Privacy · Last updated 30 October 2026
Privacy Policy
What we hold, and what we never see.
The short version. Your notes, and everything about the people you support, stay on your device, encrypted with your PIN. Kura Notes LLC never receives them. What we do hold is small: your email address, your licence key and its status, a random identifier and type for each device that uses your key, billing records at Stripe, and short-lived sign-up records. We do not sell or share personal information, we do not use advertising or tracking, and we answer privacy requests from anyone in any US state.
On this page: Who this covers · What we never receive · What we hold · How we use it · Who helps us · No selling, no tracking · How long we keep it · How it is protected · Your rights · State privacy notices · Your notes and backups · Records integrity · Children · If something goes wrong · Changes · Contact
Who this covers
This policy explains how Kura Notes LLC, a Georgia limited liability company ("we", "us"), handles personal information about the people who visit kuranotes.app, sign up for or use Kura Notes, or write to us. It applies to the website, the app at care.kuranotes.app, the licence and billing service, and our emails. The people written about in notes are not our users, and their information never reaches us (see the next section).
What we never receive
Daily notes, drafts, addenda, incidents, medicines, goals, appointments, the names or labels of the people you support, the calendar, monthly summaries and the activity ledger are written and stored only on the device you use, encrypted with your PIN of 6 digits or more. Fingerprint, face or Windows Hello can unlock it too; the device checks those itself and the app only learns yes or no. There is no server that holds your notes, no copy or backup of them on our side, and no one at Kura Notes LLC who can read them.
This is not only a promise about our conduct. It is how the app is built: the app checks on your device, before anything is sent, that a request goes only to our licence service and carries only the fields listed below. You can see this in the app under More, then What leaves this device. We could not hand your notes to anyone, sell them, or lose them in a breach, because we do not have them.
What we hold, where it comes from, and why
| What | Where it comes from | Why |
|---|---|---|
| Your email address | You, at sign-up or when you write to us | To send your sign-up code, link and key; to tell you about your account, billing and changes to these terms; to answer you |
| Your licence key, plan, status and dates (trial, active, past due, ended, cancelled), the number of seats and people your plan covers, and a count of signed notes (a number only) | Our licence service | To run your plan and its limits |
| For each device that uses your key: a random identifier made by the app, a device type (for example "Windows PC" or "Android device"), the app version, which Kura Notes address it runs at, and when it last checked in | The app | To count devices and let you release a lost one |
| Billing records: your Stripe customer and subscription identifiers, and whether you are paying. Stripe holds your name, card details, billing address and payment history | Stripe, and you on Stripe's page | To take payment and manage your subscription. Card numbers go only to Stripe, never to us |
| Sign-up records: the address typed into the sign-up form, a one-way hash of the 6-digit code we emailed, the IP address used, and the time | The sign-up form | To prove the address is yours and stop abuse; deleted after 48 hours |
| A record that an address has used its free trial (the address in a standard form) | Sign-up | To allow one free trial per person |
| Which page you signed up from, a note we may add to your account (such as "pilot group"), the group or role we put you in, and a log of support actions we take on your account (with the time) | Us | To support you and keep a record if a question about your account comes up |
| Emails you send us, and our replies | You | To answer you |
| Ordinary web request data (IP address, browser type, time, page asked for) | Your browser, seen by Cloudflare, our host | To serve the site and app and protect them from attacks |
Under state privacy laws, these are identifiers (email, IP address, device identifier), commercial information (plan and payment status), and internet activity (request data). We do not collect sensitive personal information as those laws define it, other than an account key used to sign in. We do not collect consumer health data, precise location, biometric data, or information about race, religion, sexuality or similar characteristics. Biometric unlock happens entirely inside your device; the app and we receive only yes or no.
How we use it
Only to provide and support Kura Notes: create and run your account and plan, send the emails you need (codes, links, receipts, renewal notices, changes to terms, security notices), take payment, prevent fraud and abuse (including more than one free trial), keep the service working and protected, keep records the law requires, and enforce our terms. We do not use it for advertising, we do not build profiles, and no automated decision with legal or similar effects is made about you. We send marketing email only as described in our Email Policy, and you can always say no.
Who helps us run the service
We use as few service providers as the job allows. They may use your information only to provide their service to us. None of them receives notes or anything about the people you support. The current list, with what each one handles, is on the Service providers page: Cloudflare (hosting, the licence service and its database), Stripe (payments), and Resend (email sending). We may also disclose information if the law requires it (for example, a valid subpoena; we will tell you unless we are not allowed to), to protect rights, safety or property, or to a buyer if the business is sold, under this policy.
The app at care.kuranotes.app and this website carry their own copies of every typeface and make no request to Google or any other font or analytics service. (The old transitional copy at kuranotes.app/app/, kept only so people can move their notes, still loads two typefaces from Google Fonts until it is retired.)
