NoteShuttle
Get the app

NoteShuttle Privacy Policy

Effective date:

1. Information We Collect

NoteShuttle collects information to deliver a secure, collaborative academic note-sharing and campus messaging environment:

  • Account & Profile Information: mobile phone number (for OTP authentication), display name, college name, branch, semester, year, and optional status line or profile photo. Your date of birth is verified at sign-up only to confirm you are at least 13 years old; it is not stored on our servers.
  • Academic Materials & Content: notes, documents, photos, audio clips, and whiteboards that you create, capture, or share.
  • Contact Information (Optional): if you grant permission, we access your device contacts solely to detect which classmates are already registered on NoteShuttle. Contacts are encrypted in transit and never shared or sold to third parties.
  • Device & Diagnostic Information: device model, OS version, push notification tokens (FCM), advertising identifiers, and app usage data collected for analytics.

2. How We Use Your Information

  • Enabling peer-to-peer and group study communication.
  • Syncing notes and study whiteboards across devices.
  • Delivering instant notifications for new academic notes or group messages.
  • Providing administrative tools for verified college institutions.
  • Serving and measuring advertisements and understanding app usage through the third-party services in Section 3.

3. Third-Party Services & Data We Share

NoteShuttle uses the following trusted service providers. For each, personal data (device identifiers, usage events, content, or credentials as noted) is collected by us and shared with that provider under their own terms and privacy policies:

  • Google Firebase — Firebase Analytics collects in-app event, screen-view, session and user-property data (e.g. college, branch, semester, city) to measure usage. Firebase Cloud Messaging (FCM) receives your device push token and message payloads to deliver notifications. Processed under Google's Firebase Privacy Policy.
  • Google AdMob — we serve real, personalized ads. AdMob collects and uses device identifiers — including the Android Advertising ID (AD_ID) on Android 13 and later — along with app usage data to serve and measure personalized advertising. Google may process this data under its Ad Privacy policy. You can reset or opt out of the Advertising ID in your device's Google Ads settings.
  • Cloudflare — our backend API runs on Cloudflare Workers; your notes and documents, profile avatars and institution logos are stored in Cloudflare R2 buckets. Chat photos, videos and voice notes are not stored in R2 — they go directly to Cloudinary (see the next bullet). Cloudflare receives request data (IP address, headers, payloads) to serve and protect the service under the Cloudflare Privacy Policy.
  • Cloudinary — chat photos, videos and voice notes are uploaded directly from your device to Cloudinary, which processes and delivers them under its Privacy Policy. NoteShuttle's own servers never receive these files — they only store a link so the chat can show them. Each file is deleted from Cloudinary once it has been delivered — see Section 6 for the exact rules. Note pages, avatars and institution logos are stored in Cloudflare R2 instead, not Cloudinary.
  • SMS delivery provider. To verify your phone number we send your number to our SMS gateway provider, which delivers the one-time code and returns only a delivery status. The provider processes the number solely to deliver that message on our instructions and cannot use it for its own purposes.

We do not sell your personal information. Sharing is strictly limited to these processors for analytics, advertising, diagnostics, storage, and delivery.

4. Smartboard Accounts (College Staff)

NoteShuttle's Smartboard mode is used by college staff on shared classroom tablets ("boards"). Smartboard accounts are created for a college by the institution's super administrator in the NoteShuttle admin dashboard. There is no self-sign-up, and board users cannot create additional accounts.

  • Data stays on the tablet by default. Notes, videos, whiteboard drawings and annotations, and board settings are stored locally on the device. They are not continuously uploaded, synced or mirrored to our servers.
  • Optional manual backups. A signed-in board user may choose Back up now in Settings. Only then is a backup archive uploaded over HTTPS/TLS to our private Cloudflare R2 bucket, in a storage area scoped to that college; Cloudflare encrypts stored objects at rest. Other boards in the same college can list, download and restore those backups. A backup contains note files, whiteboard data and annotations — it does not contain student personal data. Backups can be deleted from Settings at any time, and the college's administrator can delete a board together with its backups.
  • Metadata-only usage analytics. Under a board account we collect: session counts and durations, slide counts, tool and settings usage, note file types (for example PDF, PPTX or image — never file names or contents), download/upload durations and sizes, the local day and hour of activity, and the board, college and department identifiers. We use this information to improve the product and to support colleges. Board analytics are part of the service and do not have a separate in-app opt-out; the college can stop collection by deactivating the board, and deleting the board removes its analytics.
  • Not collected from Smartboard accounts: note text or file contents, annotation content, file names, student records, chats, contacts, precise or approximate location, or advertising identifiers. Smartboard sessions do not register for push notifications and are not included in student analytics.
  • Retention and deletion. Backups remain in the college's private storage until a board user or the college deletes them, or until the college administrator deletes the board account. Local board data can be deleted at any time from Settings. Deleting a board through the administrator also deletes its backups and its analytics events.

5. Data Security & Storage

All communication with NoteShuttle servers is encrypted using industry-standard Transport Layer Security (HTTPS/TLS). Sensitive assets are stored in secure cloud storage buckets with access controls and authentication safeguards.

