Privacy · Last updated 13 September 2026
Most privacy policies are written to protect the company. This one is mainly a description of an architecture, because the honest answer to "what do you do with my notes?" is that we have no way to do anything with them.
Nothing about the people you support ever leaves your device. Daily notes, names, medications, goals, incidents, appointments, photographs of documents — all of it is written and stored on the phone, tablet or computer you are using, encrypted with a key derived from your PIN. There is no server that holds it, no backup of it on our side, and no administrator anywhere who can read it.
This is not a promise about our conduct. It is a fact about how the app is built, and it is the reason we can make the promise at all: we could not hand your notes to anyone, sell them, or lose them in a breach, because we do not have them.
To sell you a subscription and to keep your licence working, we hold a small amount of information about you — the customer — on our servers:
What is deliberately absent from that list: any individual's name, any note text, any medication, any goal, any incident, any date of any event in anyone's care. Those fields exist only on your device. Our own licence console — the tool we use to support customers — has never been able to display them, because they are never sent.
We use as few third parties as the job allows, and none of them touch care records:
We do not use analytics, advertising, tracking pixels, session recording, or third-party cookies. There is no cookie banner on this site because there is nothing to consent to.
Because there is no cloud, your device is the only copy of your records unless you make another one. This is the real cost of the privacy above, and we would rather state it plainly than bury it.
The app includes a one-tap encrypted backup. The file is protected by a passphrase you choose at the moment you download it — not your PIN, because a file that leaves the device needs more than four digits. Put that file in iCloud, Google Drive or on a computer, and restoring onto a new phone takes about thirty seconds.
If you lose the passphrase, the backup cannot be opened — not by you, and not by us. There is no recovery process, because a recovery process would mean we held a key, and we do not. Write it down somewhere real.
Every note you sign is sealed with a SHA-256 hash of its own text, date, signer and timestamp, and every action in the app is written to an activity ledger in which each entry carries the hash of the entry before it. If a note or a ledger entry is altered or removed afterwards, the app reports it — on screen and in the export.
This works in your favour rather than ours. It means you can hand a reviewer an export with its head hash and they can verify the chain independently, without trusting our software and without trusting us.
Cancelling stops new notes from being written when your paid period ends. It does not touch anything you have already written: your notes stay on your device, readable, exportable and backed up, for as long as you keep them. We do not delete a caregiver's records, and we have no mechanism to.
You can ask us at any time to tell you everything on our servers associated with your email, to correct it, or to delete it. Deletion removes your licence, your device records and your email from our systems; it cannot remove your notes, which we never had. Write to admin@kuranotes.org and a person — the person who built the app — will answer, normally within a day.
Kura Notes is a professional documentation tool for caregivers, not a service for the people being supported. Accounts are held by the caregiver or provider. The people written about in the notes are never our users and never our data subjects, because their information never reaches us.
If this policy changes, the date at the top changes with it and anyone with an active subscription is emailed. One thing will not change: no future version of Kura Notes will start uploading care records. Doing so would require rebuilding the app around a server that does not exist, and it is the one commitment this whole product is organised around.