No selling, no sharing for advertising, no tracking
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in California and other state laws, and we have not done so in the past 12 months. We do not use analytics, advertising, tracking pixels, session recording or third-party cookies. We honour Global Privacy Control signals, although there is nothing for them to switch off. See the Cookies and Local Storage Notice for what the site and app keep in your browser.
How long we keep it
- Sign-up codes, attempt records and IP addresses used for sign-up: 48 hours.
- Your account, licence and device records: while your account is open, and up to 3 years after it ends (so we can answer questions about it and keep proof of what you agreed to), unless you ask us to delete it sooner.
- The one-free-trial record: as long as we offer free trials.
- Records of payments and of your agreement to subscription terms: at least 3 years after the subscription ends, or longer if tax law requires (generally up to 7 years).
- Emails with us: up to 3 years after the last message.
- Cloudflare's own request logs: as set by Cloudflare's policies (short-term).
How it is protected
Information is sent over encrypted connections (HTTPS). The licence database is reachable only by our server code. The admin console is behind Cloudflare Access with two-step sign-in, and every request to it is checked again by the server. Sign-up codes are stored only as one-way hashes. No system is perfect, and we cannot promise that information we hold will never be accessed without permission, but we keep what we hold small precisely so that there is little to lose.
Your rights, wherever you live in the US
Whatever state you live in, you can ask us to:
- Know and access: tell you what personal information we hold about you, where it came from, why, and who we disclosed it to, and give you a copy in a portable form;
- Correct information that is wrong;
- Delete it. Deleting removes your account, licence key, device records and email from our systems (it cannot remove your notes, which we never had). We keep the one-free-trial record and any records the law requires us to keep, such as tax and payment records and proof of consent to subscription terms;
- Opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do none of these); and
- Not be treated differently for using any of these rights.
How to ask: email admin@kuranotes.org from the address on your account, with the subject "Privacy request" and what you want. We may ask you to confirm the request from that address, or to give your licence key, so we know it is you. You can use an authorised agent; we will ask for proof of their authority and may ask you to confirm. We will answer within 45 days (we will tell you if we need up to 45 more days, as the law allows). There is no charge.
Appeals: if we decline your request, you can appeal by replying with the subject "Privacy appeal". We will answer within 45 days (60 days where state law allows), and if you are still not satisfied you can contact your state attorney general.
State privacy notices
California (CCPA/CPRA). In the past 12 months we collected the categories listed in "What we hold", from the sources and for the purposes listed there, and disclosed them for business purposes only to the service providers named above. We have not sold or shared personal information, and we do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would give a right to limit it. California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing.
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws. The rights in "Your rights" cover the rights these laws give, including appeals. We do not sell personal data, process it for targeted advertising, or profile people in ways with legal or similar effects.
Washington, Nevada and Connecticut consumer health data laws. We do not collect, share or sell consumer health data as those laws define it. Information about the people you support stays on your device and never reaches us.
Nevada. We do not sell covered information as defined in Nevada law.
Your notes, and the trade-off we are asking you to accept
Because there is no cloud copy, your device is the only copy of your records unless you make another one. The app includes an encrypted backup file, protected by a passphrase you choose when you save it (not your PIN, because a file that leaves the device needs more than a short number). You can also move records from one device to another with the camera, with nothing sent over the internet. If you lose the passphrase, the backup cannot be opened, by you or by us: there is no recovery process, because a recovery process would mean we held a key, and we do not.
What you copy, export, print or back up, and where you put it (for example a cloud drive or your employer's system), is outside Kura Notes and is your responsibility and your employer's. That service's own privacy terms apply there.
Records integrity
Every note you sign is sealed on your device with a SHA-256 hash of its text, date, signer and time, and every action in the app is written to an activity ledger on your device in which each entry carries the hash of the one before it. If a note or ledger entry is altered or removed afterwards, the app reports it. This happens only on your device; we never see the ledger.
Children
Kura Notes is a work tool for adults. Accounts are only for people 18 and over. We do not knowingly collect personal information from anyone under 18; if you think we have, email us and we will delete it.
If something goes wrong
If we learn of a security breach affecting information we hold about you, we will tell you and any authorities as the law requires (including Georgia's breach notification law), without unreasonable delay.
Changes to this policy
If this policy changes, the date at the top changes with it. If the change is material, we email account holders before it takes effect. One thing will not change: no future version of Kura Notes will start uploading care records. Doing so would mean rebuilding the app around a server that does not exist, and it is the one commitment this product is organised around.
Contact
Kura Notes LLC, {{POSTAL_ADDRESS}}. Email admin@kuranotes.org. A person, the person who built the app, answers, normally within one business day.