Privacy Policy

Effective date: October 28, 2026

Works Pretty Good LLC, a New York limited liability company ("Works Pretty Good LLC," "we," "us"), makes Etona, a notes app for iPhone and iPad. This policy explains what information Etona collects, what stays on your device, what goes to the companies that help us run it, and the choices and rights you have. It applies to the Etona app, this website, and the related services (the "Service"). In this policy, "your device" means an iPhone or iPad with Etona on it.

Contact for privacy questions and requests: support@etona.app, or Works Pretty Good LLC, 2248 Broadway #2262, New York, NY 10024.

Short version

  • Your notes save on your device first, then back up to our cloud. Our cloud runs on Google Firebase. The backup holds your notes' text and the photos, voice memos, files and web pages you save into them, so they survive a lost device and appear on any device you sign in to.
  • AI is your choice. Etona asks before anything goes to Google's Gemini AI. If you allow it, the text of your notes goes to Gemini through our server, including words read from your photos, recordings, files and saved pages. The photos, recordings and files themselves are not sent. You can turn AI off in Settings.
  • Google doesn't use that text to improve its products. We use Gemini under Google's paid terms, which say so. Google keeps what we send for up to 55 days to check for abuse.
  • Location is optional, and rounded. If you allow it, we save roughly where you wrote each note: a position rounded to about a kilometer, with the city and country.
  • No ads, no tracking, never sold. We count four app events and how many notes you write a week, never what you wrote. There is no third-party analytics code in Etona.
  • Our cloud is encrypted in transit and at rest. It is not end-to-end encrypted, so we are able to access what is stored there. Section 8 says when we would.
  • You can leave with everything. Export all your notes, delete a note, or delete your account in the app at any time. Section 7 says exactly what each deletion removes.
  • Etona is for adults in the United States.

1. Information we collect

Your account. If you sign in with Apple, Apple gives us an identifier for you and an email address, which is a relay address if you chose Hide My Email. We don't ask Apple for your name. If you sign up with an email address, we receive it and a password. The password is handled by our sign-in provider, Google Firebase Authentication, and we can't read it. We give each account an ID. We use your email address to sign you in, to send a password reset you ask for, and to tell you about important changes.

Your notes, and everything you save into them.

  • what you write, and links with their titles;
  • photos, screenshots and videos;
  • voice memos;
  • files, such as PDFs and documents;
  • web pages you save. Etona keeps a copy of the page's text and up to four of its images;
  • notes and conversations you import from other apps, such as Evernote, Obsidian, Apple Notes, ChatGPT and Claude, or from Markdown and text files.

With each note we keep its details: when it was made and edited, a file's name and type, whether it's pinned, whether it needs doing and by when, names you added to it or removed from it, and whether you've deleted it.

Notes can hold anything, including sensitive things such as health, relationships, money and beliefs, and information about other people. You decide what goes in. We use all of it only to run Etona for you.

All of this saves on your device first and then backs up to our cloud, on the free plan and with Etona Pro. Before a file is uploaded:

  • A photo you take, attach or share to Etona is re-encoded and uploaded with none of its metadata, such as where and when it was taken.
  • An image file kept in its original form has its GPS position removed. It keeps its other metadata, such as the time and the camera. If the position can't be removed, the file isn't uploaded.
  • Videos and other files are uploaded as they are, with any metadata inside them.

Some things are too big to back up and stay only on your device: a file over 100 MB, files beyond 10 GB for an account, and a note whose text runs past about 900 KB.

What Etona works out from your notes. Etona reads your notes in order to organize them. It works out:

  • the words in your photos, screenshots, PDFs and saved pages, and a transcript of each voice memo;
  • names: the people, places and organizations you mention;
  • for each note, a short subject of a few words, whether it needs doing, and a due date;
  • themes: groups of notes that belong together, each with a name and a color;
  • with Etona Pro, a page for each theme and Your week, written from your notes, with each sentence pointing to the notes it came from;
  • a search index, which includes numeric representations of passages from your notes (embeddings).

Some of this is inferred, and it can reveal sensitive things. A theme might be named after a health condition you write about, for example.

