Privacy Policy

Last updated: October 14, 2026

This Privacy Policy explains what personal data is collected when you use the ioJot mobile/desktop app ("ioJot", "the App"), how it is used, and what rights you have.

1. Data Controller

2. Data We Collect

Account information. When you create an ioJot account we collect your email address and password. Your password is never stored in plain text; the server only keeps a one-way, salted hash (PBKDF2) — nobody, including ioCore, can see your actual password.

Device information. For session management we store the name you gave each device, its platform (Android/iOS/Windows), and when it was last used. This list is visible under Settings > Account, where you can sign any device out at any time.

Notes, voice memos and lists. By default these live entirely on your device (local-first); unless you explicitly turn on cloud backup, none of this content is ever sent to our server.

Encrypted cloud backup (optional). If you enable backup, your notes, voice memos and lists are encrypted end-to-end on your device with AES-256-GCM before upload. The encryption key is derived on your device from a passphrase only you know and is never sent to the server — ioCore cannot read the contents of your backup and cannot recover it if you forget your passphrase.

Voice memo transcription. Transcription runs entirely on your device using an on-device model (Whisper). Your audio recording or its transcript is never sent to the ioJot server or any third party.

What we don't collect. We do not use advertising identifiers, analytics/tracking SDKs, location data, your contacts, or camera/gallery access beyond an image or file you explicitly attach.

3. How We Use This Data

• To create, verify and manage your account and session
• To provide the encrypted cloud backup service, if you enable it
• To track the status of future in-app purchases (IAP)
• To respond to your support requests

4. Sharing With Third Parties

Your data is not shared with third parties by default and is never sold for advertising or marketing purposes. Once in-app purchases are available, payment information will be processed directly by the Apple App Store / Google Play — ioJot never sees or stores your card or payment details. Where legally required (a court order or a request from a competent authority), data may be shared with authorities to the extent strictly necessary.

5. Retention and Account Deletion

Your account data is permanently and irreversibly deleted the moment you delete your account — this covers your email/ password record, every device session, and your encrypted cloud backup, if any, all at once. You can delete your account in two ways:

• From inside the app: Settings > Account > Delete account (confirmed with your password, happens instantly)
• From a device without the app installed: the web form on the Delete Account page

Deleting your account does not affect the local notes/ voice memos on your device — those already live only on your device. If you also want to erase local data, use Settings > "Delete everything" inside the app.

6. Your Rights Under Turkish Law (KVKK Art. 11)

Because our data controller is a Turkish legal entity, you have rights under Turkey's Personal Data Protection Law (KVKK), Article 11, including the right to learn whether your data is processed, request information about it, learn its purpose and whether it's used accordingly, know any third parties it's transferred to, request correction of inaccurate data, request erasure, and have any of these changes notified to third parties the data was shared with. You can send these requests to destek@iocoreyazilim.com.tr. In practice these map closely to the rights you would have under GDPR or similar data protection laws, regardless of where you're located.

7. Children's Data

ioJot is not directed at and does not knowingly collect data from children under 13.

8. Data Security

All communication between the app and the server is encrypted with TLS. Passwords are hashed with PBKDF2; your cloud backup is encrypted on your device with AES-256-GCM. Access is limited to authenticated (JWT) API endpoints.

9. Changes

This policy may be updated; significant changes will be published on this page along with an updated "last updated" date.

10. Contact

For questions, contact: destek@iocoreyazilim.com.tr