Headr privacy

Headr stores your typed notes, photos, voice recordings, links, categories and interpretation on your device. The app has no Headr customer account, third-party advertising or cloud model fallback. Headr does not run its own behavioral analytics; Android SDK diagnostics and usage metrics are described below. OS note backup is off by default. If you enable “Allow automatic OS backup” in Headr Settings, saved notes, categories, photos, recordings, transcripts and downloaded papers become eligible for your device’s OS backup and restore. Apple or Google controls the backup account, timing, storage limits and retained copies; Android cloud backup is limited to 25 MB per app. Device backup must also be enabled. Turning this option off stops future app backups but does not request deletion of existing OS backups. Pending iOS share-extension captures remain excluded until imported. Uninstalling deletes local notes; recovery requires an available OS backup. Headr has no account-based backup or cross-device sync. Optional automatic cleanup of taken down notes is set to Never by default. Choosing a duration permanently removes expired taken down notes and their unshared media from app storage when Headr is open; older OS backup snapshots may retain copies.

Local capture and interpretation

Searching and filtering saved notes, including text matching and date/category browsing, happens on your device. Text entered in the note search field is not sent to Headr or external search providers.

Camera, microphone and speech permissions are requested when used. Speech transcription and note interpretation use supported on-device Apple or Android frameworks. Capturing and browsing notes do not require Apple Intelligence; automatic interpretation requires an available local model. Images and recordings are not uploaded to Headr's search service.

Editing notes and building lists

Text can be added or edited manually on a note. Original photos and recordings remain saved alongside the text. On-device AI can turn clear lists into checkable items within that note; new captures remain separate notes. Existing saved captures from earlier versions stay available, including their original media and transcripts. Headr does not upload captures for this processing. Manual edits, checked items and saved capture history remain on this device.

Captures shared into Headr

Using another app’s Share action sends the text, link or image you choose to Headr through the operating system. Headr imports it into local storage when opened. This does not share your notes with other people or sync them to a Headr server. Unseen-share indicators and viewing status are tracked locally. External shares are not automatically combined with existing lists.

On iOS, the app icon badge counts unseen shared notes. Headr requests badge permission when needed, without notification alerts or sounds. Badge counts and viewing status stay on-device; note content is not sent to a push service. Android shows in-app unseen-share indicators without app icon badges or shared-note notifications.

Android SDK diagnostics

Android uses Google ML Kit for on-device interpretation and speech recognition. Google documents collection of device and app information, user/device/installation identifiers, performance and error metrics, feature-use events, configuration, configured languages, and input/output sizes for diagnostics and usage analytics. The SDK may contact Google to download models and updates. Note text, images, audio inputs and model outputs are processed on-device and are not sent to Google by ML Kit. Headr has no separate switch to disable SDK metrics. See ML Kit data disclosures and ML Kit privacy information.

Optional online research

Online research is on by default and can be turned off in Settings. When enabled, short generated search queries derived from your notes go through the Headr service hosted on Vercel to Brave Search. Queries can include identifying words from a note and an optional city or postal code you enter in Settings. Headr does not request device location. Clear the search area or turn research off to stop using it. Search results and a research trace are saved with the note on your device.

On both platforms, research can read selected public pages and download relevant source images directly from their websites while online research is enabled. Those sites receive the requested URL, your IP address and connection information under their own policies. Saved findings and images remain available offline. Map links are offered only for specific places verified against a page read during research. The Brave API key stays on the server; there are no manually configured provider keys or tester access codes.

Automatic search access

Apple App Attest verifies the installation before searches. Apple processes app verification requests. Headr stores an installation-specific public key, verification environment, signed request counter and search allowance counters in Redis through Upstash. The public key record expires after 180 days without a verified search. One-use challenges expire after two minutes. Attestation certificates and receipts are verified and discarded.

On Android, Google Play Integrity verifies the app and device before searches. Google processes verification requests; Headr sends Google an opaque integrity token for verification, with a hash binding it to the search request. The full query is not included in that hash in readable form. Headr uses a random installation identifier for search allowances, stored locally and hashed for server quota keys. Clearing app data resets this identifier. One-use challenge records expire after two minutes. Raw integrity tokens and verdicts are not retained by Headr. This feature requires a supported Google Play installation; app and device verification is required when using the Headr search service.

For abuse prevention, the service derives daily IP rate-limit identifiers using a server-secret hash; it does not store raw IP addresses in Redis. Daily quota counters expire after two days and minute counters after two minutes. These installation identifiers support authentication and allowances, not advertising or cross-app tracking.

Application handlers do not log queries, results, credentials or attestation bodies. Vercel, Upstash, Apple, Google and Brave process network requests and connection metadata under their own policies. Brave states that Search API query records may be retained for up to 90 days for billing and troubleshooting, subject to legal obligations. This is not a promise of zero retention by those providers. See Vercel privacy, Upstash privacy, Apple privacy Google privacy and Brave Search API privacy.

Paper store and purchases

Opening My Papers or the Paper Store loads the store catalogue, including up to three promotional or other catalogue papers. Store requests share connection information with the store and its hosting provider; your notes are not sent to choose those papers.

Browsing and downloading papers contacts the Headr store hosted on Vercel. Optional purchases use Google Play or Apple's App Store; Headr does not receive your payment-card or bank details. To verify or restore a purchase, the app sends the product identifier and store-issued purchase proof to Headr over HTTPS. Headr verifies current purchase status with the relevant store and, on Google Play, acknowledges delivered purchases.

Headr stores a purchase record in Upstash Redis containing the platform, test/production environment, product and paper identifiers, and last verification time, keyed by a hash of the purchase token or transaction identifier. Raw purchase proofs are processed for verification and are not stored in this ledger or application logs. The ledger currently has no automatic deletion schedule. These records support paper access, restoration and fraud prevention. The app stores purchased-paper access locally and periodically verifies it; refunds and revocations can remove access. The app stores separately retain purchase records under their policies.

Store requests expose connection metadata to the hosting provider. Purchase verification also uses daily secret-hashed IP rate-limit identifiers; minute counters expire after two minutes and daily counters after two days. Headr does not store raw IP addresses in Redis.

Links and website favicons

Links show the website’s favicon when one is available, and only link text otherwise. There is no thumbnail setting. Headr may request the linked page to find its icon and download it from the website or an icon host, even when online research is off. These sites receive the requested URL, your IP address and connection information. Link notes do not show social-preview images or thumbnails. Favicons are cached separately from notes; deleting a note may leave its cached favicon until the cache is cleared or the app is removed. Opening a link uses another app and its privacy settings.

Sharing and TestFlight

Sharing a link or image into Headr saves it locally through the iOS share extension or Android share receiver. Apple TestFlight separately processes testing activity, crash reports and feedback. Feedback you submit may include screenshots, device information or information you choose to share. See TestFlight privacy information.

Your choices and contact

You can disable research, clear your selected search area, manage camera and microphone permissions in device Settings, and delete notes in Headr. Archived notes remain stored until permanently deleted. Deletion is not a secure-erasure guarantee. Headr is provided by Paul Quinn / Quinnware. Contact Paul Quinn with privacy questions or a request about data held by Headr. We may need information to locate and verify a relevant record; removing local notes does not delete store purchase records or provider logs. Contact Apple, Google or the relevant provider for data they control. Please do not email private notes or API credentials.