Legal
Privacy policy
This is the whole policy for the Leonote desktop app and the leonote.app website. It replaces the version of 17 September 2026.
Summary
- The Leonote app has no accounts, no servers of its own, no analytics, no telemetry, no crash reports of its own and no licence checks. Your notes, tasks and settings stay on your computer.
- Leonote goes online only for features you use: opening a link or a video, an AI or speech service you add your own key for, a Google calendar you connect, a tool or add-on you install. Each is listed below, with what it sends and when.
- The website sets no cookies and runs no analytics or advertising scripts.
- Leonote is free. Donations, and paid extras if they are ever offered, go through a payment provider; Leonote never sees your card.
1. Who is responsible
Leonote is made and published by Olexify, an independent developer based in Ukraine. Contact: olexifyyy@gmail.com.
2. The Leonote app
What stays on your computer
Your notes, tasks, drawings, videos, settings, chat threads with AI, the built-in browser's history and your backups are files on your computer: in your vault folder and in Leonote's data folders (~/.leonote, and WebView2's folder under %LOCALAPPDATA% for the built-in browser's cookies). The developer never receives them. If you keep your vault in a synced folder (OneDrive, Dropbox, Google Drive…), that service's own terms apply to it.
Online features
Leonote contacts a service only in the cases below. What you send to a service is handled under that service's own terms and privacy policy; the developer does not receive a copy. Every request also carries your IP address, as any internet request does.
| You use… | Leonote contacts | What it receives | When |
|---|---|---|---|
| AI assistant with your own key | The provider you choose: Anthropic, OpenAI, Google (Gemini), xAI, Perplexity, OpenRouter, or a server address you type | Your question and the chat so far; the selected text, or else the open note; notes, pictures or PDFs you attach. With "can look through the vault" on (the default), the AI may ask for more notes while it answers, and those notes are sent too – never the ones you mark private. | Only when you press Send. Nothing until you add a key. |
| AI on this computer (Ollama, LM Studio) or an AI program (Claude Code, Codex, Gemini CLI…) | Nothing on the internet from Leonote. A program you choose sends the request on under your own account with its maker. | The same as above, handed to that program | When you press Send |
| Jev (TypeSafe) with your own key | TypeSafe (api.typesafe.ai) | For a new task without a priority or area: its text, its due date, today's date and the names and descriptions of your areas. For "suggest a folder and tags": the note's title, folder, first 4,000 characters, your folder names and up to 40 of your tags. | Only what you allow: new tasks are not sent until you choose "Given to AI" or "All" in Settings › Jev, and tasks you keep apart from AI are never sent. Note suggestions only on a click, never for private notes. Laya, the local option, runs on your computer. |
| Speech to text with your own key | Groq, OpenAI or Mistral, as you choose | The recording of what you say (one clip, up to 60 seconds) | Only when you click the microphone. Nothing until you add a key. With Windows' own speech, Windows' online speech recognition and Microsoft's terms apply. |
| Google Calendar | Google, through your own Google Cloud app | Reads the events of the calendars you tick. With sending on: the titles, dates and done state of your tasks and routines. | Only after you connect it; events are read when the calendar is shown. |
| Online videos and playlists in the Player and in notes | The video site (for YouTube: youtube.com, youtube-nocookie.com, i.ytimg.com) | The video's address. Playing loads the site's own player, which works under the site's terms. | A video's picture and title load when its tile is shown, and when a note with its link is shown (can be switched off: Settings › "YouTube links show the video"); the player loads when you play. Importing or refreshing a playlist, or finding a song, reads the site's pages when you click; a playlist you set to keep up with its original (off by default) is read every few hours. |
| Sending playlist changes | YouTube, through your own Google Cloud app | The changes you make to that playlist | Only for playlists you set to send; off by default |
| Names of videos a playlist lists without one | The Internet Archive (web.archive.org) | The video's address | When you import a playlist that has such videos, or ask for a name from a video's menu |
| Songs from a web address | The site of that address | A request for the file | When you add or play it |
| Links in notes | The site of the link | A request for the page, as a browser makes | When you paste a bare address (to get its title; can be switched off), when link cards are on (off by default) and the note is shown, or when you add a page as a source |
| The built-in browser | The sites you open, and the search engine you pick | What any browser sends to them | When you browse. Leonote adds nothing to the pages. |
| Browser add-ons | Chrome Web Store, Microsoft Edge Add-ons or GitHub | The add-on's id | When you install one, and when you press Check for updates (or once a day, if you switch that on) |
| Optional tools (FFmpeg, Deno, whisper.cpp and its model; in the direct download also yt-dlp) | Their makers' download sites (GitHub, gyan.dev, Hugging Face), or winget | A download request | Only when you click to install one |
| Saving online videos (direct download only, not the Microsoft Store version) | The site of the video, through the yt-dlp tool you install | What anyone's browser would send; never your accounts or cookies | Off by default; only for a video you ask to save |
| Support and About | olexify.dev (the developer's site, hosted by Cloudflare) | Your IP address, to read the current donation goal | Only when you open Support or About yourself, at most every 6 hours |
Your keys and sign-ins
- API keys for AI, Jev and speech are stored on your computer only, encrypted for your Windows account. They are sent only to the service that issued them, and are not included in backups.
