Privacy Policy

Our Core Principle

In the current build, your notes stay on your device and are not sent to us.

Prevon Pie stores your notes on your device, encrypted, under a key that comes from your 12-word recovery phrase (in strict-mode vaults, a random key that the phrase can unlock). The app does not send that key to us. A few small items are kept outside that encryption; they are listed under “What the App Stores Without Encryption” below. The app has no account to create and nothing to sign in to. Features we may add later (such as sync) are described below and will be reflected in this policy before they are turned on. This policy covers the Prevon Pie app on Android, iOS, macOS, Windows and Linux and, in a separate section below, this website. The privacy behaviour is the same on every platform; where a platform differs, we say so.

What the App Collects

In the current build, the app does not include an account system, advertising, an analytics service, a crash-reporting service or tracking, and it does not send your notes, folders, recordings, settings or a device identifier to us. Because we do not receive that data, we do not sell or share it. The network connections the app does make are listed in the next section.

If you choose to send us a problem report, you send it yourself; nothing is sent in the background.

What the App Does on the Network

Prevon Pie is built to work with no connection. With default settings and the AI models already downloaded, the app makes no routine requests of its own. These are the connections it can make, and what each one reveals:

• AI model downloads. The on-device AI runs from model files that the app downloads from Hugging Face (huggingface.co and its content network). The app only accepts these downloads over HTTPS from those hosts, and checks every file against a fixed checksum before using it. Hugging Face sees the request, including your IP address, like any website you download a file from. We do not run that server and do not receive that information from it; its handling is governed by its own terms and policy. Once AI is set up, the app may start the larger model download by itself, but only on Wi-Fi or Ethernet, only if downloads are allowed in your settings, and only when there is enough free space. You can pause or turn off downloads. Air-Gap Mode, if you switch it on, stops them. On Android a download runs as a visible notification; on the other platforms progress is shown in the app.
• Google Play licence check (Android builds from Google Play). Android builds that Google Play generates, including a direct-download APK taken from Play, contain Google's own licence check. It is added by Google, not by us. On every launch it asks Google Play whether the device is licensed, so Google sees that request under its own terms and policy. On a device without Google Play such a build shows a message and does not start. Builds we make ourselves do not contain this check.
• Devices on your own network. Pairing and sending notes nearby happens directly between your devices over your local network, not through our servers. If you add an AI server that you run yourself, the app sends your AI requests to the address you typed, and only after you add it.
• Links you open. A link in a note, or a link such as Donate where it is shown, opens in your browser after you confirm. That website then sees your visit as any website would.

Ghost Sync is off in this version. The builds we release have cloud sync compiled out, and where sync code is present every sync switch is off by default and never turns itself on. With it off, the app does not contact our relay. If you turn it on, the app also fetches a small kill-switch file (flags.json) from our relay, a Cloudflare Worker, when the vault opens and at most every 30 minutes while the app stays open. That request carries no note data, account or device identifier, but it reveals your IP address and the time to the relay and Cloudflare. The file can only switch features off. Air-Gap Mode stops it. The app contains no analytics, advertising or crash reporting. What else would apply if you turned sync on is set out in the next section.

Ghost Cloud: Ghost Sync, Ghost Sharing and Ghost Backup

These are optional and switched off unless you turn them on (they may not be available in your version yet). When they are on:

• What leaves your device. Only data encrypted on your device with keys derived from your 12-word recovery phrase, which we never receive. It is stored at addresses computed from that phrase. We hold no account, name, email or user ID for it, and titles, folder names and settings are inside the encrypted data.
• What we can still see. The sync service runs on Cloudflare. It can see that encrypted data exists, its size, when it is written or read, how often, and the network address a connection comes from. It cannot read the content. We do not claim that nothing is visible.
• Payment. Paid Ghost Cloud plans are not launched. If they are offered, a pass is bought through Stripe (see Payments), and apps from the App Store and Google Play show no price or buy link. A pass meters a monthly write allowance (at most 24 bundles, about 258 MiB of writes a month), not stored bytes. We keep no link between your payment and your notes; the next section says exactly what each part knows.
• Keeping and deleting. Your device is the master copy. A relay copy expires 90 days after its last write unless it is refreshed, and reading, restoring, exporting and deleting never stop. You can delete your synced data from the app (Nuke does this for that vault as a best effort, with no guarantee that every copy is removed). Because the design has no account to look you up by, we expect to be unable to find, recover or delete it for you.
• Sharing. People you share with can read and keep what you share. Removing them stops later access only; it cannot take back what they already received. Other devices keep their own copies until they are erased too.
• Recovery record and backups. If you enable them, an encrypted recovery record or backup file is created that only your 12 words can open. Where you save a backup file, and any service that copies that folder, is outside Prevon.

