Privacy Policy
Last updated 11 October 2026
Who we are
Penline is a private notes, tasks, expenses and PDF app made by Nawacode Est. This policy explains what personal data Penline handles, why, and the choices you have.
It covers the Penline apps for iPhone, iPad and Android, the website at penline.app, and any help we give you by email.
- Controller: Nawacode Est., registered in Riyadh, Saudi Arabia
- Contact for privacy questions: support@penline.app
The short version
We cannot read what you write. Your notes, tasks, expenses, PDFs and attachments are end-to-end encrypted on your device before they reach our servers, and the key never leaves your devices.
- We hold only what we need to run your account: your email, username, name, devices, and encrypted data we cannot open.
- We do not sell your data, show ads, or build profiles about you.
- Crash reports and app-health signals keep the app running smoothly and help us fix bugs. They never contain your content, and you can switch them off in Settings.
- You can export your notes and expenses, and delete your account, at any time from the app.
What we collect
| What | Examples | Why we need it |
|---|---|---|
| Account details | Email address, username, full name | To sign you in, send sign-in codes, and let you find each other when sharing |
| Encrypted content | Notes, tasks, expenses, PDFs, attachments, folders, settings, all as ciphertext | To sync your data across your devices |
| Content metadata | Item counts, sizes, timestamps, version numbers | To sync correctly, enforce storage limits, and show your storage use |
| Devices | Device name, platform (iOS or Android), when it was added and last seen, a device public key | To approve new devices and let you sign them out |
| Security events | Sign-ins, sign-in codes sent, devices added or approved, failed attempts | To protect your account and investigate problems you report |
| Notification tokens | A push token for each device | To send sign-in alerts and reminders |
| Purchases | Subscription status and purchase identifiers from Apple or Google | To unlock Pro. We never see your card details |
| Crash reports and app health | Error type, app version, device model, OS version; a short session signal each time the app opens; sync-health signals that can include internal record identifiers (never content) | To keep the app performing smoothly and behaving correctly, and to fix bugs. On by default, switchable in Settings |
| Support messages | What you send us by email | To answer you |
We do not collect your location, contacts, photos library, advertising identifiers, or browsing activity.
What we cannot see
Our servers store your content only as encrypted data, and we never hold the key to open it. That means we cannot read, search, scan or hand over:
- the text, titles and tags of your notes and tasks
- your expenses, amounts, merchants and receipts
- your PDFs and your annotations on them
- photos, drawings, voice memos and other attachments
- your Master Key, master password and recovery key
It also means we cannot recover your data if you lose both your master password and your recovery key. When you share with other Penline users, such as in a shared expense group, the data is encrypted for the people you choose, and only they can read it.
How we use your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Run your account and sync your data | Account details, encrypted content, metadata, devices | Contract: we need it to provide Penline |
| Keep your account secure | Security events, devices, sign-in codes | Legitimate interests: protecting you and the service |
| Send sign-in codes, alerts and reminders | Email, push tokens | Contract |
| Unlock and manage Pro | Purchase status and identifiers | Contract |
| Keep the app performing smoothly and fix crashes and errors | Crash reports and app health | Legitimate interests; you can switch them off at any time |
| Answer support requests | Support messages, account details | Contract and legitimate interests |
| Meet legal obligations | What the law requires, such as billing records | Legal obligation |
We do not use your data for advertising, sell it, or share it for others' marketing. We do not make automated decisions that have legal or similarly significant effects on you.
Service providers we use
These companies process data on our behalf, only to run Penline. None of them can read your encrypted content.
| Provider | What they do for us | Data they handle | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, database, file storage, sign-in, sign-in code emails, backups | All account data and encrypted content | Frankfurt, Germany (EU) |
| Apple | App Store purchases and push notifications on iPhone and iPad | Purchase records, push tokens | Apple's infrastructure |
| Google Play purchases, push notifications (Firebase Cloud Messaging), and on Android the on-device text recognition used to scan receipts | Purchase records, push tokens; for receipt scanning, anonymous usage and performance statistics about the feature (the receipt image and its text stay on your device) | Google's infrastructure | |
| Sentry | Crash reports and app-health signals, if you leave them on | Crash reports and health signals, with no content, email or username | EU |
Contacted directly by your device:
- open.er-api.com supplies currency exchange rates when you record an expense in another currency. Your device asks for current rates; no account data or expense details are sent.
Where your data is stored
Your account and encrypted data are stored with Amazon Web Services in Frankfurt, Germany.
Apple, Google and Sentry may process the limited data they handle outside the EU. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision, such as the EU–US Data Privacy Framework.
On your device, Penline keeps a local copy of your data in an encrypted database so it works offline.
How long we keep your data
We keep your data while your account is open. When you delete your account, it is scheduled for deletion and permanently erased after 30 days.
| Data | How long |
|---|---|
| Account and encrypted content | Until you delete it, or your account is erased |
| Items you move to Trash | Until you empty the Trash or restore them |
| Account after you request deletion | 30 days, so you can change your mind; then permanently erased |
| Security event log | 1 year |
| Backups (encrypted) | Up to 90 days for daily backups and 1 year for monthly backups, then deleted automatically |
| Sign-in directory snapshot (email and account id) | Up to 90 days |
| Crash reports | 90 days |
After your account is erased, copies may remain in backups until those backups expire. They stay encrypted, are never restored for any purpose other than disaster recovery, and are deleted on the schedule above.
When we erase an account, we keep a short record that the erasure happened, with item counts but no content, so we can prove it was done.
Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you
- Correct it if it is wrong
- Delete it, or delete your whole account
- Export it in a portable format
- Object to or restrict how we use it
- Withdraw consent where we rely on it
Much of this you can do yourself in the app: export notes and expenses, switch off crash reports in Settings → Diagnostics, and delete your account in Settings → Delete account.
For anything else, email support@penline.app. We reply within one month. Because your content is end-to-end encrypted, we can give you only the encrypted form of it; the readable copy is on your devices.
If you are in the EU or UK and unhappy with our answer, you can complain to your local data protection authority.
How we protect your data
- End-to-end encryption. Each item is encrypted with its own key (XChaCha20-Poly1305), and those keys are locked with a Master Key that only your devices hold.
- Encrypted on your device. The local database is encrypted, and your keys are kept in the iOS Keychain or Android Keystore.
- Approved devices only. A new device needs your master password, your recovery key, or approval from a device you already use.
- Strong passwords. When you create or change your master password, Penline takes extra measures to make sure it is strong. Your password never leaves your device.
- Encrypted in transit and at rest. All traffic uses HTTPS, and our servers encrypt stored data with managed keys.
- Limited staff access. Our support tools never show your content, and every support action is recorded under the staff member's name.
Device backups. If you back up your phone to iCloud or Google, those backups can include the keys that unlock your Penline data on that device. Keep your device backups protected with a strong password.
If a breach ever puts your personal data at risk, we will tell you and the relevant authority without undue delay, as the law requires.
Children
Penline is not meant for children under 16. We do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we make a meaningful change, we will tell you in the app or by email before it takes effect. The date at the top shows when this policy was last updated.
Contact us
Email support@penline.app with any privacy question or request. We aim to reply within a few working days, and always within one month.