Privacy Policy · OwlLuna

The short version

Collected by the developer: Nothing, apart from what TestFlight sends me while you test the beta: crash reports and details of your iPad, not your name or email address.
Accounts, analytics, ads, trackers: None. The app contains no third-party code at all.
Where your notebooks are: On your iPad. With iCloud on, a copy is kept in your own iCloud storage so your other devices have them. You can turn that off.
Handwriting, scans and speech: Read on the iPad, by Apple’s frameworks.
Removing everything: Delete your notebooks or the app, and clear the app’s data from your iCloud storage.

Who this is from

OwlLuna is made by Owais Khan (opens in a new tab), an independent developer. On this page “I” means me, and “the app” means OwlLuna for iPad. The app also runs on a Mac with Apple silicon, and it keeps and syncs your data the same way there. The Settings paths on this page, and what happens when the app is deleted, describe iPadOS.

The app is open source under the MIT License, so everything said here can be checked against the code (opens in a new tab).

What I collect

Nothing.

The app has no account, sign-in or registration.
It contains no analytics, no crash reporter, no advertising and no tracking. There is no third-party code in it of any kind, only Apple’s own frameworks.
It has no networking code of its own and no server to talk to. It has no way to send your notes to me or to anyone else.
It does not read or create any identifier for you or for your device, with one exception that stays on the iPad. So that iCloud sync can notice a different Apple Account signing in, it keeps a scrambled marker made from the token iPadOS gives the app for the signed-in iCloud account. The marker cannot be turned back into the account, tells one account from another and nothing more, and is never sent anywhere.
It has nothing to buy, so it handles no payment details.

That is why the app’s privacy label on the App Store will read “Data Not Collected”.

Testing the beta is the exception, because Apple’s TestFlight passes some details to me: see The TestFlight beta.

What the app keeps on your iPad

Everything you make in OwlLuna is saved as files in the app’s own storage on your iPad:

Your notebooks. Handwriting (with the moment each stroke was made, which replay and the time-lapse use), typed text, pictures, scans, imported PDFs, audio recordings and their transcripts, flashcards and when you last reviewed them, tags, bookmarks, links, the page you left off on, and when you last locked, favourited, filed, tagged or deleted the notebook.
The words read from your pages (handwriting, scans, PDFs, typed text and transcripts), so that search can find them.
Your settings, pens, folders, smart shelves and the stickers you made.
Your writing history. For each day, which pages you wrote on. It holds no text and no times of day. Settings › Writing History in the app turns it off or clears it.

Some of this is handed to iPadOS, on the same iPad, so that system features work:

Spotlight. Each notebook’s title, cover and the words in it, so it can be found from the Home Screen. Settings › Search in the app turns this off and removes what was indexed. Locked notebooks are left out.
Widgets. The title, page number and cover of the notebook you last opened, and how many pages you wrote on recent days. When it writes this, the app does not name a locked notebook or show its cover; the page counts do include pages written in locked notebooks. A notebook made from a PDF or a scan has its first page as its cover.
Siri and Shortcuts. The names and page counts of your notebooks, so you can ask for one by name. Locked notebooks are not offered; a shortcut you made before locking a notebook keeps its name and still opens it, once you unlock it. When you ask Siri for a notebook aloud, Apple handles that request (opens in a new tab), the name included, as it does any Siri request, which may not stay on the iPad.

When something goes wrong, such as a file that cannot be read or a sync that fails, the app writes a line to the iPad’s own system log. Those lines hold no note content and no notebook titles, and the app does not send them anywhere.

The app adds no encryption of its own. Your files are protected the way iPadOS protects every app’s files, which depends on your passcode. If you back up your iPad to iCloud or to a computer, iPadOS may include the app’s files, as it does for any app.

iCloud sync

iCloud sync is the one way OwlLuna itself copies your notebooks off the iPad without you sending them somewhere yourself.