Most of it is saved in our cloud as well as on your device. The names, subject and to-dos that AI finds in a note, your themes (their names, colors and which notes are in each), theme pages and Your week are stored with your notes, under your account. That way another device you sign in to gets them without working them out again. Themes are grouped on your device and are saved to our cloud whether AI is on or off. Your own changes are saved there too: a theme you rename or reject, and a name you correct, merge, hide or keep. The search index and the words read from your files are not uploaded by Etona (section 2).

Location (optional). If you allow location access, Etona reads your device's location when you make a note. Before anything is stored or sent, it rounds the position to two decimal places, which is about a kilometer. The rounded position goes to Apple's location service to look up the city and country. We store the rounded latitude and longitude and the city and country with the note, on your device and in our cloud. Your exact position isn't stored and doesn't leave your device. Location is never sent to Gemini. You can turn it off in your device's Settings, under Etona.

Your choice about AI. Whether you allowed or declined Google's Gemini AI, and when you chose. It's saved with your account so it applies on every device you sign in to.

Subscription information. If you subscribe to Etona Pro, Apple takes the payment and we never receive your card details. Our subscription provider, RevenueCat, receives your account ID (a random ID before you sign in), Apple's purchase receipts, your device type and operating system version, and an identifier Apple gives our apps on your device, which isn't an advertising identifier. It tells us whether your account has Pro and until when. It does not receive your email address, your notes or an advertising identifier. Our server also keeps counters for your account: how many AI requests of each kind you've made this month, how many of the free plan's AI-read notes you've used, and how much storage your files take.

Usage counts. To learn whether Etona is working for people, we count four things in our own database, under your account:

  1. the first time themes form in your notes;
  2. each time the Etona Pro offer is shown, and whether it opened from the themes screen or from Settings;
  3. when a free trial starts;
  4. when you open Sky, counted at most once a day.

Each is stored as the event's name and the time. Nothing about your notes, your themes' names or your location is included. We also work out how many notes each account writes in a week. That comes from the dates of notes already in our cloud. It reads dates, never text, and our report shows totals, not individual accounts. We use no third-party analytics, advertising or tracking software in Etona. RevenueCat's reports on subscriptions, such as how many there are and on which plan, come from the purchase records described above, not from what you do in the app.

Messages to us. If you email us, including through Settings › Send feedback, we receive your email address and whatever you write.

Technical information. When Etona connects to our cloud or to RevenueCat, their servers receive standard technical information, such as your IP address, device type, and operating system and app versions. Google keeps sign-in IP addresses in its logs for a few weeks. When a request on our server fails, the server logs the error's name and code and may log your account ID. It is written so that these logs don't contain what your notes say. The logs are kept for about 30 days.

This website. This website does not use cookies or third-party analytics. Like any website, our hosting provider (Google Firebase Hosting) logs standard request information, such as IP address and the pages requested, for a few months. The app shows this policy and our terms by loading them from this website.

2. What stays on your device

Much of what Etona does happens on your device, using software Apple builds into iOS and iPadOS and a language model that Etona downloads once on each device from our cloud, over Wi-Fi:

  • reading the words in photos, screenshots and PDFs (Apple's Vision and PDF software);
  • transcribing voice memos (Apple's speech recognition, set to work on your device only). Your device may download a language pack from Apple for this;
  • finding the names of people, places and organizations (Apple's language software and Etona's own name finder);
  • search, by word and by meaning;
  • grouping notes into themes, and laying out Sky;
  • naming a theme, when your device has Apple's built-in language model and it can. Otherwise Gemini names it, and only if you allowed AI (section 4);
  • making your export file.

These features don't send what they read to Apple or to us. Some of what they produce does travel, in ways this policy describes: the note and its file back up to our cloud, and if you allowed AI, the words read from a photo, recording, PDF or saved page go to Gemini as part of that note's text.

Etona does not upload these. They are kept only on your device. Each device keeps its own; these don't pass between your devices:

  • the search index and its embeddings;
  • the words read from your photos, recordings and PDFs, as stored text. A saved web page is different: its text is inside the page's file, which does back up;
  • names found on your device, with three exceptions: up to 30 of the names you use most go to Gemini with each request to read a note (section 4), a name you edit is saved to our cloud, and a name you add to or remove from a note is saved with that note;
  • Sky's layout;
  • answers from Ask, unless you save one as a note;
  • which older notes you've told Your week not to bring up again;
  • your daily reminder time and appearance setting. The reminder is a notification scheduled on your device. We don't send push notifications;
  • files and notes too big to back up (section 1).

