Privacy Policy

Last updated: 5 October 2026

In short: the free Divit app collects no personal data. If you subscribe to Divit Cloud, our server stores your notes end-to-end encrypted — we cannot read them — plus the minimum needed to run your account.

This policy covers the Divit apps for iPhone and Windows, the website divit.biltech.ee and the optional Divit Cloud subscription, provided by Biltech OÜ (“Biltech”, “we”).

1. The Divit app (free, no cloud)

• No account, sign-up, analytics, advertising, tracking or data-collecting third-party software.
• Your notes are stored only on your device, encrypted with AES-256-GCM. On iPhone the key is kept in the iOS Keychain as “this device only”; Biltech can never access it.
• If device backup is enabled, the encrypted notes file and a copy of the key protected by your recovery code may be included in your iCloud backup. It cannot be read without your recovery code.
• Your recovery code is never stored anywhere or sent to us.
• If you pair Divit with a sync server you operate (for example a NAS), notes go there end-to-end encrypted; Biltech receives nothing.

2. Divit Cloud (optional subscription)

Your notes and attachments are encrypted on your devices with AES-256-GCM before upload. The key never leaves your devices; our server stores only ciphertext and cannot decrypt it.

What our server keeps to run your account:

• a random account ID and a SHA-256 hash of your devices' access token (not the token itself);
• a reference to your purchase: the App Store original transaction ID, or a SHA-256 hash of your license key;
• your subscription end date and the storage you use;
• for each encrypted record: an ID, version, timestamp, size and whether it is deleted (needed to sync);
• if you create a cloud recovery code: a copy of your key encrypted with that code, and a lookup value derived from it. Neither reveals the code or the key.

No e-mail address, name or device identifier is stored by the sync service. It does not keep access logs of your requests; IP addresses are processed in memory only, to limit abuse (rate limiting).

Where: on a Biltech server hosted by İsim Kayıt (IK Cloud) in Kocaeli, Türkiye. Daily backups of the same encrypted data are kept in Cloudflare R2 storage (daily copies for 7 days, weekly for 4 weeks, monthly for 12 months). Because Türkiye is outside the EU/EEA, this is an international transfer; note content remains end-to-end encrypted throughout.

How long: while your subscription is active. When it ends (including after a free trial), sync continues for 7 days, then the data is read-only for 30 days and is then permanently deleted from the server. Copies in backups expire on the schedule above. You can ask us to delete your account earlier at any time.

3. Payments

• App Store: Apple processes the payment. We receive a signed transaction record (product, dates, transaction ID) — no name, e-mail or card details.
• Desktop (Polar): Polar (polar.sh) is the merchant of record and processes your name, e-mail, billing country and payment under its own privacy policy. As the seller we can see these order details and use them only for billing support and legally required accounting. Our sync server only checks with Polar whether a license key is valid.

4. Website and updates

divit.biltech.ee and the Windows update check run on Cloudflare. No personal data or note content is sent when the Windows app checks for updates; Cloudflare may keep standard technical logs such as IP addresses.

5. Device permissions

• Camera: only to scan the pairing QR code. No image is stored or sent.
• Face ID: handled by iOS; the app only learns success or failure.

6. Legal bases and your rights

We process Divit Cloud account data to provide the service you subscribed to (contract), security data to protect it (legitimate interest) and order data to meet accounting duties (legal obligation). You may request access to, correction, export or deletion of your data, and object to processing, by writing to info@biltech.ee. Your notes can be exported in the app at any time. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.

7. Children

Divit is not directed at children and does not knowingly collect their data.

8. Changes

If the way Divit handles data changes, this policy is updated and the date above is revised.

9. Data controller

Biltech OÜ, registry no 17465795, Narva mnt 5, 10117 Tallinn, Estonia. info@biltech.ee