01Who is responsible and what this covers
Shenzhen Caractiv Tech Company Limited (深圳市焦糖互动科技有限公司) is responsible for personal information handled by this website and the jottable services we provide. Our contact details are below. This policy covers the app and download website according to your version, region, settings and choices. Describing hosted AI, accounts or sync here does not enable them before release.
This is not a blanket guarantee for every external AI service. Providers you configure and websites you visit may independently determine their processing. Review the actual recipient shown in the app and that recipient’s policy before use.
02Purposes and applicable grounds
We process information only for the features you request, necessary security and support, charge reconciliation and legal obligations. Accepting service terms does not expand those purposes. You do not need to provide us with all content you manage independently on your device.
Where applicable law requires, AI transmission, optional analytics, sensitive-information processing or international transfers rely on the relevant valid consent. Providing online services you request may also rely on performance of a contract. Necessary security and compliance processing relies on legal obligations or, where local law permits and individual rights have been balanced, legitimate interests. General terms do not replace a required separate consent. Contact us about the ground for a particular activity.
03Tasks and data on your device
Task titles and text, categories, tags, dates, recurrence and reminder rules, operation history, backups, preferences, drafts, import sources and search indexes are stored in the app’s private local storage. Ordinary manual management does not automatically send your entire task library to Jottable’s business services.
Local search and system reminders run on the device. Notification content may appear on its lock screen or notification centre. You can change previews, disable notifications or hide task titles in app and system settings. We do not read your system calendar to arrange task reminders.
04Voice, text and AI: what is sent and to whom
When you request transcription, the audio you record goes to the actual selected recognition service. Polishing uses the relevant transcript and necessary settings. Task interpretation or an AI query uses the text you explicitly submit, necessary candidate task context and tool results. Simply opening the app does not upload your entire library.
- Your own service: relevant audio, text and necessary context go directly from the device to your configured provider or custom endpoint, without a Jottable hosted AI proxy. Keys are held in this app’s secure storage on the device, excluded from task files, analytics, exports and content sync.
- Jottable AI: only when offered in your version and region and selected by you, relevant requests go to Jottable and then the AI recipient disclosed before use. Necessary identity, quota, usage and request-state information may also be processed.
- Possible recipients: supported options can include OpenAI, Alibaba Cloud, DeepSeek, Deepgram, AssemblyAI and compatible custom services. Support does not mean every request is sent to every provider. The actual recipient follows your configuration and pre-use disclosure and may be outside your region.
On first use or a recipient change, the app explains the recipient, materials and purpose and requests consent as required. You can decline and still use manual tasks. With valid consent and provider support, audio can be sent while you record; otherwise it stays local until consent and later processing. Changing modes does not silently change the paying party.
05Imports, web search and page reading
If you choose AI-assisted import, readable text from the selected files, file names or relative source information and necessary context go to your current task-understanding service. Original-format backup import can run locally. Do not select files you lack permission to process or do not want transmitted.
With web search enabled, query terms go to the selected free, own-key or Jottable-managed search source. Managed search also passes through Jottable’s search service. Sources can include Mwmbl and, according to the selected configuration, Baidu, Serper, SerpApi, Brave, Tavily, Exa, Bocha, Zhipu or self-hosted SearXNG—not every source at once. Search providers and destination sites can receive your IP address, headers and request content. Page reading visits the destination directly; extracted text or summaries may become context for your AI request. These actions do not publish your private files, but recipients still process what is sent.
06Optional accounts, sync, support and service records
Only when account and sync features are offered and you actively use them do we process necessary identity-provider identifiers, basic profile details, sessions and the task content, versions and conflicts you choose to sync. Recording history and your provider keys are not part of task sync by default. Signing in alone does not make unsynced local content synced.
If you contact us, we process the email address, problem description and attachments you choose to send. Prefer redacted diagnostics; do not send keys or unnecessary private recordings. Online services may handle network addresses, request correlation identifiers, status, timing and usage for authentication, security, diagnosis and metering. Ordinary logs and analytics must not contain task text, audio or full transcripts.
