Privacy Policy
Effective 6 November 2026
The short version
- Capable Notes is a desktop app. Your notes are files on your own computer.
- We don't run servers that receive your notes, and the app has no analytics or tracking.
- If you turn on sync, your notes go directly from your PC to the storage you chose — Google Drive, Cloudflare R2 or a folder.
- With Google Drive, the app can only see the files it created. We never sell your data, show you ads or use it to train AI.
1. Who we are
Capable Notes (“the app”) is made by Capable Technologies (Pty) Ltd, a company registered in South Africa (“we”, “us”). This policy explains what information the app and this website handle, and how. If you have questions, email hello@capabletech.net.
2. Your notes stay on your PC
Capable Notes is local-first. Your notes, attachments, tags, version history and settings are stored as files in a folder you choose on your computer or on an external drive (your “vault”). The app also keeps a search index in its data folder on your PC. You don't need an account with us to use the app, and we have no copy of your vault.
Passwords and keys the app needs — such as a Google sign-in token, a Cloudflare R2 secret key, a Claude API key or your encryption key — are stored in Windows Credential Manager on your PC, never in your vault and never sent to us.
3. What we collect
From the app: nothing. The app has no analytics, telemetry, advertising or tracking, and doesn't send your notes, usage or personal information to us.
When you contact us: if you email us, we receive your email address and whatever you include in your message, and use it only to reply and to support you.
4. Google user data
Google Drive sync is optional. If you choose it, the app asks you to sign in with Google and grant the following permission:
| Permission (scope) | What it allows | Why the app needs it |
|---|---|---|
https://www.googleapis.com/auth/drive.file |
See, create, edit and delete only the files and folders the app creates in your Google Drive. | To keep a synced copy of your vault in a “Capable Notes” folder, so the same notes are available on your other computers. |
What Google data the app accesses
- The “Capable Notes” folder and the files inside it that the app created: your synced notes, attachments and version history (encrypted, if you turned on end-to-end encryption), and their names, sizes, checksums and modification times.
- The email address of the Google account you signed in with, so the app can show you which account a vault is synced to.
The app cannot see, open or change any other file, document, photo or folder in your Google Drive.
How the app uses Google data
- To upload, download, update and delete the vault files it manages, keeping your vault in sync across your computers.
- To list the vaults you have already synced to Drive, so you can open one on another computer.
- To display the connected account's email address in the app.
Google data is used only to provide these sync features you asked for. It is not used for advertising, not sold, not used to build profiles, and not used to develop, improve or train AI or machine-learning models.
Where Google data goes
All Google Drive traffic goes directly between your computer and Google. Your Drive files, your sign-in token and your account email are never sent to Capable Technologies or to any other third party. Your sign-in token and account email are stored only on your PC (the token in Windows Credential Manager).
Limited Use
Capable Notes' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access
You can disconnect Google Drive sync in the app at any time, which also deletes the stored sign-in token from your PC. You can revoke the app's access at any time in your Google Account under Third-party apps & services. To delete the synced copy, delete the “Capable Notes” folder from your Google Drive. Your local vault is not affected.
5. Other services you choose
Some optional features connect to other services. They only run if you set them up, and the app talks to them directly from your PC. Each service handles data under its own privacy policy.
| Feature | Service | What is sent |
|---|---|---|
| Cloud sync | Cloudflare R2 or another S3-compatible storage provider, using your own account | Your vault files (encrypted if you turned on end-to-end encryption). |
| Folder sync and backups | A folder or drive you choose | Your vault files or a zip backup. Nothing leaves your network unless that folder does. |
| Built-in AI (Gemma) | Hugging Face and GitHub, for the one-time download of the AI model and runtime | A normal download request (your IP address). Your notes are not sent — the model runs on your PC. |
| Claude AI | Anthropic, using your own API key | The text you ask Claude to work on (for example, a selection to rewrite or a page to summarise). |
| Ollama | An Ollama server you run, usually on your own PC | The text you ask it to work on. |
| AI connections (MCP) | AI apps you connect, such as Claude Desktop or Claude Code | Only what you allow: read-only, ask-before-write or allow writes. That app's provider handles what it reads under its own terms. |
6. How your data is protected
- Secrets are stored in Windows Credential Manager, not in plain files.
- Connections to Google, Anthropic and the AI model downloads use HTTPS. For R2 or other S3-compatible storage, the app uses the endpoint address you enter.
- With end-to-end encryption on, notes are encrypted on your PC (XChaCha20-Poly1305, with a key derived from your passphrase using Argon2id) before they are uploaded, so your storage provider only holds scrambled data. We never have your passphrase, key or recovery key, and can't recover them.
- The AI-connection server listens only on your own computer (127.0.0.1), and every AI change is kept in version history.
7. Sharing and selling
We don't sell, rent or share your personal information or your notes, because we don't receive them. We don't show ads. Data only goes to the services you set up yourself, as described above.
8. Keeping and deleting data
You decide how long your data is kept. To delete it, delete your vault folder, any synced copy (for example the “Capable Notes” folder in Google Drive or your R2 bucket) and any backups. Disconnecting sync in the app removes the stored sign-in token or secret for that vault; you can also remove saved secrets in Windows Credential Manager. Emails you send us are kept only as long as needed to help you, and deleted on request.
9. Your rights
Depending on where you live, laws such as South Africa's Protection of Personal Information Act (POPIA) and the EU and UK GDPR give you rights to access, correct, delete or object to the processing of your personal information. Because your notes stay under your control, you can exercise most of these yourself. For anything we hold — such as emails you sent us — contact hello@capabletech.net. You may also complain to the Information Regulator of South Africa or your local data protection authority.
10. Children
The app is not directed at children under 13, and we don't knowingly collect information from them.
11. This website
This website does not use cookies, analytics or trackers. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device. Fonts are loaded from Google Fonts, which receives your IP address to serve them.
12. Changes and contact
If we change this policy, we'll update the date at the top of this page and, for significant changes, mention it in the app's release notes. Questions or requests: hello@capabletech.net, Capable Technologies (Pty) Ltd, South Africa.