If you back up your device to iCloud or to a computer, Etona's data on the device is part of that backup, under Apple's terms and your own settings. We can't see or delete that backup.

3. How we use information

  • To provide the Service: create and secure your account; save, back up and sync your notes; read and organize them; and power search, names, themes, theme pages, Your week, Ask and Sky.
  • To provide and verify your subscription, and to apply each plan's limits.
  • To measure, in totals, whether people reach their first themes, keep writing and start trials (the usage counts in section 1).
  • To answer your messages and fix problems.
  • To protect the Service, prevent abuse, and comply with the law.

We do not sell your personal information, share it for advertising, show ads, or give it to data brokers. We do not use your notes for marketing or to train AI models, including large language models.

Etona does analyze your notes automatically, to find names, to-dos and themes. The results are shown to you and used for nothing else. We don't use them, or anything else, to make decisions about you that have legal or similarly significant effects.

We handle what's in your notes because you ask us to, by saving it in Etona. Nothing in your notes goes to Gemini without the separate permission described next.

4. AI, and what goes to Google's Gemini

It's your choice. Etona asks before any note goes to Google's Gemini AI: once in the introduction, and again before you subscribe to Etona Pro if you had said no. Nothing is sent until you say yes. You can change your choice any time in Settings, under AI. It's saved with your account and applies on every device you're signed in to. Another device picks up a change the next time it syncs, so for a short while it may still act on your earlier choice.

If you decline, nothing goes to Gemini. Etona still saves and backs up your notes. On your device, it still searches them, reads your photos and voice memos, finds names and groups notes into themes. Theme pages, Your week and Ask need AI.

What is sent, once you allow it. Requests go from your device to our server, which passes them to Gemini under our own Google account. We do not send your email address or account ID, your location, or your photos, recordings and files themselves. Here is each request and exactly what it carries:

  • Reading a note, when a note settles after you write or save it, and after an import (ten notes at a time). The note as one piece of text, up to about 6,000 characters: a saved page's title and site, what you wrote, then the words read from its photos, recordings, PDFs and saved page. With it go up to 30 of the names you use most across your notes, including names found on your device, so Gemini recognizes the same people and places, and the date the note was last edited. Gemini returns the names, a short subject, and whether something needs doing and by when.
  • Naming a theme, only when your device can't name it itself. The title and first line of up to 8 of the theme's notes, up to 160 characters each, and the names of up to 40 of your other themes, so the new name doesn't repeat one.
  • Writing a theme page (Etona Pro), when a theme has no page yet, and at most once a week after that. The theme's name, today's date, and up to 40 of its notes as dated, numbered passages, up to about 48,000 characters in all, with a saved page's title or site.
  • Writing Your week (Etona Pro), when you open it, at most once a day. Today's date and passages from your last seven days of notes.
  • Answering a question in Ask (Etona Pro), when you ask. Your question, today's date, and up to 16 passages from your notes that might answer it, up to about 24,000 characters.

On the free plan, Gemini reads only about your first 50 notes, imported ones included, and names up to 20 themes a month. Nothing else is sent. With Etona Pro, all five kinds of request are made, within monthly limits.

What our server keeps. Our server passes the text to Gemini and passes the result back to your device. It stores neither. It keeps the counters described in section 1. The results are saved on your device and backed up to our cloud with your notes, as section 1 says. Ask answers are not.

What Google does with it. We use Gemini under Google's paid API terms. Under those terms:

  • Google doesn't use what we send, or what Gemini sends back, to improve its products. It processes both on our behalf, under a data processing agreement.
  • Google logs both for a limited time, solely to detect misuse of its service and to make disclosures the law requires. Google says it keeps them for 55 days, that only authorized Google employees may review content its checks flag, and that the log isn't used to train AI models other than the ones that enforce its policies.
  • That log expires on Google's schedule. Deleting a note or your account doesn't remove it sooner.
  • Google may process this data, and briefly cache it, in any country where it has facilities.

