Privacy
Updated October 26, 2026
Short version: your pages stay on your iPad. When you ask, tap Check, Clean up page or Talk, only what that needs leaves the iPad, and only to the services below.
The plain promise
- What leaves your iPad: a picture of the page you ask about and what you typed or said. Only when you ask. Nothing in the background.
- Who reads it: our coach server, then Anthropic (Claude), Google (Gemini) and OpenAI (safety checks and voice). Details below.
- What we keep: during the beta, a full copy of each AI request (the page picture, your words, what the AI read and said) for 30 days, so we can fix bugs. Then it is deleted.
- Usage events: when you first write, ask, get an answer or open the app, the app tells us that it happened, with a random install number. Never your words, never your page.
- Delete it now: Delete AI history in the app's Settings wipes your AI history from our server right away. Or email us.
- Cancel: the beta is free and charges nothing. After the beta, plans run through Apple: cancel in the iPad's Settings, under your name, then Subscriptions. It takes 2 taps. You keep what you paid for until the period ends. Deleting the app does not cancel a plan.
What stays on your iPad
Your pages, imported PDFs, ink, saved mistakes, settings and streak stay on your iPad. There are no accounts and no sync. We can't see these files and we don't back them up. Delete everything in Settings wipes them from the iPad.
Who receives what, and why
When you tap Check or ask, the app sends our coach server (coach.dmchang.xyz) a picture of your page and what you typed, with a few lines of context such as the text printed on your PDF and your recent questions. The server routes this through a cloud provider to the models below. Nothing is sent in the background. The coach server only answers devices paired with an invite code the owner hands out; there is no open sign up.
Anthropic Claude writes the coach reply, reading the page picture and your words. Anthropic also transcribes Clean up pages and scans. Google Gemini is the backup for the coach reply, Clean up pages and scans. It also powers live voice when the server picks it. OpenAI checks safety and voice. Its moderation reads what you sent and what the coach said, and each finished Talk line is checked the same way. When you ask for a hint, its reply judge also reads the hint, to keep it a hint. On Check, OpenAI also sees small pictures of single handwritten lines, to double check what the coach read, plus your page lines and your question, to judge whether the reply makes sense. It never gets the whole page picture. Clean up page sends OpenAI no page picture at all. During Talk, OpenAI receives your voice and the page picture when it is the Talk voice below.
Talk runs through our coach server by default. Your voice and a small picture of the page travel through our server to the Talk voice, which is OpenAI by default and Google Gemini when the server picks it. Only the emergency fallback talks straight to the voice service from the iPad, using a short-lived credential our server mints for that one session.
When you paste a link, your iPad opens that website itself to show its title on the card. That site sees a visit from your iPad, the way it would if you opened it in a browser. The coach sees nothing about the link.
If you add your own AI key in Settings, the key stays on your iPad and is sent only with your own Check requests. It is never written to our logs. Talk and Clean up page never use your key.
What we keep
During the beta our server keeps a full copy of each AI request so we can find and fix bugs: the page picture, what you typed or said, what the AI read from your page, and what it replied. Each copy is deleted after 30 days. Delete AI history in Settings deletes yours right away, and so does an email to us. Before the app launches to everyone, the page pictures stop being kept.
Safety flags keep the category only, never your words. The usage log keeps costs and timings, never page pictures, words, keys or code. Usage events keep the event name, the time and a random install number, for 30 days.
Some numbers stay after Delete AI history, because they hold nothing you wrote: how many AI answers your iPad used today and this week, and any invite credits. They keep the limits fair.
Kids and parents
Palnote is for ages 13 and older. The app asks for your birth month and year at the start and stops under 13s there. It keeps only the answer, never the birth date.
Parents and guardians: you can ask what was kept, ask for it to be deleted sooner than 30 days, or withdraw consent with the Withdraw consent row in Settings. Withdrawing consent clears the agreement and turns the coach off on that iPad.
The beta list
If you join the beta list or the launch list, we store your email address, the date you signed up and which page or link sent you. The beta sign-up also stores the answers you pick there, and only those fixed choices: which iPad, whether you have an Apple Pencil, what you'd use it for, your age group (18 or older, or a parent of a 13 to 17 year old) and where you heard about us. We never ask for a name, a birth date or anything about a child beyond that age group, and someone under 18 can't sign up themselves.
We use this to pick testers and to email you about the beta or the launch, nothing else, and we don't share or sell it. Beta invites are sent by Apple's TestFlight to the email you gave. The first beta groups are for testers 18 and older in the US. The list is deleted after a year. To be removed sooner, email [email protected].
This website
This site is hosted on Cloudflare Pages. It sets no cookies, runs no analytics and loads no ads or trackers. Its fonts are hosted here, not on a third party.
Age
Palnote is for people 13 or older. See Kids and parents above.
Changes and questions
If this changes, we update the date at the top. Questions, want something deleted sooner than 30 days, or want to report a bad or harmful coach reply? Email [email protected].