Updated

Privacy Policy

Zyler keeps your notes on your devices. This page says what reaches our servers when you sign in, sync, or use AI, and what never does.

Zyler is operated by Ocean AI, LLC ("we", "us"). This policy covers the Zyler apps for macOS, Windows, Linux, iPhone and iPad, the Zyler account at account.zyler.app, and the Zyler services at api.zyler.app.

The short version

  • Your notes live in a vault on your device. Without an account, Zyler sends nothing about them to us.
  • An account is optional. It is needed only for Sync and for the built-in AI.
  • Sync is end-to-end encrypted. Your notes and attachments are encrypted on your device before they are uploaded, and the keys stay on your devices. We cannot read them.
  • We do not sell your information, show ads, or track you across other apps and websites. The apps contain no third-party analytics.

Without an account

Your vaults, pages, attachments, version history and settings are stored on your device. The iPhone and iPad app keeps them inside the app; the desktop app keeps them in a folder you choose. We have no copy of them. If you allow access to the camera, microphone or photo library, what you capture or pick is added to your page on your device and goes nowhere else.

Your Zyler account

You can sign in with Google, Sign in with Apple, or a code sent to your email. When you do, we store:

  • your email address, your name if the sign-in provider gives one, and an account ID;
  • which sign-in methods you use;
  • the IP address and country you signed up from, to prevent abuse;
  • your sessions, each with a device name taken from the app or browser that signed in.

Sign-in emails are sent through Resend. If you use Sign in with Apple and choose to hide your email, we only see the relay address Apple gives us.

Sync

Sync uploads your vault so your other devices can download it. Before anything leaves your device, Zyler encrypts each page, attachment and vault setting with a key that only your devices hold. A new device gets the key by pairing with one of your devices or from your recovery key. We never receive the keys, so we cannot decrypt your notes, attachments or vault names, and neither can anyone who obtains our servers' data.

To deliver and store the encrypted data, our servers see:

  • your account, the IDs of your vaults and of each encrypted record, and each record's type;
  • the size of each encrypted record, its version number, the device that uploaded it and when;
  • identifiers derived from your keys, which do not reveal the keys.

Encrypted records are padded so their size says less about their contents. The servers keep earlier versions of each encrypted record so that version history and recovery can work across devices; older versions are thinned over time. When you delete an attachment, its encrypted data is removed after 14 days. Encrypted data is stored with Amazon Web Services in the United States.

Sync runs only while the app is open. Your sync subscription is managed in your Zyler account on the web; payments are processed by Stripe, and we never see your card number.

AI (desktop app)

The desktop app's AI features send what you ask, together with the pages you choose to include, to a language model so it can answer. The iPhone and iPad app has no AI features.

  • Chat requests are routed through Vercel AI Gateway only to model providers that have committed to zero data retention and to not training on your data.
  • Web search sends your search query to Tavily or Brave Search.
  • Voice transcription sends the audio you record to Groq.

For each AI request we keep a usage record: the time, the model and provider used, the number of tokens or seconds, the cost, the app version and the device name. We do not keep the content of your prompts or of the answers. Detailed records are kept for the current month and then reduced to monthly totals.

Deleting your data

  • On your device: deleting a vault in Zyler, or deleting the app, removes your notes from that device.
  • Your account: you can delete your account at any time at account.zyler.app/account, which the iPhone and iPad app opens from Settings ▸ General ▸ Delete account. Deletion takes effect immediately: we delete your account, sessions, usage records and all of your synced encrypted data, cancel any subscription, and revoke Zyler's access to your Apple ID if you used Sign in with Apple. Stripe keeps its own records of past payments.

Who else processes your data

We share data only with the service providers that run Zyler for us, for the purposes above: Amazon Web Services (hosting and storage), Resend (sign-in email), Stripe (payments), Google and Apple (if you sign in with them), and, for the desktop AI features, Vercel AI Gateway with its model providers, Tavily, Brave Search and Groq. We may also disclose information when the law requires it.

Cookies

account.zyler.app uses a cookie to keep you signed in. zyler.app remembers your light or dark theme in your browser. Neither site uses advertising or analytics cookies.

Children

Zyler is not directed to children under 13, and we do not knowingly collect personal information from them.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how we use it. Your notes are already yours and on your device; for anything in your account, delete it as above or contact us.

Changes

If this policy changes, we will update the date at the top of this page.

Contact

Ocean AI, LLC — privacy@oceanai.so