Privacy Policy
Last updated: 3 November 2026
The short version
- Your notes stay on your iPad. We never see them.
- The app goes online only for the study café, Card Sync with your own computer, cards that use files from the web, and videos you tap. The café server keeps your café name, avatar, buddies, chats, the cards you share and reports (the full list is in section 2).
- No ads. No tracking. We never sell or share your data for advertising.
Who we are: Lekhin Notes is made by an independent developer (the seller named on the App Store page). Contact: support@lekhinnotes.com.
1. What stays on your iPad
Notebooks, handwriting, typed text, topic cards, PDFs, pictures, camera scans, voice notes, clips, your café to-do list, study progress and settings are stored only on your iPad. We never receive them. A backup goes only where you choose to save it (for example the Files app or iCloud Drive), under your own Apple account. If iCloud Backup is on, Apple's backup of your iPad includes your notes too.
The camera is used only when you take a photo or scan a page into a notebook. The microphone is used only when you record a voice note, or when you switch voice on in a private café.
Card Sync with your own computer works over your Wi-Fi, straight between your devices. It never passes through our server. It is protected by the pairing code but not encrypted, so use it only on your own Wi-Fi.
Cards from the web: a card you add can use files on the internet (fonts, pictures, chart tools). The first time you open a card, and each time it changes, the app runs it once, out of sight, for up to 2 minutes, to download those files. During that run the card's own code can reach public websites, so those sites (and any tracking code inside the card) see your device's internet address. The card's code sees only that card, nothing else in the app. After that the card works with no internet, and links inside it do nothing. A YouTube video's picture is downloaded in that run; the video plays from YouTube or Vimeo only when you tap it, and their own privacy policy applies while it plays.
2. What the study café keeps on our server
When you first open the café, the app makes an anonymous café account: no email, no phone number, no password. The café server (Supabase, hosted in Mumbai, India) keeps:
| Data | Why |
|---|---|
| A random account id | To know which seat, buddies and messages are yours |
| Your café name and avatar look | Shown to other students on your profile |
| Your streak, your minutes studied today, your focus timer, and whether you are focusing or on a break | Shown on your profile and seat |
| Which café room you are in now, and which table you focus at, minute by minute (only your latest 2 days of minutes are kept: older ones are deleted as new ones come in, and all of them when you delete your café account) | To count your 60 minutes together for study buddies, and so your buddies can join you |
| Study buddies, buddy requests, blocks | So buddies and blocking work |
| Messages to buddies and in private cafés | So they can be delivered |
| Cards and notes you choose to share (a note goes as pictures of its pages), and who you shared them with | So the other student can open them |
| Private cafés you made or joined, and tries to join one with a code (only your latest day of tries is kept) | So the room code and members work |
| Reports you send, with the last few messages of that chat | So we can deal with abuse |
| Reports about you, the times the word filter hid your words, and any mute or ban | So the café rules work |
The café never keeps what you study, your notes, or your location.
Voice and "Show my page" are live only. Voice in a private café goes through LiveKit, a voice relay service, while you talk. To join voice, LiveKit gets your café account id and café name, and it may keep a record of each call (the room, who joined, and when). "Show my page" goes through the café server while you show it. Neither is recorded or saved. The café server only notes the time you join voice, and keeps only your latest day of these; all of them go when you delete your café account.
3. Who else handles the data
- Supabase stores the café data above and passes live café updates.
- LiveKit passes voice in private cafés, live only.
- Google (Gmail) carries the report emails to us (see section 8).
- Google Fonts sends the Pine & Page café its two fonts (Inter and Shantell Sans) when you open that café. Google sees a normal download request from your device; no café data goes there, and Google's own privacy policy applies to it.
Supabase, LiveKit and Gmail handle the data only to run the café for us, and protect it at least as well as this policy says. Like any internet service, Supabase, LiveKit and Google Fonts see your device's internet address while you are connected. We use no analytics, advertising or tracking services.
4. How long we keep it
- Café data stays until you delete your café account. Then it is removed straight away.
- Reports are kept for up to 12 months after we have dealt with them, so we can act on repeat abuse. When an account is deleted, its id is taken off the report's own fields for who reported and who was reported. The chat lines saved with a report keep the café names, account ids and messages in them. Our safety log of reports, mutes and bans, and the report emails (section 8), keep their copy (café names, account ids and the last messages). All of these stay for the same 12 months, also after an account is deleted.
5. Delete your data
- In the app: Library › More › About & privacy › Delete my café account. Or inside the café: tap yourself › Change my name › Delete my café account.
- By email: write to support@lekhinnotes.com and we delete it within 30 days.
- Your notes on the iPad are yours: delete them in the app, or delete the app.
- Deleting the app does not delete your café account. Use Delete my café account first.
- Cards, notes and messages you sent stay on the other student's iPad after you delete your account.
6. Children
The café is for students aged 13 and older. Lekhin Notes is not made for children under 13, and we do not knowingly keep data from them. If you think a child under 13 uses the café, email us and we will delete the account.
7. Safety in the café
Students agree to the café rules before they join. Every profile and chat has Report and Block. We read reports within 24 hours and remove people who break the rules.
8. Your rights, and how your data is kept safe
- Your rights: you can ask us to show you the café data we keep about you, to correct it, or to delete it. Email support@lekhinnotes.com and we answer within 30 days. If you are not happy with our answer, you can complain to the data protection authority where you live. In India that is the Data Protection Board of India (Digital Personal Data Protection Act, 2023). In the EU or the UK it is your national data protection authority (GDPR).
- How it is protected: everything the app sends to the café server and to LiveKit is encrypted on the way. The server's rules let each student read only what is meant for them: only you and your buddy can read your buddy chat, only the members of a private café can read its chat and cards, and nobody else can read your reports or blocks.
- Where it is kept: on Supabase's servers in Mumbai, India. Voice goes through LiveKit, whose servers may be outside India.
- Google: when someone is reported, muted or banned, the café server emails us the details (café names, account ids and the last messages of that chat) through a small Google Apps Script in our own Google account. So Google's Gmail handles those emails.
9. Changes
If this policy changes, we update this page and the date at the top.