SideNote Pro

Privacy Policy for SideNote Pro

Effective date: 13 October 2026

SideNote Pro keeps your settings, conversations, folder indexes and usage figures on your own Windows device. This policy sets out exactly what that means, what the AI provider you choose receives when you send it a request, and what BediniLabs receives for licensing and the update check.

1. Overview

SideNote Pro is a Windows desktop application developed by BediniLabs. It is a client for AI services that you choose and configure yourself. BediniLabs does not operate an AI backend for SideNote Pro, and there is no SideNote Pro account, cloud profile or hosted conversation service.

Three parties can be involved when you use SideNote Pro, and this policy separates them because they see very different data:

  • What SideNote Pro stores on your own Windows device, and what it does not collect.
  • What happens when you send a request to the third-party AI provider you have configured.
  • What BediniLabs receives: licensing and device information through the licensing service and, from version 1.15.1, an anonymous daily check for a newer version. Neither includes anything from your conversations.

We do not receive your conversations. The AI provider you configure does receive the requests you submit to it, and handles them under its own privacy, retention and usage policies.

2. The SideNote Pro application

SideNote Pro runs locally on your Windows device. It has no user account system, no sign-in, and no cloud service operated by BediniLabs that stores or processes your conversations.

SideNote Pro makes network requests to the following destinations, and they are entirely separate:

  • the AI endpoint you configured in settings, which receives the requests you submit to it;
  • the BediniLabs licensing service, which handles trial authorization, activation, entitlement refresh and device deactivation;
  • from version 1.15.1, this website, about once a day, to check whether a newer version of SideNote Pro is available, as described under the update check.

Your settings, conversations, folder indexes and usage figures are not sent to BediniLabs, and your AI requests do not travel through the licensing service or this website.

3. Information stored locally

Application data is stored on your own device, under your Windows user’s Local App Data location. It covers:

  • Settings. Application and provider-profile settings, such as the endpoints and models you configured, the system prompt, the global shortcut, the context window, retention preferences, appearance values, the inline commands and writing context you set up, and your Takeaways settings and instructions.
  • Provider credentials. Each provider profile’s API key, held in its own protected file. Keys are never written into the settings file.
  • Conversations and history. Threads, messages, unsent drafts, compaction summaries, the takeaways you keep with any notes you add to them, and the copy of any Active Note you sent with a message, when history is enabled.
  • Active Notes. From version 1.16, the notes you write or capture, where a captured note came from, and where floating notes sit on screen. They are kept apart from conversation history.
  • Attached image data. Images you attached, pasted, dropped or captured are kept with the conversation they belong to.
  • Locally extracted document content. The text SideNote Pro extracted from documents you attached is kept with the conversation, so a saved thread does not depend on the original file remaining where it was. The file itself is not copied elsewhere or uploaded.
  • The usage ledger. Daily token counts and local cost estimates, recorded by provider, model and request category. It holds no prompts, responses, filenames, document contents, images or API keys.
  • Local folder indexes. Text extracted from folders you chose to index, with the file fingerprints and source references retrieval needs to cite them.
  • Licensing state. Trial dates and the cached signed entitlement for this device.
  • Device identity. A key pair generated on your device and used to sign licensing requests.
  • Welcome-card progress. From version 1.16, which of the try-it cards in an empty conversation are ticked, and three activity totals: responses completed, results inserted and takeaways saved. It holds no content, names, providers or keys.
  • Update check state. From version 1.15.1, when the update check last heard from this website, the newest version it heard about, and the version whose notice you closed. It holds nothing that identifies you or your device.

This information stays on your device. It is not uploaded to BediniLabs and is not synchronised between devices. Provider credentials, folder indexes, licensing state and device identity are protected with the Windows Data Protection API for your current Windows account. Conversation history and Active Notes can be protected the same way, together, and that is optional.

4. API credentials

The API key you enter, or the key OpenRouter creates for you when you choose Connect with OpenRouter, is stored locally and protected using the Windows Data Protection API (DPAPI) for your current Windows user account. In practice this means the stored credential is bound to your Windows account on that device.

Your API key is transmitted to the AI provider endpoint you configured, because that is how the provider authenticates your requests. It is not transmitted anywhere else, and it is never sent to BediniLabs.

