Penleaf privacy policy

Penleaf is a notes and checklist app, published by XDSS (package com.xdss.notes).
Effective date: 12 November 2026.

In short: your notes and checklists stay on your phone. Penleaf has no account, no sync and no server of its own, and it never sends what you write to us or to anyone else. The free version shows ads from Google AdMob, which collects device and usage data as described below. Penleaf also uses Google Analytics for Firebase for anonymous usage statistics, only with your consent where it is required, and you can turn it off in Settings. Premium (a one-time purchase through Google Play) removes all ads.

What Penleaf stores on your device

All of this is stored only in the app's private storage on your device. Notes in the trash are deleted for good 30 days after you move them there.

Backups: your notes are kept out of Google's cloud backup on purpose. On Android 12 and later they are copied only in a direct device-to-device transfer (for example a cable or Wi-Fi transfer to a new phone), together with the app lock. On Android 9 to 11 the notes are copied only in a device-to-device transfer and the app lock is not copied at all, so the notes arrive unlocked. On Android 8 nothing of your notes or the app lock is ever backed up or transferred. Your display preferences may be included in Android's normal backup. Premium status, the trial and your consent answer are never backed up (Premium is restored from Google Play).

The app lock is a lock on the app's screens, not encryption: it keeps people who pick up your phone out of Penleaf, but notes are not encrypted on the device. While it is on, reminder notifications and home-screen widgets show no note text, and screenshots of Penleaf are blocked. A forgotten PIN cannot be recovered; the only way back in is to clear the app's data, which deletes your notes.

When you share a note, Penleaf hands the text to the app you choose; what happens to it there is up to that app. When you share text into Penleaf, it is saved as a note on your device.

Third-party services

Penleaf uses no crash-reporting service and no location tracking of its own.

Usage statistics (Google Analytics for Firebase)

To learn how Penleaf is used (for example which screens are opened, that a note or checklist was created, that a reminder was set or removed, that a note was shared or text was shared into the app, which Premium features are used, how often the Premium screen, purchases and the rewarded trial are used, and ad revenue), Penleaf uses Google Analytics for Firebase. It collects app interactions with predefined, coarse values only, plus device information (model, OS version, language), an app instance identifier, approximate location derived from the IP address and, where allowed, the advertising ID. It never records what you write: no titles, note text, checklist items, search words, folder names or shared text, and not how many notes you have.

Usage statistics follow the same consent as ads: nothing is sent until your consent choice is known, and in regions that require consent they are collected only if you agree to storing and accessing information on your device. You can turn them off at any time in Settings > Privacy > Usage statistics. See Privacy and Security in Firebase.

Your choices

Permissions

Children

Penleaf is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their data.

Keeping and deleting data

Your notes stay on your device until you delete them. Deleting a note moves it to the trash, where it is deleted for good after 30 days or when you empty the trash. Clearing Penleaf's storage or uninstalling the app removes everything Penleaf stored. Data collected by Google's services is handled under Google's own retention policies linked above.

Changes

If this policy changes, the new version is published at this address with a new effective date, and significant changes are mentioned in the app's release notes.

Contact

Questions: sebiradutoiu@gmail.com