Pages and answers written by AI can be wrong. See our Terms of Use.

5. Who we share information with

We share personal information only in these situations:

  • Google, as our service provider. Firebase Authentication signs you in. Cloud Firestore holds your notes and what Etona works out from them. Cloud Storage holds your files. Cloud Functions is our server, and Cloud Logging holds its logs. Firebase Hosting serves this website. If you allow AI, the Gemini API receives what section 4 lists. Google may use this data only to provide these services to us. Google handles some operating data of its own, such as IP addresses, under its own privacy policy.
  • RevenueCat, as our service provider, for subscriptions (section 1).
  • Resend, as our service provider, sends the emails you ask for, such as a password reset. It receives your email address and the email.
  • Apple, under its own privacy policy, for Sign in with Apple, App Store purchases, and looking up a place name from a rounded position. If you use Siri or dictation to make a note, Apple handles what you say.
  • Websites you save. When you save a link, your device fetches the page and its images itself, so that site sees an ordinary visit from your IP address.
  • Legal and safety. When the law or valid legal process requires it, or to protect rights, safety and property.
  • Business transfers. If Etona is sold or merged, your information may pass to the new owner, under this policy's protections. We'll tell you before that happens.
  • At your direction, such as when you export or share a note.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. Where information is kept

Etona is offered only in the United States. Our database and file storage are in Google data centers in the United States, RevenueCat stores its data in the United States, and Resend sends our emails from the United States. Text sent to Gemini may be processed, and briefly cached, in other countries where Google has facilities (section 4). We don't offer Etona to people in other countries.

7. Keeping, exporting and deleting

We keep your account and your notes until you delete them.

Export. Settings › Export all notes saves every note as Markdown, with its photos, recordings and files, each theme page and your names, in one zip file. It's made on your device, and it's available on any plan.

Deleting a note.

  • It leaves your notes right away, and leaves your other devices the next time they sync. Its text stays in our cloud and on your devices, hidden, for the next 30 days.
  • About a day after you delete it, its photos, recordings and files are removed from our cloud.
  • Thirty days after you delete it, a daily job on our server erases its text and everything saved in it, along with the names, subject and to-dos Etona found in it. This happens whether or not you open Etona again.
  • Each of your devices erases its own copy the next time Etona runs on it after that.
  • An empty marker stays: the note's ID and dates, with no content. It's how your other devices learn the note is gone. It's removed when you delete your account.
  • A theme page or Your week written before you deleted the note may still carry sentences drawn from it until that page is next rewritten.
  • If another of your devices edited the note before it learned of the deletion, Etona keeps that edit and the note comes back.

Deleting your account. Settings › Delete account deletes your account, and it can't be undone. Export first if you want a copy. It removes:

  • from our cloud: every photo, recording, file and saved page; every note, including deleted ones and their markers; everything Etona worked out from them (names, subjects, to-dos, themes, theme pages and Your week); your changes to names and themes; your choice about AI; your usage counts and counters; and your sign-in account;
  • from RevenueCat: our server tells RevenueCat to delete its record of your account;
  • from the device you delete it on: Etona's database, your notes' files, and your choice about AI;
  • from your other devices: the same things, the next time Etona opens there with a connection in the 30 days after you delete, and it signs out. Until then, our cloud refuses anything that device sends for the deleted account.

It does not remove:

  • Your subscription. Apple bills it, and you have to cancel it yourself: on an iPhone or iPad, open the Settings app › [your name] › Subscriptions. If you don't cancel, Apple keeps charging you.
  • Apple's records. Apple keeps your purchase history. Etona also stays in your Apple Account's list of apps that use Sign in with Apple. To remove it, go to Settings › [your name] › Sign in with Apple.
  • A marker that the account was deleted. Your account ID and the time you deleted it, with nothing else. It's how your other devices learn the account is gone, and how our cloud knows to refuse what they send. Etona reads it by account ID without signing in, because a deleted account can't sign in. It can't be listed or searched, and the answer is only the time. A daily job removes it once it's 30 days old.
  • Etona on a device where it isn't opened with a connection in those 30 days. Once the marker is gone, Etona there can't learn the account was deleted. Delete the app from that device: that removes its data.
  • A device backup you made before deleting, in iCloud or on a computer.
  • Copies in Google's systems that expire on their own: Gemini's abuse log (up to 55 days), our server's error logs (about 30 days), sign-in IP logs (a few weeks), and backups, which Google clears within 180 days.
  • Email you've sent us.

