Privacy Policy

1. The short version

• Your library (saves, cards, notes, collections and reminders) lives on your phone. Ask conversations are never stored on our servers.
• Our servers keep only what runs your account: a random account ID, your subscription status, monthly usage counts and a cache of processed public posts that isn’t linked to anyone.
• When you share something, we send that content to our AI provider (Google Gemini) to build your cards. Screenshots are read on your phone: only their text is sent, never the image.
• We use PostHog to understand how the app is used and to fix bugs. Session recordings mask all text and images, and Ask content is never sent to analytics.
• No ads in the app. We don’t sell your personal information.
• You can delete your account and server data at any time in the app.

2. Who we are

Forgetless is a mobile app for iOS and Android, and this website (getforgetless.com). Both are operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (“Forgetless”, “we”, “us”). We are the controller of the personal data described here.

For anything about privacy, write to support@getforgetless.com. Our data protection contact (Encarregado under the LGPD) is [NAME OF DATA PROTECTION OFFICER], reachable at the same address.

3. What stays on your phone

Forgetless is local-first. Your saves, the cards built from them, notes, collections, places and reminders are stored on your device. We don’t keep a copy of your library on our servers, and reminders are scheduled on your device.

This also means that if you delete the app or lose your phone without exporting your library, it is gone. You can export it or delete everything on the phone in Settings.

4. What we keep on our servers

To run your account and the AI features, our servers keep a small amount of data:

5. How the AI processes what you share

Links. When you share a TikTok, Reel, video, post, web page or Maps link, the app sends the link and any caption that came with it to our server. Our server fetches the public content behind the link (title, caption, description, page text and, for some videos, the video itself), directly from the platform or through a provider: ScrapeCreators for Instagram and some TikTok posts, and the YouTube Data API for YouTube. It then sends that content to Google’s Gemini API, which extracts the recipe, place, steps, key moments or other details. Maps links are read without AI. The result goes back to your phone, where it is stored.

Screenshots. Text in a screenshot is read on your phone. Only that text is sent to our server and to Gemini; the image never leaves your device.

Places. When the AI finds a place, our server looks it up in the Google Places API by its name and area, and keeps Google’s place details in a shared cache for up to 30 days, as Google’s terms require.

Ask. When you ask a question, the app picks the saves that may answer it and sends our server your question, the title and text of those saves, their Google place IDs, up to four previous messages of the conversation and the app language. Gemini writes the answer, which streams back to your phone. Nothing of the question, the saves or the answer is stored on our servers: we only record that a message was sent, the model used, token counts and cost.

Google Gemini. Google processes this content as our service provider. We call Gemini with storage turned off. Under Google’s terms for paid Gemini API services, Google does not use this content to train its models. [CONFIRM: the Gemini account is on the paid tier.] We don’t send your name or email address with any content.

We never access your photo library, contacts or other apps. Forgetless only sees what you explicitly share with it.

6. Analytics, session replay and error tracking

We use PostHog (US Cloud) to understand how people use Forgetless and to find and fix bugs. PostHog receives:

• Usage events from the app, such as app opens, screens viewed and features used, linked to your random account ID.
• Device and app details: device model, operating system, app version, language and approximate location (country or city) derived from your IP address.
• Error and crash reports.
• Session replays: recordings of how screens are used, to see where people get stuck. All text, all images and the map are masked in recordings.
• Events from our servers with IDs, counts, durations and costs, never links, captions, screenshot text, Ask questions, answers or the text of your saves.

We use this data only to improve Forgetless, never for advertising. PostHog keeps it for [ANALYTICS RETENTION PERIOD]. When you delete your account, we delete the analytics profile linked to it, with its events and recordings. Events from before you were identified (for example, the first screens after installing) may remain under a random ID, not linked to you, until they expire. When you sign out, the app stops linking new events to that account.

7. Sign-in and payments

Sign-in. Accounts are managed with Google Firebase Authentication. When you first open the app, Firebase creates a guest account with a random ID. You can sign in with Google to keep your plan when you change phones. Firebase App Check confirms that requests come from the real Forgetless app.

Payments. Subscriptions are sold through the App Store and Google Play. Apple or Google process the payment; we never see your card details. We use Superwall to show the subscription screen and to receive your subscription status from Apple and Google.

