Privacy notice

Version 1.3. Last updated 15 October 2026.

Without Notes helps you remember things by putting them on places you already know, starting with your own body. To do that, it has to hold what you type. This notice says what we collect, why, how long we keep it, who helps us run the service, and what your rights are.

In short

• You can take the test without an account. Nothing is stored on your device until you tap Start.
• What you type in the test is kept on our servers, so the test can pick up where you left off and tomorrow’s check can work. It doesn’t go to analytics tools, advertisers or any AI model.
• To keep your progress, you sign in with your email address or with Google. We only email you about your checks and lessons, and one tap in any of them stops them.
• No ads, no selling or sharing of your data, and no tracking you across other sites.
• No one who works on Without Notes reads what you put in, apart from three cases in section 4. If someone has put your name in theirs, section 3 is for you.
• Creem sells our purchases as merchant of record, and your card details never reach us.
• You can ask us to delete everything, at any time.

1. What we collect and why
2. What we store on your device
3. If you’re named in someone’s material
4. What we don’t do
5. Who helps us run the service
6. How long we keep things
7. Your rights
8. Age
9. US state privacy rights
10. Security
11. Changes to this notice
12. Contact

1. What we collect and why

Visiting the site

To deliver a page, our host Cloudflare receives your IP address and what your browser sends with every request: the browser type, the page asked for and the time. Cloudflare uses them to serve the page and to protect it from attacks and overload, which includes limiting how many requests one address can send. Our own logs keep the route, the response and the time, never anything you typed.

Why

Running the site and keeping it safe.

Legal basis

Our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)).

Kept

30 days.

Counting visits

When you open one of our pages, our server counts it from the request your browser makes for the page anyway: which page it is, the name of the site you came from (never the full address) and campaign tags in the link from a fixed list. No script runs on your device for this, and nothing is read from it or stored on it. Our server adds your device type and whether you’re in an app’s browser, worked out from your browser type. To tell one day’s visits apart, it turns your IP address and browser type into a code using a random key that it deletes after 24 hours. It never stores your IP address or passes it on. PostHog, hosted in the EU, receives the codes and counts as our processor; no PostHog script runs in your browser.

Why

To see how many people visit and start the test.

Legal basis

Our legitimate interest in knowing how the site is used, as totals (Art. 6(1)(f)).

Kept

The random key for 24 hours; the counts for up to 12 months.

Taking the test

When you tap Start, the test runs on our server as well as in your browser, so it can pick up where you left off after a refresh and come back to you tomorrow. From then on we record:

• Your answers and what you type: what you’d like to remember better, whether you’ve used a memory method before, the names you give the parts of your body, the scenes you write, the words you recall, anything of your own you add (points, numbers, words, names and notes on a people list), the jobs you learn them for with their names and days, and your answers on cards.
• How the test went: how long each word was on screen and what moved it on, the time each round and each step took, your scores and hints, whether a round was interrupted, your pace setting, whether sound was on, and the time you chose for tomorrow’s check.
• Where you came from: the website that linked to us (its name only, never the full address), campaign tags in the link from a fixed list, which version of the page you saw, whether you opened it inside an app such as Instagram, whether you’re on a phone, tablet or computer, the height of your screen, and your time zone.

Our server passes three moments, starting the test, seeing your result and saving, to PostHog under the same daily code, so we can count how many people get how far. Everything else about how the test went reaches PostHog only if you say yes to “Help us improve”. What you type never does.

If you add a line that looks like a PIN, a password or a card number, the test refuses it and keeps nothing from it. Please don’t put other secrets here either.

The share card and the calendar file for tomorrow’s check are made in your browser; nothing is uploaded. A shared link carries only tags about how it was shared, nothing about you.

Why

To run the test, score it, resume it and bring your lists back at the right local time; and to learn, as totals, whether the method works for people who’ve never tried it, whether the test is fair, and which links bring people.

Legal basis

Providing the test you asked for (Art. 6(1)(b)). For the totals: our legitimate interest in knowing whether the product works and is fair (Art. 6(1)(f)). For other people you name: section 3.