Connect with OpenRouter opens OpenRouter in your web browser. You sign in and approve SideNote Pro on OpenRouter’s site, under OpenRouter’s own terms and privacy policy, and OpenRouter returns the approval to SideNote Pro through a single-use address on your own device. SideNote Pro then collects the key from OpenRouter and checks it. BediniLabs takes no part in that exchange and receives neither the approval, the key nor your OpenRouter account details. If setup stops after OpenRouter has created the key, the key stays in your OpenRouter account, where you can delete it. Requests to OpenRouter carry its optional attribution headers, which name the application and nothing else.

5. Conversation history

Conversation threads and history are stored locally on your device so that you can return to earlier conversations and search them. SideNote Pro does not operate a cloud conversation service, and no copy of your history is kept by BediniLabs.

  • Local conversation history can be encrypted, which is optional.
  • When enabled, that encryption uses Windows DPAPI for your current Windows user account.
  • Conversation history can be deleted from within the application, and threads can be pruned automatically after a number of days you set.
  • Takeaways, and the notes you add to them, are stored inside their conversation. They are protected with it when encryption is enabled, and deleted with it.
  • Active Notes are not conversation history. Turning history off, the retention period and deleting all history leave them in place; they are encrypted together with history when encryption is enabled.
  • From version 1.16 you can export every saved conversation to one file, and your settings to another. Both are written only where you choose to save them, are plain text even when encryption is enabled, and are not sent anywhere. The settings file contains no API key.

Protection, when enabled, covers the whole archive, including attached image data and text extracted from documents. It binds the file to your current Windows account on that device, so it is local protection rather than a portable password-based format.

6. AI provider requests

SideNote Pro contacts the OpenAI-compatible endpoint you configured when you submit a request, when you explicitly run an inline command, or, only if you have switched on Automatic Takeaways, to check a response after it finishes, as described under Takeaways below. It does not contact it before. Apart from that optional check, nothing described above is uploaded in the background, and nothing crosses that boundary on a schedule.

What a request contains depends on what you did before sending it. Following your own action, the provider may receive:

  • the message you wrote, and the system prompt the conversation uses;
  • Active Notes you explicitly attached to that message;
  • relevant earlier messages from the same conversation, within the context window you configured;
  • images you explicitly attached, pasted, dropped or captured with the screenshot tool or the capture shortcut, including pages of a PDF you chose to send as images;
  • text SideNote Pro extracted locally from documents you attached, sent as clearly delimited reference material rather than as the original file;
  • text captured by a selected-text action you invoked, in the same delimited form;
  • the text you typed after an inline command’s trigger, with that command’s instruction and your writing context, when you run the command, as described under inline commands below;
  • the excerpts local retrieval selected from a folder you indexed and attached, and only those excerpts;
  • if you switched on Automatic Takeaways, the text of the exchange that has just finished and a few earlier messages, in a separate request described under Takeaways below;
  • a summary of older messages when a long conversation is compacted. That summary is itself produced by asking your configured model, so compaction is a request to your provider like any other, and it uses tokens like any other.

Which of those apply is a consequence of what you attached and which action you used. A request that is only typed text sends only typed text.

That provider receives the content of those requests. What the provider does with it (how long it retains it, whether it is used for training, how it is billed and who can access it) is governed by that provider’s own terms and privacy policy. BediniLabs does not control those practices and cannot make commitments on the provider’s behalf.

Sending a request to an external AI provider is not private or anonymous simply because SideNote Pro itself stores your data locally. Please review the policies of the provider you choose.

7. Documents and local folders

Documents you attach are read and extracted on your device. The original file is never uploaded. Only the extracted text, or the PDF pages you chose to read as images, is sent, and only as part of a request you submit. Those pages are drawn on your device, and no text recognition runs.

Local folder context works the same way, and a folder is only ever one you added yourself. SideNote Pro does not discover folders, crawl drives, inspect recent files or run background filesystem watchers. Indexing, search and ranking all run on your device, contact no AI provider, and involve no embeddings, vector database or hosted search service.

The contents of an indexed folder are not uploaded. When you send a request with a folder attached, local search selects a small number of relevant excerpts, and those excerpts are what the provider receives.

8. Selected-text actions

SideNote Pro can act on text you have selected in another Windows application. It reads that selection only at the moment you press the Selection actions shortcut or an action shortcut you assigned. Selected-text actions do not monitor what you select or read other applications in the background, there is no clipboard polling, and the clipboard contents that were there before the capture are restored afterwards. SideNote Pro keeps its own clipboard writes out of Windows clipboard history and cloud clipboard; the application you select from copies the text itself, and that copy follows your Windows clipboard settings.