- Google sign-ins are made in your own browser with your own Google Cloud app. The lasting sign-in (refresh token) and your Google app's client secret are stored on your computer encrypted for your Windows account; the short-lived access token (an hour) is kept in Leonote's settings. Disconnecting in Settings removes them; you can also revoke access at myaccount.google.com.
Passwords you keep in Leonote
Passwords you save in Leonote's password vault are stored only on this computer, in one file encrypted with your master password. The master password is not stored anywhere, the vault locks after 5 minutes without use, and nothing in it is sent anywhere or included in backups. When you sign in to a site in the built-in browser, Leonote can offer to keep that sign-in; the details stay in memory until you answer.
Tools for AI agents
leonote-rs.exe --mcp lets an AI program on your computer read and write your notes and tasks, following each note's AI access setting. It talks only to that program on this computer and opens no network port.
The Microsoft Store version
Microsoft delivers and updates the app. Under your Windows settings, Microsoft may collect diagnostic data such as crash reports and share summaries of them, and of installs, with the developer through its Partner Center; these never include your notes. Microsoft's privacy statement applies to that: privacy.microsoft.com.
3. The leonote.app website
- Your theme and accent colour choices are kept in your browser's local storage, on your device.
- Cloudflare hosts the site and processes request data (such as your IP address) to deliver and protect it.
- The heading font loads from Google Fonts, which receives your IP address.
4. Donations and payments
Leonote is free. If you donate (Ko-fi, Patreon) or, later, pay for an optional extra, the platform or payment provider handles the payment under its own policy. Leonote receives what it needs to deliver, support, refund and keep tax records – such as your name, e-mail and the amount – never your card details.
5. Contacting the developer
If you write to olexifyyy@gmail.com, your message is used only to answer you and is deleted when it is no longer needed. Community discussion happens on third-party platforms (such as Discord) under their own policies.
6. Sharing
Personal data is not sold. It is shared only with the processors that make the above work (payment, hosting and email providers), with authorities when the law requires it, and with a successor if the business is transferred.
7. Legal bases and transfers
Where data protection law applies, data is processed to perform a contract (an answer to you, anything you pay for), to meet legal obligations (tax records) and for legitimate interests (keeping the website safe). Data may be processed outside your country; where required, under adequacy decisions or standard contractual clauses.
8. Your rights
You may ask for access to, correction or deletion of personal data the developer holds about you, ask to restrict or object to its use, and ask for a copy to take elsewhere. Write to olexifyyy@gmail.com; requests are answered within one month. You may also complain to your local data protection authority.
9. Children
The app and the website are not directed at children under 16.
10. Security
Your notes are ordinary files and Leonote does not encrypt them on disk; protect your computer with your Windows account and disk encryption. Backups are encrypted with your backup password, which Leonote never stores or sends. Passwords you keep in Leonote and your API keys are encrypted as described above.
11. Changes
When this policy changes, the date at the top changes with it, and the old versions stay available on request. If Leonote ever offers a service of its own that holds your data, such as hosted sync or storage, it will be optional, described here before it starts, and will change nothing for those who do not use it.