Kept

See how long we keep things.

Keeping your progress, and the emails about your checks and lessons

To keep your progress, you sign in, with your email address or with Google (below). We keep your time zone and the time of day you chose for tomorrow’s check. By email, you give us your address and we send you a link. Before we send it, Cloudflare Turnstile checks that you’re a person; this runs only where a form asks for a link, and on the withdrawal and cancellation forms. Your address is added to your account only once you open the link. Until then it waits with the link, which expires.

Then we email you about your checks and lessons, at the time of day you chose: the check the next day; on day 3, that check if you haven’t done it yet, or else the lesson that has opened; and the week check on day 7. If you say yes on day 7, both test lists come back once more after a month. If you give a job a day and ask for it on that job’s page, we send one email at 8 am that morning; it doesn’t say what the day is for. That’s at most one email a day, and none between 9 pm and 8 am your time. Our emails never contain anything you typed. Each one has a one-click unsubscribe and no tracking pixel. We note when you open a check or a lesson from its link, to see whether the emails bring people back. If an email to you bounces for good, or you mark one as spam, Resend tells us, and we stop sending to that address. We don’t send newsletters or marketing; if we ever want to, we’ll ask first.

Why

To send the checks you asked for, and each lesson when it opens.

Legal basis

Providing the service (Art. 6(1)(b)).

If you don’t

The test still works in this browser, but we can’t send the checks or the lessons.

Kept

Until you delete your account. Unused links are deleted 30 days after they expire.

Signing in with Google

If you choose “Continue with Google”, Google asks you to sign in on its own screen, then tells us your email address, whether Google has confirmed it, your name, your profile picture and an ID number for your Google account. We keep the email address and the ID number, so you can sign in with Google again even if your Gmail address changes. We don’t keep your name or picture, and we never get your Google password or anything else in your Google account. Google’s button loads from Google only on the screens that offer it. Google runs its sign-in under its own privacy policy, so Google knows you signed in to Without Notes.

Why

To sign you in and keep your progress.

Legal basis

Providing the service (Art. 6(1)(b)).

If you don’t

Sign in with your email address instead; everything works the same.

Kept

Until you delete your account.

Pictures of your scenes (with full access; you can switch them off)

With full access, unless you switch off “Your scene, illustrated” on your account page: when you place something, we send the sentence of its scene, such as “The TEAPOT lands on the vending machine.”, to OpenAI, which draws it with AI. Nothing else goes with it: not your name, your email address, your notes, your photos or anything else you typed, only a code that isn’t your name or email so OpenAI can spot misuse. OpenAI doesn’t use it to train its models, and keeps it for up to 30 days to check for misuse, unless the law requires longer. Before and after, the sentence and the picture are checked for content we won’t draw; if one is refused, your card just shows your sentence. We keep the picture with your account, so it shows on every phone or computer you sign in on, until you delete your account; if you report a picture, we delete it. You can switch it off at any time on your account page.

Why

To show a picture of your own scene on its card, after you’ve remembered it yourself.

Legal basis

Your consent (Art. 6(1)(a)), given when you switch it on and confirm you’re 18 or over.

If you don’t

Your cards show your own sentence, as they always have. Nothing else changes.

Kept

At OpenAI, up to 30 days. The picture, with your account, until you delete your account or report it; a copy on each phone or computer, until you sign out there or clear your browser’s data. Also with us: whether it’s on and how many you’ve had this month.

Help us improve (optional)

Only if you say yes on the save screen, our server also passes the rest of your test events to PostHog: which steps you finish and when, counts, scores, timings and error reports, linked to a random ID for your test. It never includes what you type, and it doesn’t record your screen. Nothing extra runs or is stored in your browser. “No thanks” is just as easy, and nothing changes for you either way. You can change your mind at any time by writing to us, and in the app’s settings once it has them.

Legal basis

Your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

Kept

Up to 12 months, or until you say no.