So that an answer can be returned to that application, SideNote Pro also reads the selection and up to 64 characters on each side of it through Windows UI Automation. It compares them in memory and does not save, log or send them. An answer is returned only when you choose Replace selection or Insert after; while that runs, SideNote Pro counts key and mouse-button presses, but not which keys, so that it can stop if you type or click. Saving a selection as an Active Note keeps it on your device and sends nothing.

Where the action you invoked is set to send immediately, the captured text goes to your configured provider as part of that request. Where it prepares the request for review instead, nothing is sent until you submit it.

9. Inline commands

Inline commands let you type a short command, such as /fix, followed by your text in a text field in another Windows application, and press Tab to have your configured AI provider transform that text in place. The feature is off by default, and it does nothing until you switch it on in the application’s settings.

When typing is observed. Only while inline commands are switched on does SideNote Pro observe the keys you type in other applications, and only so that it can recognise one of your commands as you type it. It keeps as little as that requires:

  • until you type a slash at the start of a word followed by the beginning of one of your triggers, it keeps nothing of what you type except whether the most recent keys were spaces, which is how it tells where a word begins;
  • while a trigger is being typed, it keeps only the trigger’s characters, and once a complete trigger and a space are typed, it holds that command’s text in memory until you run the command, cancel it or type something that ends it;
  • it does not track typing in SideNote Pro’s own windows, in fields that Windows identifies as password fields, or in Windows sign-in and credential prompts;
  • nothing it observes is written to disk, logged, or sent anywhere while you type.

When inline commands are switched off, which is the default, or paused together with the global shortcuts from the notification-area icon, typing in other applications is not observed at all.

When text is sent. Text is sent only when you explicitly run a command by pressing Tab after it. Typing a command without running it sends nothing. When you run one, SideNote Pro sends the text you typed after the trigger to the AI provider you configured, together with that command’s instruction and, if you have written one, your writing context. The trigger itself is not sent. The request goes directly to your configured provider, like any other request, and not to BediniLabs.

Replacing the text. Before sending, and again before replacing, SideNote Pro asks Windows, including through its UI Automation accessibility interface, whether the same field still has focus and whether it is a password field. To replace the command, it selects the text you typed, reads the selection back to confirm it matches, types the result in its place and confirms the field accepted it. It does not use the clipboard. What it reads during those checks is only compared, and is not stored or logged.

Inline commands do not become conversations and are not saved to your conversation history. The text of a command is cleared from memory when the command finishes or is cancelled. The usage ledger records the tokens a command used, under a category of its own, without any of the text. The commands you define and your writing context are stored locally with your other settings.

10. Takeaways

Takeaways are short cards that keep points a conversation settled, such as a decision or a next step, beside that conversation, each quoting the message it came from. You can add a note of your own to any card.

Saving and notes. When you save a response as a takeaway yourself, SideNote Pro makes the card on your device from the response’s own text and sends nothing. Notes you add to a card are stored on your device and are never sent to any AI provider or to BediniLabs.

Automatic Takeaways. Automatic Takeaways is off by default. If you switch it on, then each time a response finishes and is saved, SideNote Pro sends a separate request to an AI provider asking whether that exchange contains anything worth keeping. The request contains, as text only:

  • the response and the message it answered;
  • up to six earlier messages from the same conversation;
  • your takeaway instructions, which are SideNote Pro’s default unless you replaced them;
  • the category, title and quoted passage of takeaways already kept for that conversation, so they are not suggested again.

It never contains images, documents, text captured from other applications, folder excerpts or your notes. It goes directly to the provider and model that wrote the response or, if you chose one in the Takeaways settings, to that provider profile, and not to BediniLabs. The provider handles it under its own terms, like any other request. Its token use is recorded in the local usage ledger under a category of its own, without any of the text. Nothing is sent for takeaways while Automatic Takeaways or conversation history is switched off.

Storage. Takeaways and their notes are stored on your device with their conversation, protected with it when history encryption is enabled, and deleted with it. Switching history or Automatic Takeaways off deletes none of them. They are not uploaded to BediniLabs and are not synchronised between devices.

11. Images and screenshots

SideNote Pro can attach images to a request. Images enter a conversation only through an explicit action by you:

  • attaching an image file;
  • pasting an image from the clipboard;
  • dragging and dropping an image onto the window;
  • starting a screen capture, whether of a region you select, the active window, the current screen or the whole desktop;
  • pressing the capture shortcut, from version 1.16, and selecting a region of the screen;
  • choosing pages of a PDF to read as images.