We may also keep limited information where the law requires it, or where we need it to resolve a dispute or enforce our agreements.

8. Security

  • Your data travels between your device and our cloud over encrypted connections, and Google encrypts it where it's stored.
  • It is not end-to-end encrypted. The keys are managed by Google on our behalf, so Works Pretty Good LLC is able to access what's stored in our cloud, and Google hosts it.
  • Our database and storage rules allow only your signed-in account to read or write your data through the app. The deleted-account marker in section 7 is the one exception.
  • We don't look at what your notes say. The exceptions: you ask us for help and agree to our looking; we need to investigate a security problem or misuse of the Service; or the law requires it, such as a court order.
  • Etona is made by a very small company. No system is perfectly secure, and we can't promise that ours is. If you need notes that no one else could ever read, use an app with end-to-end encryption.
  • If a breach affects your information, we'll notify you as the law requires.
  • Please use a strong, unique password, or Sign in with Apple.
  • Etona has no lock of its own. Anyone who can unlock your device can open Etona and read your notes there, so keep a passcode on a device you share.

9. Your choices and rights

In the app. You can turn AI on or off, turn off location and the daily reminder, edit or delete any note, rename or hide any theme or name, merge two names into one, export your notes, and delete your account.

State privacy rights. Many states give their residents rights over their personal information. They include California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. We offer the rights below to everyone who uses Etona, whichever state you live in. They are not absolute, and the law sets some limits:

  • to know whether we process your personal information, to access it, and to get a copy you can take elsewhere. Export gives you your notes, files, theme pages and names. For anything else we hold, including what Etona has inferred from your notes, ask us;
  • to correct it. You can edit your notes, names and themes in the app;
  • to have it deleted (section 7);
  • to withdraw consent. Turn AI off in Settings, and location off in your device's Settings. That stops future use. It doesn't undo what was already done;
  • to opt out of targeted advertising, the sale or sharing of personal information, and profiling that produces legal or similarly significant effects. We do none of these, so there is nothing to opt out of;
  • to limit the use of sensitive personal information. We already use it only to provide the Service you asked for;
  • to get a list of the third parties we've disclosed your personal information to. They are all named in section 5; and
  • not to be treated worse for using any of these rights.

How to make a request. Email support@etona.app or write to Works Pretty Good LLC, 2248 Broadway #2262, New York, NY 10024. If you're signed in, exporting and deleting in the app are the fastest ways to get or delete your data.

Verification and authorized agents. To protect you, we need to confirm that a request really comes from you. We'll use only the information in your request or already in your account for that. If you use an authorized agent, we may ask for your signed written permission, and we may deny the request without proof of authority. Where the law gives a deadline, we'll respond within it.

Appeals. If we decline to act on your request, you may appeal by replying to our response or emailing support@etona.app with the subject "Appeal." We'll tell you in writing what we decided and why. If your appeal is denied, you may contact your state attorney general.

California "Shine the Light." California residents may ask once a year for the categories of personal information we disclosed to third parties for their direct marketing in the prior year. We don't disclose personal information for third-party direct marketing.

Do Not Track. Etona doesn't track you across other companies' apps or websites, and we don't sell personal information or share it for advertising. So there is nothing for a Do Not Track or Global Privacy Control signal to switch off, and those signals don't change how Etona or this website works.

Health information. See our Consumer Health Data Privacy Policy for more about health-related information in your notes.

10. Age

Etona is for adults. You must be 18 or older to use it. It is not directed to children, and we don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has an account, contact us and we'll delete it.

11. Changes to this policy

We'll update this policy when Etona changes. The effective date at the top shows when it was last updated. If a change is material, we'll tell you in the app or by email before it takes effect. If a change would let us use information we already hold in a new way, such as sending it to a different AI provider, we'll ask you first, and you can say no.

12. Contact

Works Pretty Good LLC
2248 Broadway #2262, New York, NY 10024
Email: support@etona.app