Everything stays on your own computers.

In short

• Your recordings, transcripts, notes and everything else Syft Notes makes are kept on your own computers: your laptop, and your library's computer if you use one. Nothing is sent to the people who make Syft Notes, and we have no way to see it.
• The audio never leaves the computer that recorded it. It's transcribed on that computer, by Whisper, NVIDIA Parakeet or Cactus Whistle, depending on the computer and the model you choose.
• No tracking, advertising or crash reporting. The app has no code that reports what you do, what you record or what's in your notes. The one thing it sends is a daily count, described under What the app contacts, which you can turn off.
• Calendars and Canvas are read-only and reached with your own sign-in. What Syft Notes reads goes only to your own library, and you can revoke it at any time.
• The AI that writes your notes is the one you choose. With Ollama, nothing leaves your computer. With Claude Code, Codex or Gemini, your transcripts go to that company under your own account.

Syft Notes is free, open-source software under the MIT licence. Everything on this page can be checked in its source code.

What stays on your computers

Syft Notes keeps its data in two folders, unless you choose other places. Your notes are in Documents/Study Stash on your library's computer (Settings → Your library → Library → Notes folder shows where). Its settings, the lecture database and your recordings are in ~/.study-stash in your home folder (on Windows, C:\Users\<you>\.study-stash). Between them, they hold:

• your recordings and their transcripts;
• your study notes, as plain Markdown files in a folder per class, and the lecture database;
• your classes, settings, and the questions you've asked and their answers;
• what Syft Notes has copied from Canvas and your calendars (below);
• the sign-ins it needs: your library's password, the tokens that let it read your calendars, your Granola sign-in if you connect Granola, and an API key for Claude, ChatGPT or Gemini if you give Syft Notes one. Files holding secrets are written so only your own user account can read them.

Between your own computers. With a laptop and a library, the laptop sends each lecture to the library, and the library sends back notes, over your home network or over Tailscale, a private network you set up with your own Tailscale account. The library is protected by its password. A phone you pair (see the phone guide) reaches the library over Tailscale's HTTPS and is let in by a pairing code you make in Settings; you can remove a phone at any time. Tailscale is a separate service with its own privacy policy; it sees which of your devices are connected, not what they send each other.

Your iPhone or iPad, through your own Google Drive

The Syft Notes app on an iPhone or iPad works with the Syft Notes on your computer through a private folder in your own Google Drive. You connect it on both, each time with Google's own sign-in, and you can stop at any time (Settings → Phone → Disconnect on the computer, or Sign out on the phone).

• The folder. Syft Notes asks Google for one permission only: its own hidden app folder in your Drive (Google calls it the application data folder). Only Syft Notes can see it, not you in Drive, not other apps, and not us. It's in your Google account and counts towards your Drive storage.
• What's in it. A copy of what the phone shows (your classes, lectures and their notes, chats, what's due and your calendar), the phone's requests to your computer (a recording's transcript and your typed notes, a renamed lecture, a question, a file or photo you add) and your computer's answers. Your computer removes requests once it has done them.
• On the phone. A lecture recorded on the phone is written down on the phone, with Apple's own speech recognition, and the recording stays on the phone; the words and your typed notes go to your computer through the folder. Whiteboard photos you take, and files you add, go the same way. The microphone is used only while you record, and the camera only while you take a photo.
• Without Google. Under Other ways, a phone can instead reach your computer over Tailscale, as described above, or try the app with sample classes that never leave the phone.

Google's own Third-party connections page shows Syft Notes and lets you remove its access, which also lets Google delete its folder.

Deleting it. Delete a lecture, a class or a phone in the app. To remove everything, delete both folders: your notes folder and .study-stash (and, on a Mac, the Canvas extension's own folder, ~/Study Stash/Chrome extension). Uninstalling the app leaves them in place, so your notes aren't lost by accident.

Calendars (Google, Microsoft, Apple and calendar links)

If you connect a calendar, Syft Notes uses it to show your upcoming classes and events, and to work out which class a recording belongs to and what to call it. Connecting one is optional, and everything else works without it.

What it reads

Syft Notes asks only for read-only access. It can't create, change or delete anything in your calendars.

From those, Syft Notes reads your list of calendars (their names and colours) and the events in the calendars you choose: each event's title, start and end, whether it's all day, its location, its attendees, its link and whether it's cancelled. It reads events from around now to a few days ahead, not your whole history.

What it does with it

• Shows your upcoming classes and events in the app, on your library's pages and in your phone app.
• Matches an event to one of your classes, so a lecture recorded at that time is filed under the right class and named after it, and (only if you turn it on) so Syft Notes can start recording when a class begins.

Where it goes

• Calendars are read by the laptop that records. It keeps what it read on that computer and sends the next seven days of events (title, times, location, and the class it matched) to your own library, which, with one computer, is the same computer.
• Your calendar data is never sent to the developers of Syft Notes or to anyone else. It isn't sold, used for advertising, or used to train AI models. Syft Notes doesn't give it to the AI engine that writes your notes; only the name of the class it matched is used.
• The sign-in tokens for Google and Microsoft are stored on your laptop, readable only by your user account, and are sent only to Google or Microsoft.

Taking it back

• In Syft Notes, remove the account from Settings. It deletes the account's token and the events it copied from that computer.
• You can also revoke access from your account at any time: for Google at myaccount.google.com/connections; for a Microsoft personal account at account.live.com/consent/Manage, and for a work or school account at myapps.microsoft.com. Once access is revoked, Syft Notes can't read anything more.