6. Data Retention

  • Notes, documents, whiteboards & message text: retained for the life of your account until you delete them, or until your account is deleted — with one exception: notes you already shared with at least one other user keep working for those recipients after your deletion, shown as being from a "Deleted user" (Section 7). Whiteboard content follows the college-scoped rules in Section 4.
  • Chat media (photos, videos & voice notes): uploaded directly from your device to our media provider (Cloudinary) — NoteShuttle's own servers never receive the file, they only store a link to it. Each item is deleted from Cloudinary within a few hours after it has been downloaded on the recipient's device; in a group chat, once every member has opened it. Chat media that nobody opens is deleted automatically within 7 days, and deleting a message also deletes its media within an hour. Once deleted, chat media is gone from Cloudinary and is never moved into NoteShuttle's own storage. The NoteShuttle app keeps a copy of the chat media you have received on your device so it keeps working after the Cloudinary copy is deleted; because these copies live on your device and not on our servers, NoteShuttle cannot retrieve, view, or delete them again. Signing out or clearing the app's storage removes the chat media copies the app stored. This applies to chat media only: note pages, avatars and institution logos are stored in Cloudflare R2 and are not deleted on delivery.
  • Account data & private content: deletion requests start a 30-day grace period; after 30 days everything you never shared with another user is permanently purged from our servers — private notes, drafts and their page images/voice files in Cloudflare R2, 1-on-1 direct messages (their Cloudinary media is destroyed in the next cleanup pass, within an hour, and never beyond the 7-day window in the bullet above), group messages you sent, contacts, blocks, share-request dialogs, login sessions and credentials, your profile identity (name, phone number, profile data), push tokens and user-identifiable analytics events. Notes you did share with someone are the only exception: they survive for those recipients as "Deleted user" notes — see Section 7.
  • Analytics events (Firebase): retained per Google Analytics for Firebase default retention (up to 14 months) and controlled by Google's retention settings.
  • Push tokens (FCM): deleted when your account is purged or the token expires.
  • Backups: server backups are rolled and purged within 90 days of account deletion. Smartboard board backups follow the college-scoped rules in Section 4.

7. Account Deletion & 30-Day Grace Period

You have full control and ownership of your data. You may request account deletion in the app (Settings > Account Security > Delete Account) or right here on the web via our Account Deletion page.

  • Immediate logout & 30-day recovery: once requested you are logged out and hidden from others; logging back in within 30 days cancels the deletion and restores your account.
  • Irreversible purge after 30 days.
  • Private data purged: notes you never shared, personal drafts, their stored page images and voice files (Cloudflare R2), 1-on-1 messages, messages you sent in groups, contacts, blocks, credentials and profile info are permanently erased from our servers.
  • Shared academic content: notes that you shared with at least one other user — directly, into a study group, through a share link, or via your institution — remain visible to those recipients after your deletion, with the author shown as "Deleted user" and the note's images kept so they stay readable. Deleting your account never removes content from people you chose to share it with; messages sent by others remain in their chats and groups.

8. User-Generated Content & Safety

NoteShuttle maintains a zero-tolerance policy against abusive behavior, academic fraud, harassment, and inappropriate content. Users can report or block any offensive content or user directly in the app. Our moderation team reviews all reports within 24 hours.

9. Children & Student Privacy

NoteShuttle is designed for and is only available to users who are 13 years of age or older. Registration requires date-of-birth verification, and accounts of users under 13 are not permitted and are terminated upon discovery. Because the app serves Google AdMob advertising and Google Firebase Analytics, users aged 13 and above are subject to personalized ads and usage analytics as described in Section 3. We do not knowingly collect personal information from children under 13.

10. Your Rights & DPDP Grievance Officer (India)

Under the Digital Personal Data Protection Act, 2023 (India), you have the right to access, correct, and erase your personal data, to nominate another person to exercise your rights, and to withdraw consent at any time (which may limit service availability).

Grievance Officer: Rubeel — rubeel.bc@gmail.com — +91 80966 33158

We acknowledge complaints within 48 hours and resolve them within 15 days as required by the DPDP Act and Rules.

11. Website Attendance Tool

The free attendance checker at noteshuttle.com/#attendance works differently from the NoteShuttle Android app. It does not require an account, and it uses your SBTET PIN only to request your attendance report from the official SBTET Telangana portal.

  • Stored on your device: if you leave "Remember on this device" ticked, the PIN and the attendance result returned by the portal are saved in your browser's local storage (localStorage). They remain on that device and in that browser until you use Clear saved PIN on the checker or clear site data in your browser settings. They are not uploaded to our analytics systems.
  • Official portal lookup: when you check attendance, your browser sends the PIN to our server, and our server requests the report from the official SBTET portal. The PIN is used for that lookup only. We do not ask for your name, date of birth, password or any other SBTET credential.
  • Aggregate analytics: for each valid lookup, our server stores a salted, one-way hash of the PIN (never the raw PIN) together with derived details such as college code, branch code, scheme, semester, result status and whether the result came from live data or a cache. We use these records to count usage and understand which colleges and branches use the tool. They are not linked to your name or roll number, and aggregate statistics are visible only to NoteShuttle administrators.
  • Clearing your website data: open the checker and choose Clear saved PIN to remove the remembered PIN and result from your browser. You can also clear this site's data through your browser's privacy settings. Because the analytics record contains only a one-way hash and is not linked to an identity, we cannot look it up from your PIN; if you have a privacy question, contact us using the details below.

12. Contact Us

Email: rubeel.bc@gmail.com
Website: https://noteshuttle.com/legal