Privacy Policy

Article 1 (Personal Information Collected)

If you use the app without signing in — the Company collects no personal information. It asks for no sign-up and no login.

• What you write — notes, tasks, events, reminder times and so on — is stored only on your own device.
• Reading your sentence and filing it as a note, task, or event is performed entirely on the device. The text you type is not sent to the Company or to any third-party server. The judgement is made by rules on the device; no external language model is called.
• Reading text out of photos, screenshots and scanned documents (OCR), and turning voice recordings into text (transcription) are likewise performed entirely on the device, using Apple's on-device recognition. Photos, recordings and recognition results are not sent to the Company or to any third-party server, and the feature is not offered for languages that have no on-device model.
• The camera is used only for document scanning, and captured images are stored on the device as note attachments. The microphone is used only for voice recording.
• The Company uses no analytics SDK, no advertising SDK, no crash-reporting SDK, and no advertising identifier (IDFA). The website carries no analytics or advertising scripts either.
• The Company does not collect or store your contact details, location, address book, or advertising identifier.
• Anonymous usage statistics — only if you turn them on under Settings → About in the app. Once a week the app sends counts of how often features were used (lines written and how they were filed, corrections, widget and share entries, paywall views and purchases), the app version, iOS version, language setting, and a random per-installation identifier to the Company's server (Cloud Storage on Google Firebase). Note text, titles, account details and location are never included. Turning it off also deletes the counts kept on the device; statistics already sent cannot identify you.

If you sign in and turn on sync — the following is stored on the Company's servers. Signing in is optional; if you never do, none of it is collected.

• What you write — the body, title, tags, dates and times of your notes, tasks and events, together with the deletion markers that keep a deleted item from coming back on another device.
• Photos, voice recordings and files you attach to a note — keeping attachments in the cloud is a paid (Pro) feature. A free user's attachments are not uploaded; they stay on the device.
• Account details — the name and email address that Sign in with Apple, or Google sign-in, passes to the Service. If you choose Apple's “Hide My Email”, the Company only ever receives the relay address.
• An account identifier — a random string used to tell whose writing is whose (a Firebase user ID).
• An installation identifier — a random string the sync SDK creates per app installation. The Company does not read or use it directly, and it is never used for advertising or tracking.
• Subscription entitlement — to decide whether to enable paid features, only whether a subscription is valid and when it expires is stored. The Company never receives your payment details.

If you use the web (oneline.date) — the web uses the same account and the same servers as above. The only things that arise on the web alone are these.

• Storage inside your browser — your signed-in state and a copy of the notes you have recently opened are kept in the browser's own storage (local storage and IndexedDB), so that what you write is not lost when the network drops. That copy never leaves your browser. Signing out, or clearing the site's data in your browser, removes it.
• Access logs — delivering the web pages leaves your IP address, the time of the request, and your browser type in the logs of the delivery provider (Cloudflare). They are used only to operate the service and to investigate faults, never to identify or profile you.
• The Company uses no advertising or tracking cookies. Nothing is sold on the web, so no payment details are received there.

The Company never receives your Apple or Google account password. Authentication is performed by Apple and Google, and only the result is passed to the Company.

If you choose to email manager@x-ti.org directly, your email address and the contents of your message reach the Company only to the extent needed to answer you. That is information you send voluntarily, not information the Service collects.

Article 2 (Purpose of Processing)

The Company processes personal information only for the purposes below and never beyond them. It is never used for advertising, profiling, user tracking, or sale to third parties.

• Providing sync between devices — only if you sign in, your writing and attachments are kept so that you can carry on from another device or the web, and after reinstalling. Account details are used solely to determine whose writing is whose.
• Providing paid features — checking your subscription entitlement in order to turn cloud storage of attachments and web access on and off.
• Responding to inquiries — an email you send is used only to reply to you, and is not used for any other purpose once the matter is resolved.
• Subscription management — payment, renewal, and refunds for the paid subscription are handled by Apple, and the Company only checks whether a subscription is active. Nothing is sold on the web.

Article 3 (Provision to Third Parties and Outsourcing)

The Company does not sell your personal information or share it with third parties for marketing. It outsources processing only as far as needed to run the service:

• Google LLC (Firebase) — handling of sign-in (Firebase Authentication), storage and sync of your writing (Cloud Firestore), and storage of attachments and anonymous usage statistics (Cloud Storage). The scope is everything listed under “If you sign in and turn on sync” in Article 1, plus the anonymous usage statistics if you have turned them on. Your writing and account information are held in the Seoul region of Google Cloud (asia-northeast3), in the Republic of Korea; attachments and anonymous usage statistics are held in the asia-east1 region (Taiwan) of Cloud Storage. If you neither sign in nor turn on usage statistics, no such outsourcing occurs.
• Apple Inc. — distribution through the App Store and payment for the paid subscription. Payment information is handled between you and Apple and is not passed to the Company.
• Cloudflare, Inc. — delivery of the oneline.date web pages and handling of the domain. This leaves access logs (IP address, request time, browser type); what you write does not travel through this path.

