Privacy · Last updated 7 October 2026

What we hold, and what we never see.

Most privacy policies are written to protect the company. This one is mainly a description of an architecture, because the honest answer to "what do you do with my notes?" is that we have no way to do anything with them.

The short version

Nothing about the people you support ever leaves your device. Daily notes, names, medications, goals, incidents, appointments — all of it is written and stored on the phone, tablet or computer you are using. When you set a PIN, your notes are encrypted with it. Without a PIN, anyone who can open your device can read them, so we strongly recommend one. There is no server that holds it, no backup of it on our side, and no administrator anywhere who can read it.

This is not a promise about our conduct. It is a fact about how the app is built, and it is the reason we can make the promise at all: we could not hand your notes to anyone, sell them, or lose them in a breach, because we do not have them.

What we do hold

To sell you a subscription and to keep your licence working, we hold a small amount of information about you — the customer — on our servers:

• Your email address, so we can send your activation link, tell you before a payment is taken, and answer you when you write in.
• Your licence key and its status — active, in trial, past due, expired or cancelled.
• A random device identifier for each device that activates your licence, with a rough label such as "iPhone", the app version, which Kura Notes address it runs at, and when it last checked in. This is how seat limits work and how you release a lost phone.
• Your billing record at Stripe. Card details go directly to Stripe and are never sent to or stored on our servers.
• For signing up: the 6-digit codes we email, kept only as a one-way hash, and the addresses typed into the sign-up form with the IP addresses it was used from. The licence server keeps these for 48 hours, to stop abuse, and then deletes them.
• Which of our pages you signed up from, and a log of support actions we take on your licence.

Who else is involved

We use as few third parties as the job allows, and none of them touch care records:

• Stripe processes payments and holds your billing details under its own privacy terms.
• Cloudflare serves this website and the app, and provides the licence server. It sees ordinary web request data such as IP addresses, as any host would.
• Resend sends our emails: your sign-up code, your link and your key. It handles your email address and those messages, and nothing from the app.
• Google Fonts: the app currently loads two typefaces from Google Fonts on first load, which sees your IP address; the app caches them afterwards. We are moving them onto our own servers. This website carries its own copies of every typeface and makes no request to Google.

We do not use analytics, advertising, tracking pixels, session recording, or third-party cookies. There is no cookie banner on this site because there is nothing to consent to.

Your notes, and the trade-off we are asking you to accept

Because there is no cloud, your device is the only copy of your records unless you make another one. This is the real cost of the privacy above, and we would rather state it plainly than bury it.

The app includes a one-tap encrypted backup. The file is protected by a passphrase you choose at the moment you download it — not your PIN, because a file that leaves the device needs more than four digits. Put that file in iCloud, Google Drive or on a computer, and restoring onto a new phone takes about thirty seconds.

If you lose the passphrase, the backup cannot be opened — not by you, and not by us. There is no recovery process, because a recovery process would mean we held a key, and we do not. Write it down somewhere real.

Records integrity

Every note you sign is sealed with a SHA-256 hash of its own text, date, signer and timestamp, and every action in the app is written to an activity ledger in which each entry carries the hash of the entry before it. If a note or a ledger entry is altered or removed afterwards, the app reports it — on screen and in the export.

This works in your favour rather than ours. It means you can hand a reviewer an export with its head hash and they can verify the chain independently, without trusting our software and without trusting us.

If you cancel

Cancelling stops new notes from being written when your paid period ends. It does not touch anything you have already written: your notes stay on your device, readable, exportable and backed up, for as long as you keep them. We do not delete a caregiver's records, and we have no mechanism to.

Your rights over what we hold

You can ask us at any time to tell you everything on our servers associated with your email, to correct it, or to delete it. Deletion removes your licence, your device records and your email from our systems; it cannot remove your notes, which we never had. We keep one record that your email address has used its free trial, so the trial can't be claimed twice, and any billing records the law requires us to keep. Write to admin@kuranotes.org and a person — the person who built the app — will answer, normally within a day.

If we ever learn of a breach affecting the information we hold, we will tell you as the law requires.

Children and capacity

Kura Notes is a professional documentation tool for caregivers, not a service for the people being supported. Accounts are for adults (18 and over), and are held by the caregiver or provider. The people written about in the notes are never our users and never our data subjects, because their information never reaches us.

Changes to this page

If this policy changes, the date at the top changes with it and anyone with an active subscription is emailed. One thing will not change: no future version of Kura Notes will start uploading care records. Doing so would require rebuilding the app around a server that does not exist, and it is the one commitment this whole product is organised around.