Evernote is a note-taking and productivity app owned since early 2023 by Bending Spoons S.p.A., a Milan-based technology company that is named as data controller in the current privacy policy (effective January 1, 2026). The service collects subscriber, usage, location, and device data — including unique hardware identifiers such as IMEI and SIM numbers — alongside user-permissioned contacts, calendar, photo, and audio data, and stores synced content on U.S. servers. The policy states Evernote is not in the business of selling or renting personal data and does not share it with third parties for their own advertising purposes, though its cookie notice describes profiling cookies, mobile ad identifiers (IDFA/AAID), and third-party ad networks used to promote Evernote's own services, and the policy says Do Not Track signals are not honored. Evernote publishes annual transparency reports (since 2013), a subprocessor list, and holds ISO 27001 certification (November 2025). Its track record includes a 2013 breach that forced a 50-million-user password reset and a 2016 machine-learning policy that would have let employees read notes, reversed to opt-in within days after user backlash.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
[2021-05-14] · COLLECTION
As assessed by PrivacySpy on 2021-05-14 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Evernote's privacy policy (effective January 1, 2026) describes collecting subscriber information, usage data, IP-based location, and device data — including unique hardware identifiers such as IMEI and SIM numbers — plus contacts, calendar, photos, and audio when users enable those features, with synced content replicated to servers in the United States. The policy also states that AI-feature inputs and outputs are not used to train Evernote's AI models unless the user directs it.
Evernote publishes an annual transparency report — with editions linked back to 2013 — detailing government and civil requests; the 2023 report discloses 16 U.S. criminal requests (8 answered with data), 53 foreign criminal requests (0 answered with data), and a stated requirement of a search warrant before disclosing account contents to U.S. criminal requests.
As assessed by PrivacySpy on 2021-05-14 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is the policy's history made available? — Yes, with revisions or a changelog.
On November 16, 2022, Bending Spoons, a Milan-based technology company, announced a definitive agreement to acquire Evernote, with the transaction expected to complete in early 2023; the announcement was published on Evernote's own site.
In July 2023, following the Bending Spoons acquisition, Evernote announced that most of its operations would move to Europe and that most of its U.S.- and Chile-based employees had been laid off, with the layoff communicated on July 5, 2023 — a substantial post-acquisition restructuring under the new parent.
Evernote's current privacy policy identifies Bending Spoons S.p.A., an Italian company based in Milan, as the data controller, and provides a Data Protection Officer contact route — a clear, primary-document disclosure of the app's ownership and accountability structure.
PrivacySpy's published assessment rates Evernote 5.7/10, scoring personally-targeted or behavioral marketing as 'Yes, but you may opt-out' and citing earlier Evernote policy language that permitted contracting with third-party advertising networks and sharing a hashed identifier with partners for services such as Google AdWords Remarketing and Facebook Custom Audience.
Evernote publishes a third-party vendor (subprocessor) list for Evernote Enterprise, naming Google Cloud, Fastly, and Bird for infrastructure, Google Analytics for analytics, OpenAI (Ireland) for AI-powered processing, Zendesk and Calendly for customer support, and Datadog and Sentry for service maintenance, with countries of processing listed for each.
As assessed by PrivacySpy on 2021-05-14 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Evernote's privacy policy states the company is not in the business of selling or renting personal data and does not share personal data with third parties for their own advertising purposes; disclosures are described as limited to service providers under data-protection requirements. The policy nonetheless permits disclosing personal data to parents, subsidiaries, and affiliated companies, and transferring it in a merger, sale, or reorganization.
Evernote's security page states the service is ISO 27001 certified as of November 2025 (with the certificate linked), undergoes yearly penetration tests by an external provider and an annual Google CASA Tier 2 assessment, runs a public bug bounty program on HackerOne, and screens passwords against the Have I Been Pwned breach database.
In March 2013, Evernote forced a password reset for all of its roughly 50 million users after detecting suspicious activity; intruders accessed usernames, email addresses, and hashed-and-salted passwords, though the company said it found no evidence that stored note content or payment information was accessed.
In December 2016, Evernote announced a privacy-policy change that would have allowed some employees to read user notes to oversee machine-learning features; after user backlash, the company reversed course within about two days, making such review opt-in, with CEO Chris O'Neill saying customers 'let us know that we messed up.' The episode is historic and was reversed before taking effect.
Evernote's cookie notice describes 'Profiling Cookies' that third-party partners may place to profile user interests and serve ads, and states that the mobile apps collect the Apple IDFA and Google AAID advertising identifiers, which are combined with analytics technologies to inform personalized advertising for Evernote's own products; users can opt out in Privacy Settings. The notice also describes tracking pixels in emails and social-media features that transmit data to platforms such as Facebook.