It asks first

On a device that has never synced, OwlLuna copies nothing until you say yes. If the iPad is signed in to iCloud with iCloud Drive on, it asks once when it opens. Settings › iCloud in the app has the switch, and you can set it at any time, also before you sign in to iCloud. A device that was already syncing with an earlier version of OwlLuna carries on without being asked.

What is copied

Every notebook, whole: everything listed under “Your notebooks” above, the words read from its pages, and its flashcards. Locked notebooks are copied like any other.
Your folders and smart shelves, the pens in your tray, and the stickers you made.
A small file holding a random ID that names this copy of your library. It lets a device tell when the copy was erased, or is another account’s.

Your writing history, your other settings and the search index are not copied.

To tell what has changed since last time, each device also keeps a small record of what it last synced: the random IDs of its notebooks, with when each was last written in and last moved into or out of Recently Deleted, the IDs of its folders and smart shelves, the file names of its stickers, the ID of the iCloud copy, and the account marker described under What I collect. That record stays on the device.

Where it goes

Into the app’s private container in your own iCloud storage, under your Apple Account. It is Apple’s service: Apple moves the files between your devices, and I have no access to them. OwlLuna does not encrypt the copy itself; it is protected as the rest of your iCloud Drive is. Apple’s handling of it is covered by Apple’s Privacy Policy (opens in a new tab) and described in its iCloud data security overview (opens in a new tab).

Sync runs only while OwlLuna is running. If you use the app on a Mac signed in to the same Apple Account, it syncs there too.

OwlLuna syncs with the Apple Account the iPad is signed in to. If a different account signs in while sync is on, sync stops and asks before it copies your notebooks to that account’s iCloud storage or brings anything in from it. A sync already under way at that moment stops after the notebook it is copying. If you say yes, the notebooks on the iPad are copied there and the notebooks that account holds are added; nothing is deleted. If you say no, sync is turned off on that device and stays off until you turn it on again in Settings › iCloud in the app, which asks again. Before you pass the iPad on to someone else, delete the app.

Turning it off, and removing the copy

Settings › iCloud in the app has the switch, and each device has its own. Turning it off stops that device syncing. It does not remove what is already in iCloud.

To remove the iCloud copy, first turn sync off on every device, because a device that still has it on will put the notebooks back. Then delete OwlLuna’s data from your iCloud storage: iPadOS Settings › your name › iCloud lists the apps that keep data there (Apple renames those screens from time to time). If you turn sync on again afterwards, the device sees that the copy is gone and uploads its notebooks, folders and stickers again. Nothing is removed from the device.

When you delete a notebook

A notebook you delete for good is removed from iCloud the next time that device syncs, and from your other devices after that. A delete only applies to the version of the notebook that device had. If another device has written in the notebook since, or has taken it back out of Recently Deleted, the notebook is kept and comes back to the device that deleted it. That holds whether or not the other device’s change had reached the deleting device: a device that finds it holds a newer version than the one that was deleted keeps it and sends it to iCloud again. The same check is made for Recently Deleted: a notebook put there on one device and written in on another that had not heard of it comes back out. For a notebook that is removed, a small marker named with its random ID stays in the container so the other devices know which version was deleted. It holds two dates and nothing else: when that notebook was last written in, and when it was last moved into or out of Recently Deleted.

Permissions

iPadOS asks before the app may use any of these. Each is asked for only when you use the feature that needs it.

Camera: Only when you choose Scan Documents. Apple’s scanner takes the pictures; the app receives the pages you keep and saves them in the notebook.
Microphone: Only while you are recording: from when you start a recording until you stop it or close the notebook. A recording carries on when you switch to another app or lock the iPad, and iPadOS shows its own recording indicator meanwhile. In a notebook with a lock it stops, and is saved, when the notebook locks. The recording is saved in the notebook it was made in.
Photos: You choose pictures in Apple’s photo picker, and the app receives only those. It never looks through your library. A picture is saved as a new image, without the original file’s details, such as where it was taken. If you save an exported picture or video to Photos from the share sheet, iPadOS may ask to let the app add it.
Speech Recognition: Only when you ask for a transcript of a recording. It is done on the iPad: the app requires on-device recognition, and if the iPad cannot do that for the language, nothing is transcribed.
Calendar: Only if you add Today’s Events to a page, or turn on Print Today’s Events, which is off until you do. The app reads the titles and times of that day’s events and prints them on the page. From then on they are part of the notebook, like anything else written in it, and are synced and backed up with it.
Face ID, Touch ID or passcode: To open notebooks you have locked, to lock or unlock one, and before a backup when any notebook is locked. iPadOS does the checking and tells the app only yes or no.