Google API data: Limited Use

In particular, data Syft Notes receives from Google Calendar and Google Drive is:

• used only to provide the features described above, which you can see in the app;
• transferred only to your own Syft Notes library (a computer you control) and your own phone or iPad, and only to provide those features; never to the developers of Syft Notes or any other third party, except as needed to comply with the law;
• never used or transferred for advertising, including retargeting or personalised or interest-based advertising;
• never used to train or improve AI or machine learning models, general or otherwise;
• never sold, and never used to determine creditworthiness or for lending;
• never read by a person. The developers have no access to it at all: it exists only on your computers.

The same promises apply to what Syft Notes reads from Microsoft.

Canvas

Syft Notes copies your Canvas courses (what's due, assignments and rubrics, your submissions and feedback, modules, files, pages, announcements, quizzes and discussions) into your library, so they sit next to your lectures. It does this through the Syft Notes for Canvas browser extension, in Chrome, Firefox or a browser built on one of them, using your own Canvas sign-in in that browser. Syft Notes never sees your Canvas password, and the extension never reads your cookies: the browser sends them to Canvas as it would for any page you open.

• It only reads. Nothing on Canvas is changed or submitted.
• What it reads goes only to your own library, on a computer you control. Not to the developers, not to anyone else.
• The extension can reach only your school's Canvas, Canvas's file storage and your library: the sites you give it.
• To stop, remove the extension from your browser. To delete what was copied, delete the class's Canvas folder in your library.

AI engines

Syft Notes writes notes and answers questions with an AI engine you choose in Settings, running on your library's computer:

• Ollama runs entirely on your computer. Nothing leaves it.
• Claude Code, Codex or Gemini are programs from Anthropic, OpenAI and Google that you install and sign in to with your own account and plan. When you choose one, Syft Notes gives it the lecture's transcript (or the notes and passages a question needs, and your whiteboard photos when it writes a lecture's notes) and the company's service writes the answer. That company handles it under its terms and privacy policy, with your account. Syft Notes' developers never see it.
• An API key for Claude, ChatGPT or Gemini can be used instead, if you give Syft Notes one in Settings → Your library → Your AI. Syft Notes then sends the transcript (or the notes and passages a question needs) straight to that company's API, with your key. The key is kept in a file in .study-stash on your library's computer and is sent only to that company's API.
• Claude, ChatGPT and other AI apps can read your library only if you set that up in Settings → Your library → AI apps, and only read. The apps on your computer (the Claude and ChatGPT apps, Claude Code, Gemini CLI) read it through that computer once you choose Connect, with no address on the internet. claude.ai and chatgpt.com in a browser, and the Claude phone app, run on Anthropic's and OpenAI's servers, so they need your library to have an address on the internet: that's off unless you turn it on, and it's protected by signing in with your library password.

Without an engine, lectures are still transcribed and filed.

What the app contacts

Apart from your own computers and the services you connect (your calendars, Canvas, Granola, and the AI engine you choose), Syft Notes contacts:

• GitHub, to check for and download updates from Syft Notes' own releases. Each download is checked against the release's checksums. You can turn automatic updates off.
• Hugging Face, to download the transcription model you pick (a Whisper model or NVIDIA Parakeet; Cactus Whistle comes with the app) and, if you turn on Tell speakers apart, the models that tell voices apart. And ollama.com if you ask it to install Ollama or a model.
• jsDelivr, a public CDN, when your library's web pages show formulas: your browser loads the KaTeX maths typesetter from it.
• Cloudflare's public DNS, only when you check whether claude.ai can reach your library, to look your library's address up the way the internet would.
• Syft Notes' daily count, kept in Google's Firestore in Syft Notes' own project: once a day, the computer app sends one record with a random code made for this copy of the app (not linked to you, your accounts or your computer's name), the day, the app's version and whether it's a Mac or a PC. That's all it holds, and nothing outside the project can read it. It tells us how many copies are in use. Turn it off in Settings → General → Count this copy.

None of these requests include your notes, recordings, calendar or Canvas data, and none identify you beyond what any web request does (your IP address). The daily count doesn't keep your IP address.

Granola is contacted only if you connect it in Settings → Granola, to bring over lectures you recorded there. You sign in on Granola's own page in your browser, so Syft Notes never sees your Granola password. It then looks at your lectures in Granola every few minutes, through Granola's own connection for apps (mcp.granola.ai), and a lecture you choose to transfer goes to your own library, the way a recording does. It only reads: nothing in Granola is changed. The sign-in is kept in .study-stash on the computer you record on, with the email address of your Granola account (so Settings can show it) and a note of which lectures you've brought over or left. Disconnect forgets the sign-in, and the lectures already brought over stay.

This website

This site is static pages hosted by Firebase Hosting. It sets no cookies, runs no analytics and loads nothing from other sites. Google, as the host, may keep standard server logs (such as IP addresses) under the Google Privacy Policy. Download links go to GitHub.

Your choices

Because your data is on your own computers, you're in control of all of it: you can open, copy, export (every lecture's notes download as Markdown) or delete it at any time, without asking anyone. We hold no data about you, so there's nothing for us to hand over, correct or delete. Revoking calendar or Canvas access is described above.

Syft Notes is made for students and isn't directed at children under 13.

Changes

If this policy changes, the new version is posted here with a new date, and every earlier version stays in the site's history on GitHub. If Syft Notes ever needs to read something new, it will ask you first.

Contact

Questions about privacy: open an issue on GitHub. To report a security problem privately, use the repository's Report a vulnerability form. See Support for more.