Everything stays on your own computers.

In short

• Your recordings, transcripts, notes and everything else Syft Notes makes are kept on your own computers: your laptop, and your library's computer if you use one. Nothing is sent to the people who make Syft Notes, and we have no way to see it.
• The audio never leaves the computer that recorded it. It's transcribed on that computer, by Whisper, NVIDIA Parakeet or Cactus Whistle, depending on the computer and the model you choose.
• No tracking, advertising or crash reporting. The app has no code that reports what you do, what you record or what's in your notes. The one thing it sends is a daily count, described under What the app contacts, which you can turn off.
• Calendars and Canvas are read-only. A calendar is a link you paste in, and Canvas is reached with your own sign-in. What Syft Notes reads goes only to your own library, and you can stop it at any time.
• The AI that writes your notes is the one you choose. With Ollama, nothing leaves your computer. With Claude, ChatGPT or Gemini, your transcripts go to that company under your own account.

Syft Notes is free, open-source software under the MIT licence. Everything on this page can be checked in its source code.

What stays on your computers

Syft Notes keeps its data in two folders, unless you choose other places. Your notes are in Documents/Study Stash on your library's computer (Settings → Your library → Library → Notes folder shows where). Its settings, the lecture database and your recordings are in ~/.study-stash in your home folder (on Windows, C:\Users\<you>\.study-stash). Between them, they hold:

• your recordings and their transcripts;
• your study notes, as plain Markdown files in a folder per class, and the lecture database;
• your classes, settings, and the questions you've asked and their answers;
• what Syft Notes has copied from Canvas and your calendars (below);
• the sign-ins it needs: your library's password, the addresses of the calendar links you pasted, your Granola sign-in if you connect Granola, and an API key for Claude, ChatGPT or Gemini if you give Syft Notes one. Files holding secrets are written so only your own user account can read them.

Between your own computers. With a laptop and a library, the laptop sends each lecture to the library, and the library sends back notes, over your home network or over Tailscale, a private network you set up with your own Tailscale account. The library is protected by its password. A phone you pair (see the phone guide) reaches the library over Tailscale's HTTPS and is let in by a pairing code you make in Settings; you can remove a phone at any time. Tailscale is a separate service with its own privacy policy; it sees which of your devices are connected, not what they send each other.

Your iPhone or iPad, through your own Google Drive

The Syft Notes app on an iPhone or iPad works with the Syft Notes on your computer through a private folder in your own Google Drive. You connect it on both, each time with Google's own sign-in, and you can stop at any time (Settings → Phone → Disconnect on the computer, or Sign out on the phone).

• The folder. Syft Notes asks Google for your email address, to show which account is connected, and for one Drive permission only: its own hidden app folder in your Drive (Google calls it the application data folder). Only Syft Notes can see it, not you in Drive, not other apps, and not us. It's in your Google account and counts towards your Drive storage.
• What's in it. A copy of what the phone shows (your classes, lectures and their notes, chats, what's due and your calendar), the phone's requests to your computer (a recording's transcript and your typed notes, a renamed lecture, a question, a file or photo you add) and your computer's answers. Your computer removes requests once it has done them.
• On the phone. A lecture recorded on the phone is written down on the phone, with Apple's own speech recognition, and the recording stays on the phone; the words and your typed notes go to your computer through the folder. Whiteboard photos you take, and files you add, go the same way. The microphone is used only while you record, and the camera only while you take a photo.
• Without Google. Under Other ways, a phone can instead reach your computer over Tailscale, as described above, or try the app with sample classes that never leave the phone.

Ask on the phone. Before your first question, the app asks your permission. A question goes from your phone, through your own Google Drive folder, to Syft Notes on your laptop. The AI you chose there (Claude, ChatGPT, Gemini or Ollama) answers it under your own account, and the answer comes back the same way. Nothing goes to the people who make Syft Notes.

Google's own Third-party connections page shows Syft Notes and lets you remove its access, which also lets Google delete its folder.

Deleting it. Delete a lecture, a class or a phone in the app. To remove everything, delete both folders: your notes folder and .study-stash (and, on a Mac, the Canvas extension's own folder, ~/Syft Notes/Chrome extension, or ~/Study Stash/Chrome extension from an earlier version, if you loaded the extension from a folder). Uninstalling the app leaves them in place, so your notes aren't lost by accident.