Buying

Purchases are sold by Creem (Armitage Labs OÜ, Estonia) as merchant of record. Creem’s checkout collects your name, email address, billing country and payment details under its own privacy policy, and your card details never reach us. When we open the checkout, we pass Creem only what it needs to fill it in and to send the payment back to your account: your email address, if your account has one, and our own reference numbers for you and the checkout. Creem tells us the order reference, what you bought, the amount, the currency, your country and the email address used, so we can attach the purchase to your test and send you our confirmation of what you bought. If you buy before keeping your progress, we also email the address you paid with one link that keeps your progress there; we send nothing else to it, except, for the yearly full access, the notices before each renewal. Those notices, 35 and 7 days before each renewal, and our confirmation when you cancel, go to your account’s address even if you’ve stopped our other emails, because they’re about your contract. Creem tells us whether your subscription renews, and when. We keep a record of each purchase and refund, with the email address used, and for the yearly full access, when you ticked that it renews every year until you cancel; we keep that with the purchase record, for at least 3 years. To show prices in euros or dollars, and to hold back the offer where we can’t sell yet, our server reads the country that Cloudflare, which delivers our site, works out from your connection; we don’t store it. If you use Withdraw from contract here or Cancel contract here, which need no sign-in, we use what you enter (your name, the email address and, if you give them, the order reference and, for a cancellation, what you cancel, when it should end and your reason) to find your purchase and process your request, and we email that address a confirmation of what you sent and when it reached us. We keep the request with the purchase record.

Why

To give you what you bought, handle refunds and withdrawals, and keep the records tax law requires.

Legal basis

The contract (Art. 6(1)(b)) and our legal obligations to keep records (Art. 6(1)(c)).

Kept

As long as German tax and commercial law requires, up to 10 years. After you delete your account, without your name or email address.

Writing to us

If you email us, we use your message and address to answer you.

Legal basis

Answering you (Art. 6(1)(b) where it’s about the service, otherwise Art. 6(1)(f)).

Kept

As long as we need to deal with your request and anything that follows from it.

Errors

Only if you said yes to “Help us improve”: if something breaks, we record where it happened, the step you were on, your session number and a short error message, so we can fix it. Before it leaves your browser, the message is cut to 300 characters, and anything quoted, anything that looks like an email address, and the parts of web addresses after a “?” or “#” are removed. It goes to our server, which passes it to PostHog in the EU. If you said no, error reports don’t leave our server.

Legal basis

Your consent, as for “Help us improve” (Art. 6(1)(a)).

Kept

Up to 12 months.

2. What we store on your device

Each of these is needed for something you asked for: the test, a quiet test, a saved session, a safe sign-in. So we don’t ask for consent to them (§ 25(2) No. 2 of Germany’s TDDDG, which applies Article 5(3) of the ePrivacy Directive). For the bot check, the legal basis is our legitimate interest in stopping automated abuse of these forms, such as automated requests for sign-in links and fake withdrawals or cancellations (GDPR Art. 6(1)(f)). We use no advertising or analytics cookies.

3. If you’re named in someone’s material

People use Without Notes to remember real things, and real things include other people: a new colleague’s name with a few words about where they met, the guests at a wedding, the team in a talk. This section is for the people they name. It’s public because we have no other way to reach you.

What we hold

A name and the few words the user wrote with it, such as “Priya (Leeds office)”. We don’t hold your contact details or a photo of you for this. Everything comes from the user who typed it.

Who sees it

Only that user. The app uses it to help them remember, and for nothing else. We never show it to anyone else, analyse it for any other purpose, use it for marketing or advertising, put it on share cards, send it to analytics or use it to train AI. No one who works on Without Notes reads it, except when the user reports a problem and asks us to look, when the law requires it, or to deal with a request or report about it (below). Our database is in Frankfurt, Germany; the companies that help us run the service are in section 5. If the user switches on pictures of their scenes and writes your name into a scene, that scene’s sentence goes to OpenAI to be drawn (section 1).

Why, and our legal basis

So the user can remember the people in their life and work. Our legal basis is legitimate interests (GDPR Art. 6(1)(f)): the user’s interest in remembering you, and ours in providing the tool they asked for. We’ve weighed these against your interests and rights, and that’s why we keep it small and private, and why you can ask us to remove it.

