Privacy
This is not a policy position. It is how the product is built. There is no server receiving your captures, no cloud storing your voice memos, no company with access to the things you are trying to remember.
The short version
No account required. There is nothing to sign up for and nothing to log into.
Unless you choose Connected, which requires an account to identify you to the people you share with. That is your choice, made explicitly.
No cloud. Your captures live in local storage on your device. Full stop.
Unless you choose to share a capture with a connected person, in which case only what you explicitly share leaves the device – end-to-end encrypted.
No subscription. One purchase. No recurring charges. No ongoing relationship to manage.
Unless you choose Connected, which has real ongoing backend costs and is priced accordingly. The Solo tier remains a one-time purchase, permanently.
No algorithm. Nothing decides when you are ready. You set the cue. The app honors it.
This does not change at any tier. Ever.
How it's built
The Solo tier runs entirely on your device. No outbound connections. No telemetry. No analytics. Location permissions are used only to fire cues you have set – they are never sent anywhere. Voice recordings are transcribed on-device and never leave unless you explicitly share them.
The Connected tier introduces a backend for one purpose: routing signals between people who have chosen to be connected. That backend holds ciphertext only – it cannot read your capture content or your presence events. Revoking a connection immediately invalidates the encryption key for that connection. When you cancel your subscription or delete your account, presence log history is deleted from the server within 30 days. Deleting the app from your phone does not trigger server deletion – cancel your subscription or delete your account from within the app first.
The qualifications on the previous page are honest, not apologetic. Every exception is your own choice, made explicitly, for a feature that requires it. Nothing happens to your data without your action.
Permissions
Location (when in use)
Required for geofence cues. Used only to detect when you enter or leave an area you have defined. Your location is never transmitted.
Location (always)
Required for geofence cues to fire while the app is in the background. You can choose "when in use" only – geofences will fire less reliably. Always-on location is never transmitted.
Microphone
Required for voice capture. Recordings are transcribed on-device. Audio is stored locally until you choose to delete it. Nothing is transmitted without your action.
Camera
Required for photo capture. Photos are stored locally.
NFC
Required to read and write NFC tags. Tag identifiers are stored locally. Nothing is transmitted.
Bluetooth
Required for Bluetooth device cues. Device names are stored locally. Nothing is transmitted.
Wi-Fi information
Required for Wi-Fi network cues. Network names are stored locally. Nothing is transmitted. This permission requires the Access Wi-Fi Information entitlement on iOS.
Notifications
Required to deliver retrieves. Notifications are generated locally by cues you have set. No push notifications are sent without your action, except on the Connected tier where presence events and shared captures are routed to connected devices.