Calendars (calendar links)

If you add a calendar, Syft Notes uses it to show your upcoming classes and events, and to work out which class a recording belongs to and what to call it. Adding one is optional, and everything else works without it.

What it reads

You add a calendar by pasting its link (a webcal:// or .ics address) in Settings. Google, iCloud and many school timetables give you one. Syft Notes doesn't sign in to your Google, Apple or Microsoft calendar, and it asks none of them for permission. A link can only be read, so Syft Notes can't create, change or delete anything in your calendar. Some links are secret addresses, so Syft Notes keeps them in a file only your own user account can read.

From the link, Syft Notes reads the events in that calendar: each event's title, start and end, whether it's all day, its location, its attendees, its link and whether it's cancelled. It reads events from around now to a few days ahead, not your whole history.

What it does with it

• Shows your upcoming classes and events in the app, on your library's pages and in your phone app.
• Matches an event to one of your classes, so a lecture recorded at that time is filed under the right class and named after it, and (only if you turn it on) so Syft Notes can start recording when a class begins.

Where it goes

• The laptop that records downloads the link. It keeps what it read on that computer and sends the next seven days of events (title, times, location, and the class it matched) to your own library, which, with one computer, is the same computer.
• Your calendar data is never sent to the developers of Syft Notes or to anyone else. It isn't sold, used for advertising, or used to train AI models. Syft Notes doesn't give it to the AI engine that writes your notes; only the name of the class it matched is used.
• The link is sent only to the address it points to, to download the calendar.

Taking it back

• In Syft Notes, remove the calendar from Settings. It forgets the link and the events it copied from that computer.
• If the link is a secret address, you can also make it stop working in the calendar's own settings (for Google, by resetting the secret address).

Google API data: Limited Use

Syft Notes asks Google for three permissions, all for the iPhone and iPad app's link to your computer: to know who you are (openid), your email address (email) so it can show which account is connected, and the app's own hidden folder in your Drive (drive.appdata). It asks for no calendar, email, contacts or other Drive files. In particular, data Syft Notes receives from Google is:

• used only to provide the features described above, which you can see in the app;
• transferred only to your own Syft Notes library (a computer you control) and your own phone or iPad, and only to provide those features; never to the developers of Syft Notes or any other third party, except as needed to comply with the law;
• never used or transferred for advertising, including retargeting or personalised or interest-based advertising;
• never used to train or improve AI or machine learning models, general or otherwise;
• never sold, and never used to determine creditworthiness or for lending;
• never read by a person. The developers have no access to it at all: it exists only on your computers.

Canvas

Syft Notes copies your Canvas courses (what's due, assignments and rubrics, your submissions and feedback, modules, files, pages, announcements, quizzes and discussions) into your library, so they sit next to your lectures. It does this through the Syft Notes for Canvas browser extension, in Chrome, Firefox or a browser built on one of them, using your own Canvas sign-in in that browser. Syft Notes never sees your Canvas password. To find your school without asking you to type its address, the extension looks at which instructure.com sites your browser is signed in to Canvas on: the Canvas sign-in cookie's name and the site it belongs to, never what's in it. It then asks that Canvas who's signed in. The browser sends your sign-in to Canvas as it would for any page you open; the extension never copies it or sends it anywhere.

• It only reads. Nothing on Canvas is changed or submitted.
• What it reads goes only to your own library, on a computer you control. Not to the developers, not to anyone else.
• The extension can reach only Canvas (instructure.com, or your school's own Canvas address), Canvas's file storage and your library: the sites you allow when your browser asks.
• To stop, remove the extension from your browser. To delete what was copied, delete the class's Canvas folder in your library.

