Privacy
Draft for review, October 2, 2026
Draft for review. This policy is not yet in effect.
Lyra Notes keeps your notes as Markdown files on your devices and uses your iCloud account for note sync. You do not need a Lyra account to use your notes. This draft describes local storage, Apple services, optional dictation providers, web purchases and support.
Your files stay yours
Lyra Notes stores your notes as Markdown files on your Mac, iPhone or iPad. The Lyra licensing service does not receive your note text, titles or recordings just because you use Notes.
For iCloud note sync, Notes sends note content and the metadata needed to synchronize titles, pins, edits and deletions to Apple’s CloudKit private database for your iCloud account. Your iCloud account owns that library. Changing iCloud accounts opens a separate library instead of uploading the previous account’s notes to the new account.
Deleting a note in Notes keeps it recoverable in Recently Deleted for 30 days unless you permanently delete it sooner. Removing files through Finder, Files or another tool may bypass this recovery. Deletion and restoration synchronize across your devices. Sync is not a substitute for an independent backup.
Dictation and transcription
On-device dictation processes speech on your device. If you explicitly choose a supported cloud provider, Notes sends the recorded audio or live audio stream needed for transcription to that provider using the credential you add. Notes does not silently switch to a cloud provider after a transcription failure.
Provider credentials are stored in the Apple Keychain. Notes offers an optional setting to synchronize its provider keys between your Mac, iPhone and iPad through iCloud Keychain. This is off by default and must be enabled on each installation. Enabling key sync does not select a cloud dictation provider or give consent to send audio.
When transcription fails, Notes can retain the recording locally so you can explicitly retry. That temporary recording is removed after a successful retry, when you discard it or close its editor, or when you start a new recording. Recordings you independently choose to save on Mac follow your recording-retention setting.
Cloud providers process submitted audio under their own terms and privacy policies. A failed request, interrupted cleanup or provider retention setting can leave content with the provider. Local deletion is not a guarantee that the provider has deleted its copy.
Purchases, licenses, and recovery
Apple handles purchases made through the App Store and restoration with the purchasing App Store account. Notes verifies purchase evidence and stores it locally to recognize access, including when the store is temporarily unavailable. An App Store purchase does not give us your full payment-card details or require a Lyra delivery email.
For a web purchase, Stripe and Link handle checkout and payment information. We do not receive your full card number. We receive information needed to fulfill and support the order, such as your email address, product, price and currency, payment status, provider references, and refund or dispute status.
Our web licensing service uses that information to issue and recover accountless licenses. It stores one-way representations of license keys and recovery tokens rather than their plaintext values. Notes stores local license material in the Apple Keychain. Resend processes your email address and transactional message content when it delivers a web purchase or recovery email from licenses@lyranotes.com.
The App Store account used to buy Notes can differ from the iCloud account used for your notes. Restoring a purchase does not switch the notes library or transfer another person’s notes.
Software updates
The App Store handles updates to the iPhone and iPad app. For the directly distributed Mac app, checking for or downloading an update sends ordinary request information to the update host, such as IP address, time, requested file and app networking details. These update requests do not include your note contents.
Website analytics
We use Cloudflare Web Analytics to understand aggregate traffic. It counts visits and page views and reports broad information such as the referring website, country, device type, operating system, and page performance.
The analytics beacon does not use cookies, persistent visitor identifiers, fingerprinting, session replay, inferred demographic profiles, or cross-site tracking. We do not use it to measure bounce rate or dwell time. Cloudflare processes this analytics data as our service provider.
Your analytics choice
We respect Global Privacy Control and Do Not Track signals. You can also disable aggregate analytics for this browser. The preference is stored only in your browser so the analytics beacon stays off.
Support and communications
If you contact us, we receive the email address, message, attachments, and other information you choose to send. We use it to answer the request, investigate a problem, prevent abuse, and keep an appropriate support record. Purchase and recovery emails are transactional. We do not use them to enroll you in marketing without a separate choice.
How we share information
We do not sell personal information. We share information with service providers only as needed for hosting, payments, fraud prevention, email delivery, licensing, updates, analytics, and support. We may also preserve or disclose information when reasonably necessary to comply with law, protect people or the service, investigate fraud or abuse, or complete a corporate transaction subject to appropriate protections.
Retention and security
We keep personal information only as long as reasonably needed for the purpose described here, including delivery, recovery, accounting, tax, fraud prevention, disputes, support, and legal obligations. Retention periods differ by record and service provider.
We use access controls, encryption where appropriate, secret redaction, and limited operational logging. No method of storage or transmission is completely secure.
Your choices and rights
Depending on where you live, you may have rights to ask what personal information we hold about you, receive a copy, correct it, delete it, or object to certain uses. We may need to verify your request and may retain information where the law permits or requires it. Contact us at the address below.
Children
Lyra Notes and its website are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us so we can investigate and delete it where appropriate.
Changes
We may update this policy when Lyra Notes, its providers, or legal requirements change. We will post the revised policy here, change the effective date, and provide additional notice when required.