How long

Until the user removes it or deletes their account. Deleted data leaves our backups within 30 days.

Why we don’t tell you directly

When we get data about someone from someone else, the law usually asks us to tell them (GDPR Art. 14). We have no way to reach you: we don’t have your email address or any other contact details, and often not your surname. Getting them would mean collecting more about you, and writing to you could give away something the user meant to keep to themselves. So we rely on the exception for when telling each person would take disproportionate effort (Art. 14(5)(b)), and publish this section instead.

Your rights, and how to ask

You can ask us what we hold about you, ask us to correct or delete it, or object to our keeping it, by writing to privacy@withoutnotes.com. Tell us your name as it might appear, and the email address of the person who wrote it, if you know it. We can find an account only by its email address, and we won’t search through everyone’s material to look for you (GDPR Art. 11). So without that address we usually can’t tell which entry is about you, and we’ll tell you so.

Where we find the entry, we remove it, or the words in it that are wrong, and tell you what we did within one month. If it holds details of your health, religion or other private matters, we remove those whatever else we decide. We tell the user which entry we removed and why, without giving them your name or contact details unless the law requires it. You can also complain to a supervisory authority (section 7).

The same address takes reports of anything else in Without Notes you believe is illegal, under the EU Digital Services Act. Tell us what it is, the email address of the account it’s in if you know it, and why you believe it’s illegal.

For users

Keeping names for your own study is normally fine. A first name and a cue are enough, as the people list says where you type. Please don’t add anyone’s health, religion, sex life, political views or other private details, or material you’re not allowed to use, such as an employer’s confidential documents. If you keep names for work, you’re responsible for having the right to. If someone asks us to remove an entry about them, we’ll tell you which one and why (terms, section 13).

4. What we don’t do

• No ads and no advertising trackers. We don’t sell or share personal information, and we don’t track you across other sites.
• No one who works on Without Notes reads what you put in. There are three exceptions: you report a problem and ask us to look, the law requires it, or we have to deal with a request or report about it (section 3). Even then, we look only at what the problem or request is about.
• No screen recording, and no analytics company’s script in your browser. Our pages report to our own server, which passes counts to PostHog.
• Nothing you type goes into a visit count, an error report, a log or an email to an address that hasn’t been confirmed.
• We don’t use your material to train AI models. It goes to one only for pictures of your scenes (with full access, unless you switch them off), and then only each scene’s sentence, to OpenAI, which doesn’t train on it either.
• Fonts come from our own server, so loading a page doesn’t send your IP address to Google. Google’s sign-in button loads only on the screens that offer it.
• No decision with legal or similarly significant effects is made about you automatically. Your scores, and when your lists come back, are worked out automatically, and that’s all those calculations do.

5. Who helps us run the service

These companies process personal data for us, only on our instructions, under data processing agreements:

Creem (Armitage Labs OÜ, Estonia) sells your purchase as merchant of record and is responsible for that processing itself; its own privacy policy applies to it. If you sign in with Google, Google (Google Ireland Limited) runs that sign-in and is responsible for it itself, under its own privacy policy.

We’ll add any new service to this list before it receives your data, and if you’ve saved, we’ll email you at least 30 days before. Services we plan to add later include sign-in with Apple, and purchases in our iPhone and Android apps (Apple, Google and RevenueCat).

Transfers outside the EU. We’re based in Germany and our database is in Frankfurt. Some of our providers handle data in the United States. For providers certified under the EU-US Data Privacy Framework, we rely on the European Commission’s adequacy decision (Art. 45 GDPR). For the others, and as a fallback for all, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For people in the UK, we rely on the UK Extension to the Data Privacy Framework (the UK-US data bridge) or the UK Addendum to those clauses. To get a copy of the clauses we use, email privacy@withoutnotes.com.

6. How long we keep things

7. Your rights

Under the GDPR, and the UK GDPR if you’re in the UK, you have the right to:

• see the personal data we hold about you and get a copy;
• have it corrected;
• have it deleted;
• have its use restricted in some circumstances;
• object to uses that rely on our legitimate interests;
• get what you gave us in a portable format;
• withdraw any consent you’ve given, at any time;
• complain to a supervisory authority: where you live, or ours, the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg. In the UK, that’s the Information Commission (formerly the Information Commissioner’s Office, still known as the ICO).

