us (our processors)

They process your data only to provide their part, on our behalf:

Supabase stores your account, notes and files (our database and storage, in India: Mumbai).
Google Cloud runs our server (the gateway and the note pipeline, in India: Mumbai).
Cloudflare hosts our website (getquern.com) and forwards email sent to us. It sees what any web host sees when you open a page (your IP address and browser), never your notes or account.
Google (Gemini, Search grounding, Fact Check Tools), Groq, Cerebras, OpenRouter (and the host of the model it picks) and Mistral AI do the AI steps and fact-checks above.
The email sender [to be named when chosen] delivers your sign-in codes; it sees your email address and the code, nothing else.
Komoot (Photon), a map service in Germany, gets place names from your notes, to put them on a map. From a personal or private note it gets the place names and their towns alone – never the note’s title, its words or who you are – and we keep nothing it answers for that note.
YouTube, Vimeo and Spotify get the link you shared, to describe it; the website you shared gets one request for its page, from our server, never from your phone or with your logins.
ScrapeCreators (a content service) gets the link of a public Instagram post or reel, or a public YouTube video, you shared – nothing else – and sends back its caption, its creator’s handle, its length, its location tag and its public counts. Apify gets the link of a public reel longer than two minutes, for the words said in it. Neither ever gets your login, your account or anything private.
GitHub gets the address of a public GitHub project or issue you saved, to describe it.
For the places in a note you saved from a public page, never a personal or private one: Wikimedia (Wikipedia, Wikidata and Commons) gets a place’s name, for its one-line description, its pin and a picture with its author and licence; OpenStreetMap’s Nominatim gets a place’s name and area, as a last backup for its pin (from a personal or private note too, as Photon does), and the map’s own id for a pinned place, for its opening hours and its picture; Geoapify gets only a map’s centre and size (never a name or your words) and draws the street map under its pins; Pexels gets a place’s name and area, for a photo, only when we have switched it on.
When you open a note’s map full screen, your phone fetches the map itself from OpenFreeMap (tiles.openfreemap.org, free public map tiles): only the areas of the map on screen, as any map app does – never a place’s name, your words or who you are. OpenFreeMap sees your phone’s address, as any website you open does.
Wikidata also gets the names of products, organisations, books and films in a note you saved from a public page, or – only when you tap Find links – in your own note: only those names, to find each one’s official website.
To tell what a product, brand, organisation or book named in a note is, these public references get only that bare name, never your words or who you are: Wikipedia, Google’s Knowledge Graph, GLEIF (the register of companies’ legal names), Open Library (books) and Open Food Facts (food and drink products). A person’s name is never sent, and nothing from a private note.
If you tap Send to AI, the AI app you pick gets what you chose to send. We never call it.

If you speak a question to Ask, your phone’s own speech input (often Google’s) hears it and gives the app the words; its terms are your phone’s. If your phone has none, the audio goes to Gemini, for its words only, and is kept nowhere by us.

How long we keep things

Your notes and files: until you delete them. A deleted note sits in the bin for 30 days. Then it and its files are deleted for good: from your phone at 30 days, and from our servers 3 days later.
A locked note: only its newest sealed version.
Your account: until you delete it. Delete my account keeps it 30 days, in case you change your mind, then deletes your files, your notes and your account. During those 30 days nothing is processed (no AI, no sync): your data is only kept, so you can sign in and tap Keep my account. A guest can’t sign back in, so for a guest it can’t be undone.
After your account is deleted, we keep only a scrambled fingerprint of its email address and of its Google account – a one-way code made with a secret key, from which the address can’t be read back – and how many free AI notes and uploads it had used that month, for 2 years. If you come back with the same email or Google account, we can say welcome back, and that month’s free allowance carries on from where it stopped (so deleting and re-joining never gives a fresh one). No note, file, name or other detail is kept. A guest has no email, so nothing is kept for a guest.
What we learn about public things. When a note you saved from a public page names a public thing (a product, a book, a brand, a place), we keep, anonymously, the public facts public references (such as Wikipedia and OpenStreetMap) gave us about it – what it is, its one-line description, a place’s opening hours – and how often it has been looked up, so the next look-up needs no call. We never keep who saved it, or anything from your own notes: a personal or private note’s names are never kept. It holds nothing of yours, so it stays when you delete your account; each fact is checked again with its sources after 30 days.
Anonymous crash reports and counts: 180 days.
A problem report you send: [to be set when the support address exists].
Our servers’ security logs (who reached the service, never what your notes say): one year, in India. [One year, in India: to be set up before launch.]

Your rights, and how to use them

Under India’s Digital Personal Data Protection Act you can:

see your data: export every note, its full history and your files from Settings → Your data;
get a summary: ask us for a summary of the personal data we process about you, and of who processes it;
correct it: edit any note; a guest can add an email in Settings → Account; to correct your email, write to us;
delete it: delete a note, or your whole account, as easily as you started: in the app (Settings → Account → Delete my account), or on the web at <<DELETION_URL>>;
withdraw your consent: delete your account (above). It takes effect at once on your phone. On our servers, nothing more is processed, and everything is deleted after the 30 days above;
nominate someone to use these rights for you if you can’t: write to us;
ask us anything, or complain: write to <<PRIVACY_CONTACT_EMAIL>>. We confirm within 24 hours and settle it within 15 days.

If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.

Anonymous crash reports and usage counts

The app sends anonymous crash reports and usage counts to help us fix it, at most once a day. A crash report says where in the app’s code it broke, never the error’s message, and may add the last few screens you passed through before it (at most five, by name from a fixed list, in order, with no times and never a note); the counts say, for example, which features and screens were opened, how many shares became notes and how fast, how often the phone’s own AI ran, worked or couldn’t, and where people leave a few steps (saving a link, signing in, asking, exporting). They carry no account, no note, no words you wrote, no phone identifier and no time finer than the day, and our server doesn’t keep your IP address for them. [Cloud Run’s request log leaving them out: to be set up when the server is deployed.] Our server only adds them up, per day: no single report is stored, and the totals are kept for 180 days. You’re told on the app’s first screen, and you can switch it off in Settings → Privacy, where See what’s sent shows exactly what’s waiting to go. Switching it off stops it at once and deletes what was waiting.

Problem reports go only if you send one, from Settings → Help → Send a Problem Report. You see exactly what will be sent before anything goes: what you typed, if anything, the app’s version, the kind of phone and the app’s last log lines, which hold what the app did (never your notes or anything you wrote). Your email app sends it to our support address, so we see the address you send it from.

Children

The app is for adults: you must be 18 or older to use it. If we learn an account belongs to someone under 18, we delete it.

Security

Everything travels encrypted (HTTPS).

Other people can’t read your notes: our database lets each account read only its own.
Our systems process your notes to run the app: to write AI notes, answer Ask, search and sync.
We look at an account’s data only to fix a problem you report, or for security, and that access is logged. [How each look is logged: to be set up before launch.]
Locked notes are the only ones even we can’t read: each is sealed on your phone with a key that never leaves it.

If a breach affects your data, we’ll tell you and the authorities as the law requires.

Changes

If this policy changes in a way that matters, the app tells you before the change applies. If a change would use your personal data for a new purpose, we ask you first, and we don’t use it for that purpose unless you agree.

Draft, 2026-10-10.