Privacy policy

We do not run ads, sell data or track you across apps. This policy separates local storage, AI, iCloud sharing and optional statistics.

On your phone and speech

Items, locations, aliases, history and unfinished original notes are stored locally first. The app does not keep audio. Apple speech recognition may run on-device or use Apple services, depending on system support. You can type if speech permission is declined.

Optional OpenAI assistance

AI is offered to adults who declare they are 18 or older and explicitly consent. This declaration is not identity verification. No birth date is collected or shared. Local features remain available without AI. After consent, only the current record or search text and a limited number of necessary candidates are sent through Cloudflare to OpenAI. Audio, complete maps and full history are not sent; the provider key stays on the server.

The app uses store:false; this is not zero retention. Providers may retain abuse-monitoring data under their policies. API data is not used for training by default unless separately opted in. See OpenAI data controls. Turning AI off stops new AI requests and rejects in-flight results, but cannot recall data already sent.

iCloud sharing

Private places stay on this phone. Confirming sharing uploads items, individual descriptions, locations, aliases, events and borrower names to Apple CloudKit for authorized members. Original notes, pending records, audio and diagnostics consent are not shared. Apple manages identity and permissions. Offline permission revocation may be delayed; exported copies cannot be recalled. Members can leave; owners can delete a shared place after confirmation, affecting all members.

Service security and logs

Cloudflare processes network metadata such as IP addresses. DeviceCheck, HMAC installation identifiers, request identifiers and replay records protect the service and enforce the shared AI allowance. Hashed identifiers are not fully anonymous. Operational logs contain versions, latency, token and candidate counts, status codes, error types and necessary request identifiers, never original notes, item or location names or complete AI responses. Security and quota records are not necessarily deleted with local device data.

Optional statistics

Usage and error statistics are off by default. If enabled, fixed success, failure and correction counts, timing ranges and app versions are sent, without original text, names, locations, audio or installation identifiers in the statistics payload. Device verification and network metadata processing still apply. The service removes batches older than 30 days on the next receipt, not on a daily deletion schedule. Turning this off clears unsent counts; a batch already sending may finish and sent aggregates cannot be recalled.

Backups, deletion and contact

You choose where to export backups; the app does not secretly upload them. Backups include original notes and need secure storage. Restoration replaces local data after preview and confirmation. Shared backups become new private copies without restoring members or changing cloud data. You can delete private data, leave a shared place or confirm deletion of an owned shared place. Data already handled by Apple, OpenAI and Cloudflare follows their policies.

Privacy questions: support@whereisit.musofixr.com. We update this policy when practices change and obtain new consent where needed.