Screen capture is initiated explicitly by you. SideNote Pro does not capture your screen in the background, does not continuously monitor what is displayed, and does not read your clipboard except when you explicitly paste or attach content.

There is no passive microphone, camera, clipboard or screen monitoring of any kind. Attached images are transmitted to your configured AI provider as part of the request they belong to, and are otherwise stored with the conversation on your device.

12. The SideNote Pro licensing service

The licensing service is operated by BediniLabs. It exists to answer whether an installation is entitled to run, and it handles trial authorization, activation, entitlement refresh and device deactivation.

For those purposes it processes licensing and device information: the licence, the devices registered against it, trial and entitlement dates, and the purchase email described under buying a licence. Starting the free trial requires a request to it, because the trial is authorized by the service rather than issued on your own device. Trial authorization also sends an identifier derived from your Windows installation, and only the derived value is transmitted.

It does not receive your prompts, responses, attachments, screenshots, filenames, folder contents, usage figures or your AI provider API key. Your AI requests do not pass through it. It is not a proxy for your provider, and BediniLabs is not in the path between SideNote Pro and the AI service you chose.

13. The update check

From version 1.15.1, SideNote Pro checks about once a day whether a newer version has been released. It downloads one public file from this website, https://sidenotepro.com/updates/latest.json, which is the same for everyone, and compares the version number in it with its own. The check runs in the background once the application has started, and the website is asked again only when the last answer is a day old. When a newer version exists, Settings › About says so. The update itself comes from the Microsoft Store: SideNote Pro never downloads or installs anything on its own.

The request is an anonymous download of that file. It carries no licence key, device or installation identifier, email address, settings, provider configuration, API key, usage figure or conversation content, and no cookie. Every installation sends the same request, so nothing in it tells one installation from another. SideNote Pro does not report that a check happened or what it found, and keeps the answer only on your device.

Like any visit to this website, the request passes through Cloudflare, which delivers the website, to our web server, and both see the IP address it comes from and the time, as described under website privacy. The web server records that IP address, the time and the requested address in its access log, which is deleted after about two weeks.

14. Telemetry and analytics

The SideNote Pro application does not contain telemetry, product analytics, advertising identifiers or marketing SDKs. It does not report usage, feature interaction, crash statistics or device information to BediniLabs.

The update check is not telemetry: it asks for a public file and sends nothing about you, your device or how you use SideNote Pro.

15. Website privacy

This website does not intentionally use advertising trackers, analytics scripts, marketing pixels or cross-site tracking cookies, and it does not ask you to create an account.

It carries two forms: the bug report form on the contact page, and the newsletter signup card described below. Both are optional, and nothing else on this site collects anything you type.

The website is served by hosting and network infrastructure which may process ordinary request information (such as IP address, request time, requested URL and user agent) as needed to deliver, operate and secure the site.

16. The bug report form

The contact page carries a form for reporting a problem with SideNote Pro. Using it is optional: the same report can always be sent as an ordinary email instead.

What you type is what is sent, and nothing else: your name, your email address, the Windows version you give, how urgent you say the problem is, whether you would like a beta build to test, your description of the problem, and your steps to reproduce it. The form does not read anything from your device, your clipboard, your conversations or your SideNote Pro installation, and it has no hidden fields.

A submitted report is delivered to BediniLabs as an email, through Brevo, the same transactional email provider described below. It is not written to a database, a ticketing system or any other store belonging to this website. From then on it is an ordinary email in the BediniLabs mailbox, kept for as long as it is useful for fixing the problem and answering you. Your address is used to reply to you about that report and for nothing else, and it is not added to any mailing list.

Before the report is sent, the form runs a Cloudflare Turnstile check. This is an anti-spam measure, and it is what allows the form to exist without an account or a puzzle to solve. Cloudflare receives what it needs in order to judge whether the submission is automated, which includes your IP address and information about your browser, and uses it to issue or refuse a token for that one submission. Turnstile does not track visitors across websites, and it runs on the contact page and nowhere else on this site.

17. The newsletter signup

Some pages on this site show a small card offering occasional SideNote Pro updates by email. Giving your address there is entirely voluntary, and nothing on this site requires it.

If you subscribe, this website records your email address for that one purpose: sending you occasional updates about SideNote Pro. Stored alongside it are the date you subscribed, the date of your most recent signup, the version of the signup wording you agreed to, which page you subscribed from, and, where your browser provides them, the site that referred you and any campaign parameters in the link you followed. Your IP address is not stored. This signup record is held on the BediniLabs server that runs this website.