We do not use synced data for advertising or to train AI models. It is encrypted with keys we do not hold.

How payment stays separate from your notes

This describes how Ghost Cloud is built today. Paid plans are not launched; the first launch is a free monthly allowance for Ghost Sync and Ghost Backup. We keep no link between your payment and your notes. We do not claim it cannot be defeated, and we do not claim anonymity.

What each part knows

• Stripe, the payment handler. That you paid, and the card and billing details you give it. It does not receive your notes or your storage address.
• The pass desk (our service that sells passes). A stable pseudonym derived from your 12 words, and when you paid. It does not see the pass id, and it holds no storage address.
• The pass issuer. A random pass id, with no name and no pseudonym.
• Storage on the relay. Sealed objects at addresses derived from your 12 words. It cannot read them.

What is closed by math

Your app makes the pass id and blinds it before the desk signs it (a blind signature), so the desk cannot connect the pass it signed to the pass later spent. The Stripe reference, the desk secret and the storage address are separate one-way derivations of your 12 words, so none can be turned into another. The records kept at the desk, the issuer and storage do not match across services, and every pass redemption is the same size.

What is not yet closed

• Network addresses. Cloudflare, a third party, sees network addresses on every path it hosts, including this website and the relay. We have not yet shown on real phones that a network address cannot be tied to a payment, so we do not say it cannot.
• Timing. Visiting a payment page, paying and later using a pass happen at times that can be compared. While few people subscribe, timing could narrow who a pass belongs to. A larger crowd helps; we will not claim it until the numbers support it.
• No independent relay yet. Today we run the relay. A second company running part of it does not exist yet.

The floor

Any scheme, ours included, can be defeated by a malicious app update that the publisher is forced to ship, because the app holds your keys. Other private apps share this limit. Your device is the master copy of your notes; a relay copy expires 90 days after its last write unless refreshed, and reading, restoring, exporting and deleting never stop.

What the App Stores Without Encryption

Your notes, titles, attachments, search index and the assistant's data are encrypted on your device. These items are kept outside the vault's encryption (they stay on your device and are not sent to us, but anyone with access to the device's files or backups may be able to read them):

• Reminder and widget text.“Show what reminders are about” is on by default. Reminder notifications then say what the reminder is about, which can appear on the lock screen and on a paired smartwatch or other apps that read notifications, and the home-screen widgets show the words of your next reminders. Turning that setting off, or choosing Private or Maximum under Notification privacy, makes notifications generic and removes the widget copy.
• Note metadata.A plain copy of each note's title is kept in the note's metadata fields.
• Search-by-meaning cache.The on-device cache for searching by meaning holds note text in plaintext inside the app's private storage.
• Lecture recordings. A recording waiting to be saved is kept as plain audio in temporary storage until the vault is next unlocked. The app erases idle recordings when it locks, but a crash can leave a file behind.
• Keyboard. The on-screen keyboard (including third-party keyboards) may learn what you type in notes, titles and search, because the private-keyboard setting is off by default. Password, PIN and phrase fields are always private.

Deleting a note forever removes it from the vault, but older copies can remain for a while in the database log and in the safety copy kept after an app upgrade (erased after 7 days at the latest). Do not rely on delete as a shredder. The full list of known limits is on our Security page.

Microphone, Camera, NFC and Notifications

• Microphone: voice-to-text and recording a lecture or meeting when you start it. Speech is turned into text on your device. A recording you start keeps going with the screen off, shown by a notification with a Stop button, until you stop it. In the current build, audio is processed on your device and the app does not upload it.
• Camera and photos: scanning a QR code to pair devices, reading text from a picture you take or choose, and a photo during a recording when you tap Photo. Pictures are read on your device.
• NFC, security keys and biometrics: unlocking with a security key or NFC tag, or with fingerprint or Face ID where your device has them, when you set those up. The app does not store anything on the key or tag, and does not send these credentials off your device.
• Notifications and alarms: reminders and alarms you set, model-download progress, and a running recording. Reminders are scheduled on your device; their text is covered in the previous section.

Each of these is requested through your operating system's permission prompt, and you can refuse or withdraw any of them in your device's settings. On Windows, macOS and Linux the same microphone, camera and notification permissions apply, and the operating system's own secure storage (the Keychain on Apple devices, the Android Keystore, and on Linux the desktop keyring, which should be unlocked) holds device-bound secrets. No permission is needed to run the app without these features.

AI Processing

AI features run on your device by default, using the downloaded model. In the current build, the app does not send your notes anywhere to produce an answer.

