How Jottoo protects your data: encrypted on your device before sync

Notes, tasks, and meeting records are stored first on your device (local database in the browser or native app). When you are online and signed in, they sync to your Jottoo account in the cloud so you can use the same workspace across devices.

Jottoo is offline-friendly. You can open existing notes, edit them, create tasks, and capture content while offline. Changes queue locally and sync when connectivity returns. Recording and upload behaviour may be limited until you are back online, depending on the device and network.

Signed-in changes to notes, tasks, folders, and related metadata sync to your cloud workspace. Sync is account-scoped: your records belong to your user account, not a shared public feed.

Note content is encrypted on your device (AES-GCM) before it syncs to cloud storage, using a key protected by your account password and a recovery key you create at signup. Your unwrapped note encryption key is never stored on our servers.

When you use transcription or AI features, the content needed for that request is sent to the provider named below so a result can be returned, then stored back in your note encrypted. Server-side transcription means a note can briefly exist as plaintext on our servers until your device re-encrypts it. Metadata used for sync and routing may remain unencrypted.

Keep your own copy of your recovery key: you need it to unlock your notes on a new device after a password reset. As a last resort, Jottoo also stores a protected recovery copy of your recovery key in a private collection that the app, other users and public APIs cannot read. If you lose every copy, it can only be emailed to your registered account address.

When you record or upload audio for transcription, the audio is sent to AssemblyAI so speech can be turned into text. Jottoo is opted out of AssemblyAI's model improvement programme, so your audio and transcripts are not used to train its models. The resulting transcript is written back into your note workflow. Transcription cannot run entirely on-device for this product today.

Features such as summaries, organisation suggestions, and action extraction send selected content to OpenAI through Jottoo's servers. Only the content needed for that request is processed so a result can be returned to your workspace. Under OpenAI's API terms, this content is not used to train its models; OpenAI may keep it for up to 30 days for abuse monitoring before deleting it.

Third-party providers are used only where they are technically required to deliver a feature — for example transcription and AI processing, plus infrastructure such as authentication, cloud storage, and payments. Jottoo does not use your notes as an advertising surface and does not sell customer note content to advertisers or data brokers.

The full list of providers and their retention terms is in our privacy policy.

Jottoo does not show ads in your workspace and does not sell or broker your note content for advertising. The product is funded by the subscription.

You can delete your account from the signed-in app settings. Account deletion removes your Jottoo account data according to the process described in the privacy policy. Local copies on a device may remain until you clear browser/app storage or uninstall the app.

The sections above describe data handling in the Jottoo workspace app. This section is only about jottoo.com — the public marketing site where you are reading this page — not your signed-in workspace at workspace.jottoo.com.

We do not use cookies to read your notes or workspace content. The marketing site is separate from the app: visiting jottoo.com does not give us access to your meeting records.

Essential use. The marketing site needs basic technical storage to work — for example, keeping your cookie preference so the consent banner does not reappear on every visit. That preference is saved in your browser's localStorage, not in your Jottoo account.

Analytics and campaign measurement (optional). If you choose Accept All on the cookie banner, we load Google Analytics 4 (GA4) to understand aggregate traffic — such as which pages are visited and how people move through the site. We also load the Reddit Pixel on jottoo.com to attribute visits, free-trial link clicks to Reddit advertising. The Reddit Pixel is not installed on workspace.jottoo.com, and this marketing site does not report completed account registrations or subscriptions to Reddit. Optional tracking cookies are not set unless you explicitly accept. If you choose Reject All or Essential Only, the Reddit Pixel stays off and GA4 runs in a limited cookieless mode that does not store advertising or analytics cookies in your browser.

We use Google's Consent Mode so default consent is denied until you make a choice. We do not send your notes, meeting content, email address or workspace activity to Reddit from this site. We do not use marketing-site analytics to show ads in your workspace, sell note content, or build advertising profiles from your notes.

Changing your choice. Clear site data for jottoo.com in your browser settings to reset the banner and choose again. Data already collected while consent was granted is handled according to the providers' retention settings and our privacy policy.

For more on how the providers process measurement data, see Google's privacy policy and Reddit's privacy policy.