You can download your data and delete your account yourself, on your account page. For anything else, or if you’d rather ask us, email privacy@withoutnotes.com. We’ll check it’s you, usually by confirming the email address on your account, and answer within one month. For complex or numerous requests we may take up to two more months; if so, we’ll tell you why within the first month.

If we refuse a request, you can appeal by writing to the same address with “Appeal” in the subject line. We answer appeals within 60 days. You can complain to a supervisory authority at any time, whether or not you appeal.

If you took the test without saving, we can’t tell from an email address which test is yours. It is deleted automatically 30 days after your last activity.

8. Age

Without Notes is for people aged 16 and over. When you save, you confirm that you are; we don’t ask for your date of birth. We don’t knowingly collect personal data from anyone under 16. If you think someone under 16 is using Without Notes, email privacy@withoutnotes.com and we’ll delete their data.

We follow the UK Children’s Code by giving everyone the same high-privacy settings: no ads, no public profile, no location, no social feed, and nothing shared unless you share it yourself. Pictures of your own scenes are for people aged 18 and over, and only if you switch them on.

9. US state privacy rights

If you live in a US state with a consumer privacy law, such as California, Virginia, Colorado, Connecticut, Texas or Oregon, you have the rights below. We honour them whether or not we meet the thresholds of your state’s law.

• Know and access: the categories and specific pieces of personal information we hold about you.
• Delete it, subject to legal exceptions such as tax records.
• Correct it.
• Portability: a copy in a portable format.
• Opt out of sale, sharing for cross-context behavioural advertising, and profiling with legal or similarly significant effects. We do none of these.
• No discrimination for using your rights.

What we collect, in the categories California law uses: identifiers (email address, session number); commercial information (what you bought); internet activity (how the test and checks went, where you came from); and what you type into the service. Sources: you, and your use of the service. Purposes and how long: as set out above. We don’t use any of it to infer characteristics about you beyond your scores.

How to ask: email privacy@withoutnotes.com with “Privacy Request” in the subject line. We’ll confirm we’ve received it and answer within 45 days, or tell you within that time if we need 45 more. An authorised agent can ask for you with your signed permission, and we’ll still verify your identity. If we refuse a request, you can appeal by writing with “Appeal” in the subject line; we answer appeals within 60 days. If you’re still unhappy, you can contact your state attorney general.

Do Not Track and Global Privacy Control. We don’t track you across sites and don’t sell or share personal information, so these signals don’t change anything here. If that ever changes, we’ll honour them.

10. Security

• Every connection is encrypted (TLS), from your browser to our database.
• There are no passwords. Sign-in links work once, expire quickly and are stored only in scrambled (hashed) form.
• Rate limits and a bot check protect the service from abuse.
• Logs and error reports are set up to leave out what you type.

No system is perfectly secure. If a breach puts your data at risk, we’ll tell the authority within 72 hours and tell you without undue delay where the risk to you is high (GDPR Articles 33 and 34).

11. Changes to this notice

If we change this notice in a way that matters, we’ll email everyone who has saved at least 30 days before the change takes effect, and show it on the site. The version and date at the top show the latest one.

Version 1.3, 15 October 2026: the jobs you learn things for, with their names and days, are among what you type, and one email on the morning of a job’s day, only if you ask for it on that job’s page (“Saving, and the emails about your checks and lessons” above). Nothing changes unless you ask for it.

Version 1.1, 11 October 2026: we email about lessons as well as checks (in short, and “Saving, and the emails about your checks and lessons” above). If you saved before this version, lesson emails reach you only once 30 days have passed since it took effect. The check emails stay as they were.

12. Contact

Email: privacy@withoutnotes.com
Post: BD Nova UG (haftungsbeschränkt), Straße der Jugend 18, 14974 Ludwigsfelde, Germany

The terms cover buying, refunds and your right to withdraw. To withdraw, use Withdraw from contract here.