AI engines

Syft Notes writes notes and answers questions with an AI engine you choose in Settings, running on your library's computer:

• Ollama runs entirely on your computer. Nothing leaves it.
• Claude, ChatGPT or Gemini run through programs from Anthropic, OpenAI and Google (Claude Code, Codex and Gemini) that you install and sign in to with your own account and plan. When you choose one, Syft Notes gives it the lecture's transcript (or the notes and passages a question needs, and your whiteboard photos when it writes a lecture's notes) and the company's service writes the answer. That company handles it under its terms and privacy policy, with your account. Syft Notes' developers never see it.
• An API key for Claude, ChatGPT or Gemini can be used instead, if you give Syft Notes one in Settings → Your library → Your AI. Syft Notes then sends the transcript (or the notes and passages a question needs) straight to that company's API, with your key. The key is kept in a file in .study-stash on your library's computer and is sent only to that company's API.
• Claude, ChatGPT and other AI apps can read your library only if you set that up in Settings → Your library → Your AI, and only read. The apps on your computer (the Claude and ChatGPT apps, Claude Code, Gemini CLI) read it through that computer once you choose Connect on their AI's card there, with no address on the internet. claude.ai and chatgpt.com in a browser, and the Claude phone app, run on Anthropic's and OpenAI's servers, so they need your library to have an address on the internet: that's off unless you turn it on, and it's protected by signing in with your library password.

Without an engine, lectures are still transcribed and filed.

What the app contacts

Apart from your own computers and the services you connect (your calendar links, Canvas, Granola, and the AI engine you choose), Syft Notes contacts:

• GitHub, to check for and download updates from Syft Notes' own releases. Each download is checked against the release's checksums. You can turn automatic updates off.
• Hugging Face, to download the transcription model you pick (a Whisper model or NVIDIA Parakeet; Cactus Whistle comes with the app) and, if you turn on Tell speakers apart, the models that tell voices apart. And ollama.com if you ask it to install Ollama or a model.
• jsDelivr, a public CDN, when your library's web pages show formulas: your browser loads the KaTeX maths typesetter from it.
• Cloudflare's public DNS, only when you check whether claude.ai can reach your library, to look your library's address up the way the internet would.
• Google's and Mozilla's public add-on services, while you set up Canvas: to ask which version of the Syft Notes for Canvas add-on your browser's store has now, so setup knows whether it can skip typing your school's address. It sends no information about you, and what comes back is one version number.
• Syft Notes' daily count, kept in Google's Firestore in Syft Notes' own project: once a day, the computer app sends one record with a random code made for this copy of the app (not linked to you, your accounts or your computer's name), the day, the app's version and whether it's a Mac, Windows or Linux. That's all it holds, and nothing outside the project can read it. It tells us how many copies are in use. Turn it off in Settings → General → Count this copy. The iPhone and iPad app sends no count at all.

None of these requests include your notes, recordings, calendar or Canvas data, and none identify you beyond what any web request does (your IP address). The daily count doesn't keep your IP address.

Granola is contacted only if you connect it in Settings → Granola, to bring over lectures you recorded there. You sign in on Granola's own page in your browser, so Syft Notes never sees your Granola password. It then looks at your lectures in Granola every few minutes, through Granola's own connection for apps (mcp.granola.ai), and a lecture you choose to transfer goes to your own library, the way a recording does. It only reads: nothing in Granola is changed. The sign-in is kept in .study-stash on the computer you record on, with the email address of your Granola account (so Settings can show it) and a note of which lectures you've brought over or left. Disconnect forgets the sign-in, and the lectures already brought over stay.

This website

This site is static pages hosted by Firebase Hosting. It sets no cookies, runs no analytics and loads nothing from other sites. Google, as the host, may keep standard server logs (such as IP addresses) under the Google Privacy Policy. Download links go to GitHub.

Your choices

Because your data is on your own computers, you're in control of all of it: you can open, copy, export (every lecture's notes download as Markdown) or delete it at any time, without asking anyone. We hold no data about you, so there's nothing for us to hand over, correct or delete. Stopping a calendar or Canvas is described above.

Syft Notes is made for students and isn't directed at children under 13.

Changes

If this policy changes, the new version is posted here with a new date, and every earlier version stays in the site's history on GitHub. If Syft Notes ever needs to read something new, it will ask you first.

Contact

Questions about privacy: email support@syftnotes.com, or open an issue on GitHub. To report a security problem privately, use the repository's Report a vulnerability form. See Support for more.