07Analytics, website storage and advertising
Optional app usage analytics and attribution use AppsFlyer only with valid consent and an available configuration. The current configuration is off by default. Data can include platform, app version, device form factor, interface language, action types, counts, timing, error categories, installation/app-instance identifiers, IP addresses and deduplication identifiers. It excludes task titles and text, audio, transcripts, search terms, file names, keys and tokens. The app does not proactively request advertising-identifier tracking permission. You can withdraw analytics consent to stop future sending; previously received data follows applicable deletion procedures.
This download website itself sets no analytics or advertising cookies, embeds no ad trackers, external fonts or third-party analytics scripts, and has no email subscription form. Language selection uses URLs. Its hosting or network provider may retain access logs needed to deliver and secure the site. Store, email and external-policy links lead to services with their own practices.
We do not sell or rent your personal information, use task content for interest-based advertising, or use it to train our own general-purpose AI models. A third-party model’s retention, improvement or training rules depend on its policy and your agreement; do not assume every provider offers zero retention or no training.
08How long information remains
- Local tasks, drafts and sources: kept to support the features you use until you delete or clear the relevant data, or device storage, uninstallation or system behaviour affects it. Trash, history and backups may retain recovery copies; deleting a current task does not erase every backup or export.
- Local recordings and their text: kept by default until you delete them in recording history. Successful transcription, task submission, updates or remote cleanup do not automatically delete local history. Removing a recording does not undo saved tasks or erase separately edited drafts.
- Temporary Jottable-hosted speech materials: original server audio is deleted after successful recognition; failed audio and temporary transcripts are kept for at most 24 hours. This does not set the retention period of the selected third party.
- Local backups and optional analytics queue: daily pre-write snapshots and pre-restore snapshots each retain seven rolling copies. Unsent optional analytics entries expire after 24 hours. You manage files you export separately.
- Other online records: kept only as needed to provide services, handle requests, protect security, settle charges or meet legal obligations, then deleted or de-identified when no basis remains. Independently received third-party data follows that party’s periods.
09Sharing, security and international processing
We transmit necessary information to the recipients for the features you request. We may also disclose information to competent authorities as legally required or protect and lawfully transfer necessary records during a business reorganisation. Not every supported provider is a recipient of every request. Where we engage a service provider to process data on our behalf, we require protection consistent with this policy and applicable law within that processing relationship.
We use risk-appropriate safeguards, including encrypted production transport, app-profile isolation, secure key storage, access controls and content-log restrictions. No device or transmission method is absolutely secure. You should also check the security, address and access permissions of a custom service.
We are located in China. Your selected AI, search or website service may process information in other countries or regions. Actual recipients and regions follow pre-use disclosures and your service selection. Where law requires, we provide necessary disclosures, lawful transfer safeguards and separate consent; this policy does not replace those steps.
10Your choices and rights
You may avoid AI, withdraw relevant consent, change or delete your keys, stop web tools, disable analytics or system permissions, and use available app controls to inspect, edit, export or delete local content. Withdrawal does not invalidate earlier lawful processing or retrieve requests already delivered to a third party.
If account features are offered, account deletion is available through settings; merely disabling sync or signing out does not delete cloud data. To request hosted-data deletion, withdraw consent or exercise applicable rights of access, correction, deletion, restriction, objection or portability, email contactus@caractiv.com with the relevant service and request. We may verify identity proportionately and respond within the period required by applicable law. We do not ask for your AI key to verify identity.
We may not have access to purely local data, which you must manage on your device. You may also complain to a competent data protection authority. If a legal exception or retention duty applies, we will explain it.
11Children, changes and contact
jottable supports general personal work and task management and is not directed at children under 13. Follow local requirements if the age of independent consent is higher or guardian permission is needed. Contact us if you believe a child supplied information without required authorisation.
We publish changes and the date on this page. Material changes to purposes, recipients or your rights receive any legally required notice or consent. Use the contact below for privacy questions, complaints or deletion requests.
Shenzhen Caractiv Tech Company Limited
深圳市焦糖互动科技有限公司
Registered address: 5/F, Area A, Jiada R&D Building, No.5, Songpingshan road, Songpingshan, Xili, Nanshan
深圳市南山区西丽街道松坪山社区松坪山路5号嘉达研发大楼A座510
Email: contactus@caractiv.com