Privacy Notice
Your Scribble library is stored locally by default. RQAI does not use it to train AI, sell it, target advertising or monitor your writing. Content leaves the device only when you deliberately use a feature that requires another service.
1. Controller and scope
The operator trading as RQAI, currently an unincorporated project pending incorporation in the United Kingdom, is controller for personal information it actually receives through the Scribble website, support and any RQAI-operated endpoint. Registered-company particulars will be added after incorporation. Contact hello@rqai.co.uk with “Scribble privacy” in the subject.
The current app sends optional AI, sync and publishing requests directly from your device to the service you select; RQAI does not operate an AI prompt proxy. External services process information under their own notices and their legal role can differ by service and account. BYOK does not by itself determine every controller/processor question. If you use Scribble for an organisation or process other people’s information, you may have your own controller, notice, lawful-basis, DPIA and transfer duties.
2. Information and where it goes
| Information | Default location / recipient | Purpose |
|---|---|---|
| Notes, blocks, drawings, media metadata, chat drafts, calendars, settings | On-device IndexedDB/SQLite or app storage | Provide the editor and offline library. RQAI does not receive it by default. |
| Provider keys, GitHub token, OAuth tokens | Web device storage or native secure storage; then the named provider | Authenticate an optional request you initiate. RQAI does not receive the credential. |
| AI prompt, conversation, selected note content, voice profile, image or relevant audio | Your selected direct AI/transcription provider | Generate or transcribe the output you request. |
| OpenRouter request content and metadata | OpenRouter and the model provider to which it routes the request | Aggregate, route and perform inference. Account, model and endpoint settings affect handling. |
| DeepSeek request content and metadata | DeepSeek; its published notice states processing and storage in the PRC | Inference and the other purposes described by DeepSeek, including service improvement subject to its stated controls. |
| Sync/export content and file metadata | Your Google Drive app-data area, enabled OneDrive app folder or GitHub repository | Optional multi-device sync, backup or publication. |
| Browser speech audio | Your browser/operating-system speech facility; processing may be local or vendor-operated | Live speech recognition when you select Browser Web Speech. |
| Local Whisper audio | On device after first model download | Offline transcription; audio is not sent to RQAI. |
| Cloud Whisper audio | Your chosen Groq/OpenAI provider | Transcription. Scribble holds the recording in memory and does not save or sync it. |
| IP address, request time, URL, browser/security metadata | Hostinger infrastructure and security/access logs | Deliver and secure the website, diagnose abuse and maintain availability. |
| Email and message you send us | RQAI’s email/support systems | Answer support, legal, privacy and accessibility requests. |
| Legal acceptance version and time | Your device settings | Remember that this device completed clickwrap. It is not centrally collected by default. |
3. Lawful bases
Where RQAI processes personal information, the UK/EU GDPR basis is normally contract for requested services/support; legitimate interests for proportionate security, reliability, abuse prevention and legal claims; legal obligation where applicable; and consent only for an activity for which law genuinely requires consent. Agreeing to Terms is contractual acceptance. Acknowledging this notice does not activate AI, sync, publishing or marketing.
4. Personal, special-category and other people’s data
A free-form notebook can contain personal or special-category information even though Scribble does not ask for it. Keep health, biometric, political, religious, sexual-orientation, criminal, child, confidential and similarly sensitive information out of external AI requests unless you have authority, an Article 6 basis and any additional Article 9/10 condition required. Minimise or remove identifiers. Do not record people covertly or upload their information without authority.
5. Recipients and international transfers
RQAI uses hosting and communications suppliers for its public site and support. Optional providers are selected and connected by you. Processing can occur outside the UK/EEA. The current Provider & Data Routing Notice identifies key routes and links to provider documents. DeepSeek states that it directly collects, processes and stores personal data in the PRC. OpenRouter states that it may transfer a request to the selected or automatically routed model provider and that provider practices vary.
Do not send personal or confidential content until you have assessed the recipient, retention/training controls and any transfer mechanism you require. RQAI is documenting its own role and transfer responsibilities; organisations using Scribble must conduct their own assessment for their processing. RQAI does not sell personal information or share it for behavioural advertising.
6. Retention
- Local library/settings: until you delete them, clear app/site data or uninstall. Remote copies follow the destination’s rules.
- In-memory cloud dictation audio: released after transcription or session closure; the provider may retain its received copy under its terms.
- Website operational logs: retained under the hosting/security configuration; RQAI is confirming and documenting the exact period. Incident extracts may be kept where necessary to investigate or defend a claim.
- Support correspondence: normally up to 24 months after closure, longer where law or an unresolved dispute requires.
- Provider requests: provider-specific. Disconnecting Scribble does not necessarily erase provider logs, prompts, outputs, backups or account records.
- Legal/compliance records held by RQAI: for the applicable statutory or limitation period.
7. Security
Scribble uses local-first storage, a restrictive content security policy, sanitisation, sandboxed interactive previews, HTTPS, scoped requests and native secure storage where available. Web credentials may reside in browser storage and can be exposed by a compromised device, browser profile or extension. Use device controls, avoid shared computers, prefer scoped/short-lived credentials and revoke them if a device is lost. No system is perfectly secure.
8. Your rights
Subject to conditions and exemptions, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and rights concerning significant solely automated decisions. Scribble does not use your library for such decisions. Most library data is only on your device, so RQAI cannot retrieve it; use export/delete controls. Provider-held copies must normally be addressed through that provider. For information RQAI holds, email hello@rqai.co.uk. We may verify identity proportionately and normally respond within the legal time limit.
You may object to processing based on legitimate interests and have an absolute right to object to direct marketing. Scribble currently performs no behavioural or in-app email marketing. You may complain to the UK Information Commissioner’s Office at ico.org.uk or, where EU GDPR applies, your local supervisory authority.
9. Children and provider eligibility
Scribble does not collect age merely to provide local note-taking. It is not designed specifically for children, and its privacy-preserving defaults apply to everyone. External AI, cloud, GitHub and app-store services have separate minimum-age and guardian rules; do not connect a service unless those rules are met. A parent, guardian, school or organisation should assess whether sending a child’s content to an external provider is lawful and in the child’s best interests.
10. Changes
We publish updates here. Material changes receive a new version and, where appropriate, renewed in-app acknowledgement. Previous versions are retained in release history. Version 2026-08-09 adds specific DeepSeek/OpenRouter routing information, removes the blanket Scribble age declaration and corrects the interim operator description.