Privacy Policy for Jottle

Last updated: 23 September 2026

This policy covers the Jottle apps for macOS, iOS, iPadOS and watchOS, including the widgets and watch complications (“the app”), published by Michael Shear. It explains what the app stores, where it is stored, and who can reach it — which, in every case, is you.

The app's bundle identifiers and its iCloud container still carry the name QuickNote, which is what Jottle was called during development. They are internal identifiers, they refer to this app, and they are deliberately unchanged because renaming them would strand the data they hold.

What the app stores

Everything the app stores is content you created:

• The text of your notes.
• For each note: when it was created, when it was last changed, and whether you pinned or archived it.
• For a locked note: the encrypted body, and the short plain-text label you chose for it (see below).
• The encrypted vault key and its public salt, if you have ever locked a note.
• Your settings — text size, accent colour, light or dark, background, and on the Mac the global shortcut. Stored in the app's own preferences on each device, readable by this app and its widgets alone, and never synced.

That is the entirety of it. The app does not store or transmit:

• Your name, email address, or any account or login information — there is no account.
• Device identifiers, advertising identifiers, or IP addresses.
• Location data.
• Analytics, telemetry, usage statistics, or crash reports of any kind.
• Your contacts, photos, calendars, messages, health data, browsing history, or any other data belonging to other apps.

The app's privacy manifest declares no collected data types and no tracking, because there are none.

Where it is stored

In two places, both of them yours:

• On each device, in the app's own private container, shared between the app and its widgets so a widget can show a pinned note without a copy of the data being made anywhere else.
• In your private iCloud database, if you have iCloud enabled. This is Apple's CloudKit, running inside your Apple Account and billed against your iCloud storage. It is what keeps your Mac, iPhone, iPad and Apple Watch in step. The developer has no access to it, no credentials for it, and no way to read, copy or analyse its contents. Its handling by Apple is governed by Apple's privacy policy.

If iCloud is unavailable or switched off, the app falls back to a purely local store on that device and tells you so in a banner. Nothing is lost and nothing is sent anywhere.

Locked notes

Any note can be locked. When you lock one, its body is encrypted on your device with AES-256-GCM, under a key wrapped by a passphrase you choose and derived with PBKDF2-SHA256 at 600,000 iterations. Only the ciphertext is stored and only the ciphertext syncs. The encryption is Apple's own CryptoKit and CommonCrypto; there is no cryptography of the developer's invention here and no key ever leaves your devices.

Two consequences worth stating plainly:

• The passphrase is not recoverable. It is never stored, never transmitted, and not known to the developer or to Apple. There is no reset and no backdoor. If you forget it, the contents of those notes are permanently unreadable.
• The label you give a locked note is not encrypted. It is stored and synced in the clear so locked notes stay distinguishable in the list, and the app says so at the moment you choose it. Leave it empty if you would prefer nothing be visible.

After you have unlocked on a device, the app can keep a copy of the key in that device's Keychain, protected by Face ID or Touch ID. That copy is per device, never syncs, and is invalidated by the system if the device's enrolled biometrics change. Face ID is used for this and nothing else; no face or fingerprint data is ever seen by the app, only the system's yes-or-no answer.

Network access

The app makes no network requests of its own. There is no server to talk to. Syncing happens entirely through Apple's iCloud infrastructure, initiated by the operating system on your behalf, and the Mac app's purchase check goes through Apple's StoreKit in the same way (see Purchases).

Two points of full disclosure. The macOS app declares the sandbox's network-client entitlement, which is what CloudKit requires in order to reach iCloud at all; it is not used by the app to contact anything else, and the app contains no networking code. And the app registers for background remote notifications — these are iCloud's silent “something changed” pushes, carrying no content, and they are the mechanism by which a note written on your watch shows up on your Mac. The app never sends you a notification.

Purchases

Jottle is free on iPhone, iPad and Apple Watch. On the Mac it offers a free 14-day trial and a one-time purchase, both as ordinary App Store in-app purchases. They are handled entirely by Apple. The developer never receives your name, Apple Account, payment details or any other personal information from them — only the aggregated, anonymous sales figures Apple gives every developer.

To know whether the trial is running or the purchase has been made, the Mac app asks the system's StoreKit framework, which reads Apple's own signed record of your purchases. That is the one time the app causes anything to be requested from Apple other than iCloud, and it concerns your purchase only — never your notes. The iPhone, iPad and Apple Watch apps never ask.

Files you import and export

Export writes your notes as ordinary Markdown files, to a location you choose, on your device. Import reads them back. The app can only touch a folder you have explicitly picked, and it writes nothing outside it. Nothing about an import or an export is transmitted anywhere. Locked notes are excluded from export, because a locked note has no plain text to write.

Third parties

There are none. The app bundles no third-party analytics, advertising, attribution, crash-reporting or tracking libraries. No data about you or your notes is shared with any third party, because none is ever sent anywhere. Apple is not a third party in this sense — it is the platform your own iCloud account runs on, and it receives your notes only in your private database, at your instruction.

Tracking

The app does not track you, across apps or websites or at all, and contains no tracking domains. Nothing about your use of it is ever measured or reported.

Your control over your data

• Delete any note from within the app; the deletion syncs to your other devices.
• Export everything as plain Markdown files at any time — they are ordinary text, deliberately so, and they mean you are never locked in.
• Lock a note, change its passphrase, or remove its lock, whenever you like.
• Turn off iCloud syncing for the app in your device's iCloud settings. Your notes remain on the device.
• Revoke Face ID access in Settings → Jottle (iOS) or System Settings → Privacy & Security (macOS). You will be asked for the passphrase instead.
• Uninstall the app, which removes its local data from that device. Data held in your own iCloud account is removed through your Apple Account settings, in the same way as for any other app.

There is nothing to request from the developer, because there is nothing held by the developer.

Children's privacy

The app is not directed to children under 13, and does not knowingly collect personal information from anyone of any age — it collects none at all.

Changes to this policy

If the app's data handling ever changes, this page changes with it: the updated policy will be posted at this URL and the “last updated” date above revised.

Contact

Questions about this policy, or about Jottle generally: shearm@mac.com. General help is on the support page.