Privacy policy

Cupla Notes is a notes app for Android and iPhone. Cupla Software Oy, Finland, is responsible for your personal data (the data controller). This policy explains what we collect and why. An account and email address are required to use the app.

What we collect and why

• Account details: your email address, name if provided, account identifier, and account creation date. For password sign-in, we store a password hash. For Google or Apple sign-in, we receive an identifier, email address and, when provided, your name. We do not receive your Google or Apple password.
• Notes: the text you write, its order, and creation and update times. We store these to save your notes and make them available when you sign in.
• Sign-in and verification: login sessions and temporary email verification codes to manage access, registration, password resets and account deletion. The app stores a login token on your device to keep you signed in.
• Purchases: the store, product, purchase reference or token, and purchase status, linked to your account. We use these to verify and restore unlimited notes and handle refunds. Apple or Google processes payment; we do not receive your card number.
• Service activity: registration and sign-in events, email addresses, app platform and error information in service logs. We also use an account identifier to count daily active users through our own monitoring service. This helps us troubleshoot, protect and understand use of the service.

We process account details, notes, sign-in information and purchases to provide the service under our contract with you. Our legitimate interests in maintaining a secure, reliable service and understanding its use are the basis for service logs and usage counts. If you contact us, we use your email and message to respond and resolve your request.

Service providers and security

We host the service on Hetzner servers physically located in Finland. Hetzner provides the infrastructure used to store and process your data. We use Google Workspace to send account and verification messages; it processes the recipient address and message contents. Google and Apple also process information when you choose their sign-in services or make a purchase, under their own privacy policies.

Google Workspace may process email data outside the European Economic Area, including in the United States. Transfers are covered by Google's data processing terms, using applicable adequacy decisions or the European Commission's standard contractual clauses. You can read these safeguards through the linked terms or contact us for a copy.

The app connects to our service over HTTPS, and account passwords are stored as hashes rather than readable passwords. Signing in is required to access your notes.

We do not sell your personal data or show ads. The app does not request your location. We use your notes only to provide the notes service.

Retention and account deletion

We keep your account and notes until you delete your account. To do this, open Account > Delete account in the app and complete email verification. You can also request account and data deletion by emailing teemu.latti@cuplasoftware.com, including the email address used for your account. We may need to verify your identity. You do not need to reinstall the app to make an email request.

In-app deletion immediately removes your account, notes, purchase records and login sessions from the live database. Copies may remain in our server backups for up to 30 days. We use these backups for recovery only and reapply account deletions if a backup is restored. Verification codes expire after one hour and expired records are cleared during subsequent verification activity. Login sessions expire after one year unless ended earlier. Apple and Google retain their own records under their respective policies.

We delete routine service logs and account identifiers used for usage counts within 30 days. We delete support emails from our mailbox within 12 months after resolving your request. Google Workspace removes residual copies according to its data processing terms.

Your rights

You can ask for access to your personal data, correction, deletion, or a portable copy. You can also ask us to restrict processing or object to processing based on our legitimate interests. These rights apply subject to the conditions in data protection law. Contact us at the email address below to make a request.

You can complain to the Office of the Data Protection Ombudsman in Finland or your local data protection authority.

Changes to this policy

We update the date above when this policy changes. If we change how we use your data in a material way, we will tell you in the app or by email before the change takes effect.

Contact