SideNote ProHow SideNote Pro handles your data
SideNote Pro keeps settings, history and folder indexes on your PC. Your chosen AI provider receives the requests you send, while the separate BediniLabs licensing service handles trial and entitlement data.
Three parties, not one
SideNote Pro stores local records on your PC, sends AI requests to the provider you configured, and contacts BediniLabs for licensing and, from version 1.15.1, for a daily update check. Each receives different data.
SideNote Pro, on your PC
The Windows client. Holds your settings, conversation archive, Active Notes, folder indexes, usage ledger and protected credentials. It never uploads any of them.
Your AI provider
The endpoint you configured. Receives the prompts, context, attachments and excerpts you send, and applies its own privacy, retention and billing policies.
BediniLabs licensing
Handles trial authorization, activation, entitlement refresh and device deactivation. It does not receive AI prompts or conversation content.
SideNote Pro sends content only in AI requests to the provider you chose, never to us. A request can start when you press Send, run an inline command or choose a selected-text action set to send immediately. If you switch on Automatic Takeaways, a separate check can follow a completed response.
What stays on your machine
Everything SideNote Pro persists lives under %LOCALAPPDATA%\SideNote Pro\. There is no cloud copy of any of it.
| File | Contents | Protection |
|---|---|---|
settings.json | Non-secret application and provider settings | Plain local JSON |
provider-credentials\*.dat | Per-profile API credentials | Windows DPAPI, current user |
conversations.json | Threads, messages, attachments, drafts, summaries, Takeaways and their notes | Plain JSON by default, optionally DPAPI |
usage.json | Daily token and cost aggregates by provider and model | Plain local JSON, no conversation content |
folder-indexes\*.dat | Extracted local-folder chunks and retrieval provenance | Windows DPAPI, current user |
active-notes.json | Your Active Notes: titles, words, where a captured note came from, and where floating notes sit | Plain JSON by default, DPAPI while history protection is on |
trial-progress.json | Which welcome cards are ticked, and three activity totals | Plain local JSON, no content or names |
update-check.json | LastCheckedAt, LatestVersion and DismissedVersion; no user, device or licence identifier | Plain local JSON |
license.dat | Trial dates and cached signed entitlements | Windows DPAPI, current user |
device-identity.dat | The device key used for licensing operations | Windows DPAPI, current user |
API keys are never written into settings.json. Each profile has a stable ID pointing at its own protected credential file. Enabling conversation protection applies DPAPI to the whole archive, including extracted document contents, binding it to your current Windows account, and covers your Active Notes too. That is local protection, not a portable password-based format: it protects the file at rest on this machine and under this account. Exports are different: a settings file and Export all conversations are plain text, written only where you save them, and unprotected even when history protection is on.
What is sent, and exactly when
SideNote Pro sends content to your AI provider when you press Send, run an inline command or choose a selected-text action set to send immediately. If Automatic Takeaways is on, it can make a separate check after a response finishes. Depending on what you attached or captured, a request can contain:
- your prompt, and the system prompt the conversation uses;
- recent conversation context, and the compaction summary when one exists;
- text you captured with a selected-text action;
- Active Notes you attached to the message, as the copy kept with it;
- the text you typed after an inline command's trigger, with the command's instruction and your writing context, sent when you press Tab;
- text extracted locally from attached documents, delimited as untrusted reference material;
- images, as base64 data URLs in the OpenAI-compatible multimodal shape, including PDF pages you chose to send as images;
- the folder excerpts local retrieval selected, delimited the same way.
SideNote Pro makes two further provider calls. The first is compaction: when a thread outgrows its context window, SideNote Pro asks your configured model to summarize the older messages. It is still your provider, still your key, and it still costs tokens. See managing conversations.
The second is Automatic Takeaways, which is off by default. Switched on, it sends one separate request after each response finishes, to the provider that wrote the response or the profile you chose for Takeaways, carrying that exchange and a few earlier messages as text, with your takeaway instructions and the cards already kept. It never includes images, documents, captured text, folder excerpts or your notes on Takeaways, and saving a Takeaway yourself sends nothing.
What SideNote Pro does not do
- No telemetry or product analytics
- No usage pings, no crash beacons, no feature counters.
- No account
- Nothing to sign up for, no profile, no email required to run the application.
- No advertising
- No cloud conversation storage or sync
- There is no server-side copy of your threads and no cross-device history.
- No passive monitoring
- No background screen capture, no microphone listening, no camera access, no clipboard polling.
- No automatic file discovery
- Folders are added by you. There is no drive crawling, no recent-files inspection and no background filesystem watcher.
- No provider billing access
- Local cost figures are estimates computed on your machine; SideNote Pro never queries your provider's billing system.
Screenshots, clipboard images and selected text are all read only after an explicit action from you: starting a capture from the composer or with the capture shortcut, pressing Ctrl+V, or pressing the Selection actions shortcut or an action's shortcut. There is no ambient awareness of your screen.
So that an answer can go back to the app it came from, a selected-text action also reads the selection, and up to 64 characters around it, through Windows UI Automation. That stays in memory, is compared there, and is never saved, logged or sent. A return borrows the clipboard only after you click Replace selection or Insert after, keeps its writes out of Windows clipboard history and cloud clipboard, and puts your clipboard back. While a return runs, SideNote Pro counts key and mouse-button presses, never which keys, so it can stop if you start typing or clicking before it pastes.
Inline commands are the one feature that watches typing, and only while you have switched them on. SideNote Pro looks for the start of one of your triggers and keeps nothing else of what you type; after a trigger, it holds that command's text in memory until it runs or is cancelled, and never stores or logs it. Inline commands covers the detail.
What BediniLabs receives
The licensing service exists to answer one question: is this installation entitled to run. It handles trial authorization, activation, entitlement refresh and device deactivation, and it stores licensing and device metadata to do that.
It does not receive prompts, responses, attachments, screenshots, filenames, folder contents, usage figures or your provider API key. Your AI requests do not pass through it, and it is not a proxy for your provider. Activation keys are sent to the licensing service when you activate and are not persisted locally afterwards.
From version 1.15.1, SideNote Pro also checks about once a day whether a newer version is out, by downloading one public file, https://sidenotepro.com/updates/latest.json. The request carries no licence key, identifier, settings or content, and every copy sends the same one, so it is not a usage ping. Like any visit to the website, it arrives with an IP address and a time, which the web server's access log keeps for about two weeks. Updates themselves come from the Microsoft Store. The privacy policy has the detail.
Going further with a local provider
If your requirement is that content never leaves the machine at all, configure a local provider. With Ollama or LM Studio running on your own hardware, the request goes to localhost and inference happens on your PC.
SideNote Pro does not supply the local model and cannot make guarantees about third-party software. What it controls is where it sends the request. Whether that destination keeps data local depends on how you configured it.