You can withdraw them in iPadOS Settings, on OwlLuna’s own page under Apps or under Privacy & Security (Face ID is under Face ID & Passcode). The rest of the app keeps working, and recording, transcripts and Today’s Events tell you when their permission is off.

What Apple’s frameworks do

Reading your notes is done by frameworks that are part of iPadOS. The app passes them the text or the picture and makes no network request of its own.

Search, handwriting to text and stickers. Handwriting, scans and photo pages are read, and the subject of a photo is cut out for a sticker, by Apple’s Vision framework on the iPad.
Transcripts. Apple’s speech recogniser, on the iPad only, as described under Permissions.
Translation. Only when you choose Translate for handwriting you have turned into text. The app hands those lines to the translator built into iPadOS. Apple describes it as working on the device, once iPadOS has downloaded the language from Apple.
Study guides. Only when you open Study Guide. The words already read from your pages, or a recording’s transcript, are given to Apple’s on-device language model, the one behind Apple Intelligence, through Apple’s framework. OwlLuna has no other model and no server of its own, so on an iPad without Apple Intelligence there is no study guide.
Typing. Typed text goes through the ordinary iPadOS keyboard and text tools, such as dictation, autocorrection, or another keyboard you have installed. Those belong to iPadOS or to the keyboard’s maker and work as they do in any app.

How Apple’s features treat what they are given is described on Apple’s privacy pages (opens in a new tab).

What leaves when you send it

Apart from iCloud sync, nothing leaves the app unless you do one of these:

Export or print. A notebook as a PDF, pages as images, or a page as a time-lapse video is handed to the iPadOS share sheet or print panel. The file is named after the notebook, and a PDF carries its title, bookmarks and links. Covering something with ink or study tape does not take it out of an exported PDF: what lies underneath is still in the file.
Back up. Settings › Backup makes one file of your whole library and hands it to the share sheet. The file is not encrypted, and it contains every notebook, including locked ones and any still in Recently Deleted, along with your writing history. If any notebook is locked, making a backup, or sharing the last one again, asks for Face ID, Touch ID or the passcode first. Keep the file somewhere you trust.
Copy or drag. Text you copy goes to the iPadOS clipboard, and a picture you drop on a page comes in from another app.
Present. While you present, the page is shown on the second screen you connected.
Open a link. A web link you placed on a page opens in your browser, and Settings › About links to this website and to GitHub. What a visit here records is under This website; other sites have privacy policies of their own.

Where a file goes after the share sheet is up to the app or service you chose there.

Locked notebooks

A lock keeps a notebook closed in the app. It asks for Face ID, Touch ID or the passcode each time the notebook is opened, blurs its cover, and leaves what is written in it out of search, Spotlight, the widgets and On This Day.

It is not encryption. A locked notebook’s files are stored like any other notebook’s, and its iCloud copy and any backup file hold it in full. Its title is still shown in the library. It is not offered to Siri and Shortcuts, and making a backup asks you to unlock first.

With iCloud sync on, a lock reaches each of your other devices the next time that device syncs, whether or not the notebook has been written in since, and it is then taken out of that device’s Spotlight and widgets. Until a device has synced, it still opens the notebook without asking. Newer pages arriving from a device that had not yet received the lock do not remove it, and if a notebook changed on two devices is kept as a conflicted copy, the copy is locked as well.

Keeping and deleting

Your data stays until you remove it. Outside the TestFlight beta, there is no copy with me to keep, and none for me to delete.