The newsletter itself is managed in SideNote Outreach, the BediniLabs newsletter system, which runs on its own server. Outreach imports your address, your signup dates and the signup wording version from this website, but not the page or link you came from. It keeps the subscriber list, decides who each newsletter is sent to, and records whether each message was delivered.

Newsletters are sent through Elastic Email, an email delivery provider. Elastic Email receives your address and the message in order to deliver it, and reports back whether it was delivered, bounced or reported as spam.

Apart from Elastic Email delivering the newsletter, your address is not shared, sold or rented. It is not used to build a profile of you, and it is not combined with anything from your SideNote Pro installation, which BediniLabs cannot see in any case.

Every newsletter contains an unsubscribe link, and also works with your email app’s own unsubscribe button. Once you unsubscribe, no further newsletter is sent to you. The same applies if messages to your address bounce permanently or are reported as spam. Your address is then suppressed: Outreach keeps a one-way hash of it, together with whether it was an unsubscribe, a bounce or a spam report and when, so that no newsletter is sent to it again, even if the address is signed up again later. Nothing else about you is kept with the hash, and it is kept even if the rest of your record is later deleted.

Unsubscribing does not delete your signup record from this website. To have your address deleted, email info@bedinilabs.com. It will be deleted from this website’s signup records and from Outreach. If your address had been suppressed, the suppression hash is kept, so deleting your address does not put it back on the list.

18. Purchase and licensing data

Buying SideNote Pro involves payment and licence records held outside your device.

Payment is taken by Stripe, which is an independent payment processor. You enter your card details on a page hosted by Stripe, not on this website. BediniLabs does not receive, see or store your card number, its expiry, or its security code, and no card field is embedded anywhere on this site.

Stripe reports the outcome of a completed payment back to BediniLabs. What we receive and keep is the information needed to issue and support a licence: the email address you used at checkout, Stripe’s own identifiers for the purchase, the amount and currency, and the time the payment completed. Stripe processes your payment under its own privacy policy and its agreement with you.

Your activation key is delivered by email through Brevo, a transactional email provider. Brevo receives the recipient address and the message in order to deliver it, and reports back whether delivery succeeded. BediniLabs keeps the delivery outcome so support can tell whether your licence email arrived.

The licensing record holds your purchase email, your licence and its registered devices. It does not hold your card details and it does not hold your conversations. There is still no SideNote Pro account: the email address identifies your purchase for support and delivery, and it is not a login.

19. Third-party services

The AI provider you configure is an independent third party. Its handling of your requests is governed by its own agreements with you, not by this policy. BediniLabs does not control, audit or take responsibility for third-party AI provider practices.

Any billing relationship for API usage is between you and that provider.

Two further third parties are involved if you buy a licence: Stripe, which processes the payment, and Brevo, which delivers the licence email. Both are described in the section above.

If you send a bug report from the contact page, Brevo delivers that email as well, and Cloudflare performs the anti-spam check that precedes it. None of these three receives your conversations or your AI provider credentials.

20. Data deletion

Because SideNote Pro data is stored on your own device, you remain in control of it:

  • Conversation history can be deleted from within the application.
  • History can be disabled so that conversations are not retained.
  • Removing a folder from the folder list deletes the local index built from it.
  • An API key can be removed from its provider profile, which deletes the protected credential file holding it.
  • Clearing the writing context in the inline commands settings removes it from the settings file, and switching inline commands off stops typing from being observed.
  • Dismissing a takeaway removes it, saving an empty note removes that note, and deleting a conversation deletes its takeaways and notes. Switching Automatic Takeaways off stops takeaway requests.
  • Deleting an Active Note removes it from your device. A copy of a note you sent with a message stays with that conversation until the conversation is deleted.
  • Deactivating a device releases it from your licence, through the application or by writing to us.
  • Removing the application and its local application data removes the settings, conversations, Active Notes, folder indexes and usage ledger it kept on that device.

A bug report you sent from the contact page exists only as an email in the BediniLabs mailbox. Ask us to delete it and it will be deleted.

Data already submitted to a third-party AI provider is subject to that provider’s retention and deletion practices. Requests to delete it must be directed to the provider.

21. Changes to this policy

This policy may be updated as SideNote Pro develops. When it changes, the effective date at the top of this page will be updated. Continued use of SideNote Pro after a change indicates acceptance of the updated policy.

22. Contact

Questions about this policy can be sent to info@bedinilabs.com. You can also use the contact page.