Apple's and Google's handling of personal information is governed by their own privacy policies.

Article 3-2 (Transfer of Personal Information Overseas)

What you write is not transferred overseas. Even when you sign in and turn on sync, your writing and account information are held in the Seoul region of Google Cloud (asia-northeast3), in the Republic of Korea.

Attachments (photos and voice recordings) and anonymous usage statistics, however, are held in the asia-east1 region of Google Cloud Storage, which constitutes a transfer overseas.

• Recipient — Google LLC (Firebase)
• Country — Taiwan (Google Cloud asia-east1)
• When and how — at the moment you upload an attachment, over the network (HTTPS)
• Items transferred — photos, voice recordings and files attached to notes; anonymous usage statistics and the installation identifier
• Purpose — storing attachments and aggregating usage statistics
• Retention period — until you delete your account

Cloud storage of attachments is a paid (Pro) feature, so this transfer does not occur for free users. Usage statistics can be turned off under Settings → About in the app.

Simply opening a web page causes the following transfer.

• Recipient — Cloudflare, Inc.
• Country — the United States and Cloudflare's edge servers in various countries
• Items transferred — IP address, request time, browser type
• Purpose — delivering the web pages and investigating faults
• Retention period — Cloudflare's log retention period

You may refuse this transfer. Simply use the app and not the web, and either do not upload attachments or turn off usage statistics under Settings → About in the app. Information stored on the server can be removed with Settings → Account → Delete account in the app. Refusing does not affect any on-device feature of the app.

Article 4 (Retention and Destruction)

If you have signed in, the Company keeps your writing until you delete it yourself. It does not set a retention period and does not delete anything on its own initiative.

• Tapping Settings → Account → Delete account in the app deletes your account and everything stored on the server (notes and attachments included) immediately and irreversibly. Your Apple and Google sign-in links are revoked at the same time.
• Switching the storage location to “This device only” or “Back up to a file” stops anything further from being uploaded. To remove what is already there, use Delete account above.
• What you enter in the Service is stored on your device and is deleted along with the app when you delete it. If you were signed in, the copy on the server remains until you delete your account.
• Signing out on the web clears the copy left in your browser.
• Backup files you export are kept and deleted by you.
• Inquiry emails are destroyed within three years of the reply being sent.

Article 5 (Your Rights)

You can view, edit, and delete your own data at any time.

• Edit or delete any individual item directly, in the app or on the web.
• Use backup export to get all of your data as a file, and restore to bring it back.
• Deleting the app deletes the data stored on the device.
• Deleting your account and everything stored on the server is something you can do yourself in Settings → Account → Delete account. There is no request procedure and no waiting period.
• You may also exercise your rights of access, correction, deletion and restriction of processing by writing to manager@x-ti.org, and the Company will act without delay.

Article 6 (Security Measures)

• On-device processing — the judgement that sorts your sentences happens on the device, and your text is not transmitted to a server for it.
• Optional collection — nothing at all is collected from users who do not sign in.
• Encryption in transit — all communication, in the app and on the web, is over HTTPS end to end.
• Access control — server security rules mean each user's writing and attachments can be read and written only by that user's own account; no other user can reach them.
• Device protection — data stored on the device is protected by iOS file protection. We recommend keeping a device passcode, Face ID, or Touch ID enabled.
• Shared computers — the web leaves a copy in the browser, so we recommend signing out after using a shared computer.

Article 7 (Children's Information)

The Service is not directed at children under the age of 14, and the Company does not separately collect or use children's personal information. Nothing at all is collected from users who do not sign in.

Article 8 (Data Protection Officer)

For questions, complaints, or remedies concerning the handling of personal information, please contact:

Data Protection Officer

Cho Seunggyu

Email

manager@x-ti.org

Company

XTI Co., Ltd. (주식회사 엑스티아이)

Business registration no.

362-87-03342

Corporate registration no.

130111-1216844

Address

2F, 94 Yangcheon-ro, Gangseo-gu, Seoul 07604, Republic of Korea

Article 9 (Duty of Notice)

If anything in this privacy policy is added, removed, or changed, the Company will announce it on this page at least seven days before the change takes effect. For changes that materially affect users' rights, notice will also be given by other means, such as an in-app announcement.

• 30 August 2026 — first effective
• 5 September 2026 — cloud backup items revised
• 7 September 2026 — current. Clauses about iCloud sync were removed because the feature no longer exists, and the web (oneline.date) and Google sign-in were added. Later the same day, the overseas-transfer clause was corrected after the storage location of your writing was confirmed to be Seoul, Republic of Korea, and the Taiwan region holding attachments and anonymous usage statistics was set out as a transfer overseas.