A notebook: Deleting it moves it to Recently Deleted. It is removed for good after 30 days, the next time the app opens, or sooner if you delete it from there yourself. With iCloud sync on, the app syncs first when it can, so a notebook you restored on another device is not removed. If that restore has not reached this iPad by then, the notebook is removed here, stays on the device that restored it, and comes back here at a later sync.
A recording or a transcript: Each can be removed on its own from Recordings.
A page of an imported PDF: An imported PDF is kept whole inside its notebook, so a page you remove from the notebook stays in that file until the notebook itself is deleted.
Writing history: Settings › Writing History › Clear Writing History.
What Spotlight holds: Settings › Search › Find Notebooks in Spotlight, switched off, removes it.
Everything on the iPad: Delete the app. That removes its notebooks, settings, history and widget data from the iPad.
The iCloud copy: Deleting the app does not remove it. See iCloud sync above for how to.
Exports and backup files: Wherever you saved or sent them, they are yours to delete. A finished export or backup also stays in the app’s temporary storage until iPadOS clears it or the app is deleted.

Children

OwlLuna has no accounts, no ads, nothing to buy and no data collection, for children or for anyone else. I do not knowingly collect personal information from children, because I do not collect it from anybody.

What Apple tells me

If you have agreed to share analytics with app developers (iPadOS Settings › Privacy & Security › Analytics & Improvements), Apple may send me crash reports and usage figures for the app, and the App Store shows me totals such as how many times it was downloaded. Apple says these do not identify you. They come from iPadOS and the App Store, not from any code in OwlLuna, and you can switch the sharing off in the same place.

The TestFlight beta

The beta comes through TestFlight, which is Apple’s service, not code in OwlLuna. While you test, Apple collects the following and passes it to me. You cannot opt out of it.

Crash reports. When the app crashes, the crash log, which shows where in OwlLuna’s code it happened and how long the app had been running.
Usage and your iPad. How many times you installed and used each build, how many times it crashed, which version you have, your iPad’s model and an identifier for it, and its iPadOS version and language.

Feedback is up to you. If you send it from the TestFlight app, by taking a screenshot in OwlLuna, or when TestFlight asks after a crash, I also get your comments and any screenshot. With them come the iPad’s battery level, free storage, screen resolution, time zone, processor type, connection type and mobile carrier, and how long the app had been open. A screenshot shows whatever is on the screen, your notes included, and you can send feedback without one.

If you joined through the public link on this site, Apple does not show me your name or email address, and you appear to me as Anonymous. I see your email address only if you add it to a piece of feedback, or send feedback by email.

Apple lets me use all of this only to improve the app, and not share it with anyone else. Apple keeps feedback for a year, and may keep crash logs and usage until the bugs are fixed, as its TestFlight & Privacy notice (opens in a new tab) describes. To leave the beta, open OwlLuna in the TestFlight app and tap Stop Testing. Apple asks you to bring requests to see or delete your TestFlight data to the developer, so ask me as under Questions and requests. To see what Apple itself holds, go to privacy.apple.com (opens in a new tab).

This website

This site is a set of static pages hosted on GitHub Pages. It sets no cookies, runs no analytics and loads no trackers, and its fonts are served from the site itself. GitHub, as the host, logs technical details of visits such as IP addresses, as its Privacy Statement (opens in a new tab) describes. The links to the source code and to the issue tracker go to GitHub.

Questions and requests

Outside the TestFlight beta, I hold no data about you, so there is nothing I can look up, correct, export or delete on your behalf. Your data is on your own devices and in your own iCloud, where the steps above remove it.

For any question about this policy, open an issue on GitHub. Issues are public, so please leave anything private out of them. Posting needs a free GitHub account, and GitHub handles what you post under its own Privacy Statement (opens in a new tab).

Ask a question on GitHub Support

Changes to this policy

If the app changes in a way that affects anything here, I will update this page and the date at its top. Earlier versions are in the project’s public history (opens in a new tab).