Privacy

Last updated 5 October 2026

Your notes are yours. Prodigus works on a folder of ordinary files on your iPad, and those files leave the device only when you turn on sync. This page covers the Prodigus iPad app, the Prodigus sync service and this website. “We” on this page means the Prodigus.app team, who run all three.

Your notes and documents

A vault is a folder of files: Markdown notes, ink, and the documents you read. It lives on your iPad, or in a folder you chose, and you can use Prodigus without an account. We never see these files unless you turn on sync for a vault. If you keep a vault in iCloud Drive or another provider’s folder, that provider stores it under its own terms.

Your account and sync

Sync is optional. To use it you create an account with an email address and a password.

• We keep your email address and a one-way scrambled form of your password that can check it but cannot reveal it. We never store the password itself.
• We don’t send a confirmation email, so we never email you about your account.
• We keep a record of your signed-in devices so they stay signed in. Signing out ends that device’s session.
• Only the vaults you choose to sync are uploaded. Their contents are stored encrypted on the Prodigus sync service, which runs on a server we operate ourselves and is reached through Cloudflare’s network.
• With normal sync, the service holds your vault keys and can decrypt your synced vault. It is not end-to-end encryption. Older end-to-end vaults keep their original key rules.
• When you share a vault, we keep the email address you invited, so the invitation reaches the right person.

Crash reports and diagnostics

When the iPad app crashes, hits an error or freezes for a moment, it sends a report to a diagnostics server we host ourselves. A report can include:

• the app and iPadOS versions, your language and region setting, and whether Low Power Mode or heat was slowing the device;
• the error message and where in the app it happened, or how long a freeze lasted and what the app was doing;
• the app’s last 25 log lines.

Reports never contain the text of your notes or documents. We remove the app’s storage paths before a report is sent, but the name of a file that failed to open or save can appear. Reports are not linked to your account or email address. The app has no analytics and no advertising.

Feedback you send

About ▸ Send feedback opens an email to us with the app version, build and iPadOS version filled in, and a file of the app’s recent activity (the same log lines, with storage paths removed). You see all of it before you send. We receive only what you send.

Video transcripts and links

Transcripts are optional and use your own Gemini API key, which stays in your iPad’s keychain. When you ask for one, the app sends the public YouTube link and your key to Google’s Gemini service, which handles it under Google’s terms. When you paste a web link or add a video, the app fetches that page or the video’s title directly from its own site.

This website

This site is hosted on Cloudflare. We use PostHog (United States) to understand how the site is used. It records the pages you view, what you click, and errors in the page, and uses your IP address to estimate your rough location. PostHog sets a cookie and stores an identifier in your browser so it can recognise a returning visit. Its requests go through this site’s own address. Clearing this site’s data in your browser resets that identifier.

If you ask for beta access, we store your email address with Resend, which sends our welcome email. We store nothing else about you there, and we never send your email address to PostHog. The welcome email has an unsubscribe link that takes you off the list.

Deleting your data

You can delete your account in the app, from your account settings, with Delete Account. It asks for your current password, and deletion happens straight away:

• your account and your signed-in sessions are removed;
• every synced vault that only you hold is deleted from the sync service, with its contents;
• a vault shared with others stays for them, and you are removed from it;
• the files on your iPad stay where they are, and you can keep using them without an account.

Backups we take before maintaining the sync service can hold a copy until they are deleted. To have anything else removed, such as your beta list entry or a feedback email, write to us. Diagnostics reports are not linked to you, so tell us roughly when and on which device the app was having trouble and we will look for them.

Children

Prodigus is not meant for children under 13, and beta testers must be 13 or older.

Changes and contact

If this page changes, the date at the top changes with it. Questions, requests or worries: support@prodigus.app.