- In effect
- Version
- 1.0
- Applies to
- Pen Friend on iPad and Mac
The short version
Pen Friend is a handwriting notebook for iPad, with a small companion app for Mac. There is no account, no analytics, no advertising and no tracking. Your worklogs live on your iPad.
One group of features, the pen friend, the briefings and search by meaning, is written by Google's Gemini model. Those features are off until you agree to them, and Pen Friend is a complete notebook without them.
Who is responsible for your data
Pen Friend is made by Bishwas Bhandari, an individual developer, who is the data controller for the small amount of processing described here.
What stays on your iPad
Everything you write is stored on your iPad: your ink, the images on your pages, your folders, and the titles, labels and summaries Pen Friend writes about them. I keep no copy of any of it, and with the Gemini features off, none of it leaves your iPad except to your own iCloud and your own Mac, as described below.
What is sent to Google, and only if you agree
Pen Friend asks before any of this happens, and you can turn it off again in Settings. When it is on:
- A picture of the page you are on, your ink and the images on it, is sent when you use the pen friend, and shortly after you stop writing so the briefing stays current. This includes pages in locked folders.
- With that picture goes the text Pen Friend has already written about your worklogs: titles, labels, keywords, short summaries and their history, your folder names, and labels you corrected. The same text is sent on its own, together with the words of your search, when you search by meaning, and when you ask for worklogs to be filed.
- Each request carries a random number that names your install of Pen Friend. It is used only to limit how fast requests can be made. It is not tied to your name, your Apple ID or your device's identifiers.
- Each request is also signed by your iPad's secure chip, using Apple's App Attest, so the relay can tell it comes from a genuine copy of Pen Friend and not from someone imitating it. The first time, your iPad asks Apple to certify the key it made for this. Apple learns that this app asked for a certificate, and nothing about what you write. The key is made for this app alone and is not tied to your name or your Apple ID.
The legal basis for it
Your consent, which you give the first time and can withdraw at any time in Settings by turning off Pen friend and briefings. Withdrawing it stops anything further being sent, and the rest of the notebook keeps working.
Who processes it, and where
| Who | What they do | What they receive | How long |
|---|
| Cloudflare Workers | Runs the relay that holds the API key and passes requests on | The request in transit, plus operational log lines | Short-lived logs, never the content |
| Google, Gemini API | Writes the answers, briefings and search results | The page picture and the text described above | Under the Gemini API terms |
| Apple, iCloud | Stores your backup in your own private database | Your worklogs, under your Apple ID | Until you delete it |
| Apple, App Attest | Certifies that the app is genuine | That this app requested a certificate | Under Apple's terms |
Both Cloudflare and Google process requests on infrastructure outside Nepal, including in the United States. The relay does not store your pages or your text, and I do not receive, and cannot see, what you send or what comes back.
iCloud backup
If you are signed in to iCloud, Pen Friend backs your worklogs up to your own private iCloud database so a new iPad can restore them. That data is held by Apple under your Apple ID. I have no access to it. You can delete it at any time in the iPad's Settings, under your name, iCloud, Manage Account Storage.
The Mac companion
Pen Friend for Mac and Pen Friend for iPad talk to each other directly over your local network. Screenshots go from the Mac to the iPad, and your worklogs are mirrored to your own Mac so you can see and export them there. Worklogs in locked folders are never sent to the Mac. Nothing in this link passes through the internet or through me.
Permissions Pen Friend asks for
Two of these belong to Desktop mode, which is off until you turn it on in Settings. With it off, Pen Friend asks for neither and uses neither.
- Photos, in Desktop mode only, so a screenshot you take on the iPad can land in Pen Friend. Pen Friend reads new screenshots only, and they stay on your iPad unless they are on a page you ask the model to read.
- Local network, in Desktop mode only, to find your Mac.
- Face ID or Touch ID, to open locked folders. The check is done by iPadOS. Pen Friend never sees your face or fingerprint data, only a yes or a no.
Your rights
Because I hold no copy of your data, most rights are satisfied on your own device, immediately and without asking me:
- To see your data: it is on your iPad, in the app.
- To correct it: edit the page.
- To erase it: delete the worklog, or delete the app, and delete the iCloud backup from the iPad's Settings.
- To take it elsewhere: export your worklogs from the Mac companion.
- To withdraw consent: turn off Pen friend and briefings in Settings.
If you are in the EEA or the UK and want to raise something formally, write to me, and you may also complain to your local data protection authority. If you are in California, Pen Friend does not sell or share personal information, and there is nothing to opt out of.
Deleting your data
Deleting Pen Friend from your iPad deletes everything it stored there. The iCloud backup is deleted from the iPad’s iCloud settings as described above. I hold no copy of your data, so there is nothing for me to delete.
Children
Pen Friend is not directed at children under 13 and does not knowingly collect information from them.
Changes
If what Pen Friend sends ever changes, this page changes first, and the app asks for your agreement again before anything new leaves your iPad. Each version carries a number and the date it took effect.
Contact
Pen Friend is made by Bishwas Bhandari. Questions about this policy or your data: [email protected].