The app contains settings for connecting your own cloud AI account (a third-party service you choose, with your own key). That path is switched off in this version of the app. If a later version turns it on, it will be your choice, it will be shown in AI Settings, and this policy will say exactly what is sent before it does. We do not use your data to train AI models, and we do not receive your notes to do so.

Payments

The app has no in-app purchases and takes no payments in this version. If you buy or donate on this website (for example a Founder Lifetime payment or a donation), our payment processor, Stripe, collects your name, email and payment details to complete the sale and comply with tax law. Stripe, not us, handles your full card number. Our systems keep a record of paid Founder Lifetime codes. We keep no link between your payment and your notes; see “How payment stays separate from your notes” above for what each part can and cannot see. Refunds are as stated on the page where you buy.

Data Retention and Deletion

Your notes live only on your device, so the way to erase them is Nuke in the app, which deletes the vault's files and keys on that device (see the previous section for what can linger) and, if sync was on, as a best effort, removes its copies from the sync service. Uninstalling alone may leave data behind (on Windows, macOS and Linux the app's data folder stays; on Apple devices keychain items can survive), so Nuke first, then uninstall. Nuke erases one vault on one device: other devices keep their copies until erased too, and the 12 words can re-create the vault from any remaining copy. We hold no copy and cannot restore one for you. Synced data is covered in the Ghost Sync section. If you lose both your device and your 12-word recovery phrase, we cannot recover your notes for you: we hold no copy and no key. See Support.

Your Rights

Your notes are held on your devices. Depending on where you live (for example the EU/UK or California), you may have the right to access, correct, delete or export the personal data we hold about you (such as website form entries or payment records), and to object to how it is processed, under laws such as the GDPR or CCPA. Email us at [email protected] to exercise any of these rights; we handle these requests by hand and will respond as the applicable law requires. Sealed Ghost Sync data is different: it is not tied to an account or an identity and we cannot read it, so we expect to be unable to identify which data is yours; you control it from the app instead.

This Website

This section covers the website only, not the app. What the website collects and stores, based on how it is currently built:

• Waitlist, newsletter and contact forms. Your email (and, for contact, name, subject, message and the page you came from) are stored in our database to reply to you or send what you asked for. The contact form also stores your IP address for spam prevention. We have no automatic expiry for these: waitlist and newsletter signups and contact messages are kept until you ask us to remove them.
• Beta invite codes. Redeeming a code records the code and invitee name, your IP address and browser details for abuse prevention, and your email if you give one so we can send a confirmation and download link. These records are kept until we delete them.
• Problem reports. A pasted report is stored with its optional reply address, IP address and browser details, and is set to be deleted automatically after 30 days. The form may use Cloudflare Turnstile to filter bots, as described for the ideas form below.
• Ideas and issues form. The text, category and optional email you enter are stored in our database and emailed to us. The form may use Cloudflare Turnstile to filter bots, which receives your IP address and browser signals for that purpose. We do not store your IP address with ideas.
• Roadmap votes. Vote counts are stored as totals.
• Downloads. Downloads offered on this website need no account. The AI model files on the Models page are served from our own storage on Cloudflare (downloads.prevon.ai). Cloudflare, as host, sees ordinary request data such as your IP address.
• Payments and donations. Handled by Stripe (see Payments). Our systems keep a record of paid Founder Lifetime codes.

Who processes this data.Cloudflare hosts the website and runs our database and key-value storage, and sees ordinary request data (such as IP address) as a hosting provider. The website's security headers also permit Cloudflare's analytics script (static.cloudflareinsights.com), so Cloudflare Web Analytics may be enabled on our account; if it is, it measures page visits without our own tracking cookies. Resend sends our email (it receives the recipient address and message content). Stripe processes payments. Sanity (cdn.sanity.io) serves blog and page content and images. Our fonts are served from our own site. Each receives only what it needs for its job. None of this is note content, and we do not sell it or use it for advertising. You can ask us to delete what you submitted by emailing [email protected].

Cookies and local storage.The website sets no advertising or tracking cookies of its own. It stores a few small items in your browser's local or session storage (for example that you dismissed the cookie notice or a banner, and, if you redeem a beta code, a flag that you did so). These stay in your browser. Cloudflare and Stripe may set their own cookies or storage when you use their services.

Children

Prevon Pie is not intended for users under 16, the same minimum age as in our Terms. We do not knowingly collect data from children. If you believe a child has sent us data through this website, email us and we will delete it.

Changes to This Policy

If we make material changes, we will say so in the app and on this website before they apply. We will not materially reduce the protections described here without notice.

Contact

Prevon LLC, 732 S 6th St, Las Vegas, NV, USA, is the entity responsible for this policy. Questions about this policy? Contact [email protected] or visit our support page.