8. Permissions on your phone

• Share sheet. Forgetless appears in your share menu. It only receives what you choose to share with it.
• Notifications. Used for the reminders you set, which are scheduled on your phone. You can turn them off in your phone settings.
• Location (optional). Asked only when you tap “Near me” on the map, and only while you use the app. It is used on your phone to show where you are and how far places are. It is never stored or sent to our servers.
• Map. The map is provided by Google Maps. To draw it, your phone downloads map images from Google for the area you are looking at, under Google’s Privacy Policy.

9. This website

getforgetless.com is hosted on Cloudflare, which processes your IP address to deliver the site and protect it from abuse. The site doesn’t set cookies or load analytics or advertising trackers. It stores your language choice in your browser’s local storage, which never leaves your device.

If you join the waitlist, we keep your email address and language on our own server only to email you when Forgetless launches. You can ask us to remove it at any time.

If you request account deletion on our Delete account page, we keep the email and message you send only until we handle the request, then delete them.

10. Who we share data with

We share data only with service providers that help us run Forgetless, under contracts that limit their use of it to providing their service to us:

We don’t sell your personal information and we don’t share it for cross-context behavioral advertising. We may disclose data if the law requires it, to protect people’s safety or our rights, or to a successor if Forgetless is sold or merged, in which case this policy keeps applying to your data.

11. International transfers

Our servers and most of our providers are in the United States, so your data may be processed outside your country, including outside Brazil, the European Economic Area and the United Kingdom. When that happens we rely on the safeguards the law provides, such as the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework where a provider is certified, and the mechanisms in article 33 of the LGPD.

12. Legal bases

Under the GDPR and the LGPD we process personal data on these bases:

• To provide the service you asked for (performance of a contract): your account, subscription, AI processing, Ask and shared collections.
• Legitimate interests: security, fair-use limits, cost tracking, product analytics and fixing bugs. You can object at any time.
• Consent: notifications, location and, where the law requires it, session replay. You can withdraw consent at any time.
• Legal obligations: tax, accounting and responding to lawful requests.

13. Your rights

Depending on where you live, you have rights over your personal data. We honor them for everyone, wherever you are:

• Access and portability: get a copy of the data we hold about you. Your library can be exported from the app at any time.
• Correction: fix data that is wrong or incomplete.
• Deletion: delete your account and server data in the app, or request it on the web without the app (see Delete account).
• Objection and restriction: ask us to stop or limit certain processing, such as analytics.
• Withdraw consent at any time, without affecting what was done before.
• Information about who we share data with.

Brazil (LGPD). You have the rights in article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, portability, deletion and information about sharing. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).

European Economic Area and United Kingdom (GDPR). You can complain to your local data protection authority.

California and other US states (CCPA/CPRA and similar laws). You have the right to know what personal information we collect, to delete it, to correct it and to opt out of its sale or sharing. We don’t sell or share personal information as those laws define it, and we don’t use sensitive personal information to infer characteristics about you. We won’t treat you differently for exercising your rights. An authorized agent can make a request on your behalf.

To exercise any right, email support@getforgetless.com. We may need to confirm it’s you before acting. We reply within the time the law gives us (for example, 15 days under the LGPD and one month under the GDPR).

14. Retention and deletion

We keep your account data while your account exists and delete it when you delete your account. Some data has shorter limits: shared captions and screenshot text are erased when processing ends, processing jobs are deleted after 7 days, and Google place data is kept for up to 30 days. Cost records are kept without any link to you, and we keep transaction records the law requires. Server logs expire within 90 days, and we keep no database backups.

Deleting your account in the app also erases your library on that phone. Details are on the Delete account page.

15. Children

Forgetless is not directed to children under 13, or under the minimum age required in your country to use online services without a parent’s consent. We don’t knowingly collect data from them. If you believe a child has given us data, write to us and we’ll delete it.

16. Security

Data is encrypted in transit (TLS), every request to our servers must carry a valid sign-in token, and access to our servers and providers is limited to the people who need it to run Forgetless. No system is perfectly secure, so we can’t guarantee absolute security, but we work to protect your data and will notify you and the authorities of a breach when the law requires it.

17. Changes and contact

If we change this policy in a meaningful way, we’ll tell you in the app or on this site before the change takes effect. The date at the top shows the latest version.

Questions or requests: support@getforgetless.com. [COMPANY LEGAL NAME], [REGISTERED ADDRESS].