Privacy Policy

1. Controller#

The controller for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:

We have not appointed a data protection officer because there is no legal obligation to do so. Please send questions about data protection to the e-mail address above.

2. Hosting and server log files#

The website is hosted on our own server with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, in Germany; the Hintsight proxy runs on the same server (B.5a). When you open a page, the web server processes the following data as technically necessary: IP address, date and time of the request, requested file, amount of data transferred, HTTP status code, the previously visited page (referrer) if your browser sends it, and browser and operating system (user agent).

• Purpose: to deliver the pages, keep operations secure and detect and fend off attacks.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and functioning website.
• Retention: the log files are deleted after 14 days at the latest, unless a specific security incident requires longer retention to investigate it.
• Recipients: the hosting provider as processor under Art. 28 GDPR.

3. No cookies, no tracking, no third-party content#

The website sets no cookies and stores nothing in your browser. There is no audience measurement, no advertising, no social media buttons and no embedded content from third parties. Fonts, images and scripts are hosted on our own web space; opening a page does not connect to third parties such as font or content delivery services. That is why there is no cookie notice.

Some pages contain ordinary links, for example to the privacy information of Anthropic and OpenAI. You only leave this website when you click such a link; the terms of the respective provider then apply.

4. Contact by e-mail#

When you write to us, we process your e-mail address, your name if you provide it, and the content of your message in order to answer your request.

• Legal basis: Art. 6(1)(b) GDPR where your request concerns the use of the app, otherwise Art. 6(1)(f) GDPR (our interest in answering requests).
• Retention: until your request has been dealt with; we then delete the correspondence unless a statutory retention obligation applies.
• Recipients: our e-mail provider STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, as processor.

Please do not send us recordings, transcripts or other content from the app. We do not need them for a bug report.

1. Principle: local first#

Hintsight records conversations through the iPhone microphone, a paired Bluetooth microphone or the Apple Watch, transcribes them on the iPhone, recognises who is speaking and derives commitments, decisions and other statements from them. Each of these sources is optional; the app also works without an Apple Watch.

Recording, speech recognition, speaker separation, voice matching, search and the entire database run on your iPhone. There is no user account with a name or e-mail address, no password sign-in and no telemetry. We store no content from the app: no recordings, no transcripts, no names, no usage statistics and no crash reports. Our only server for the app is the Hintsight proxy (B.5a), which we run from the launch of the starter allowance and subscriptions; it forwards pseudonymised text without storing it and keeps the hour allowance per device. We run no server for circles (B.7a); they run on iCloud.

Data leaves the device only in the ways described in sections B.5, B.5a, B.5b, B.7a, B.8, B.9 and B.10.

2. Who is responsible for what#

On your device, we as the provider do not process any personal data; the exceptions are downloading the models (B.9) and the Hintsight proxy. We are the controller for processing on the proxy (B.5a) and for purchase receipts (B.5b); OpenAI processes the text forwarded by the proxy on our behalf. You control the processing on your device: you decide when recording takes place, whom you record, what remains stored and whether text is sent to an AI provider. The following sections nevertheless describe exactly what the app does, so that you can make these decisions on an informed basis.

If you record other people, you are responsible for these recordings unless the exemption for purely personal or household activities (Art. 2(2)(c) GDPR) applies. More on this in B.7.

If you share statements in a circle (B.7a), you and the other members decide what is shared; we receive none of it.

3. Data on your device#

The following overview lists each kind of data, its purpose, where it is stored and how long it stays. “App container” is the app's protected storage area on your iPhone, which other apps cannot access.

Hintsight does not read your contacts.

Recording and consent rule. The sound is recorded as it reaches the microphone. Which voices remain in the transcript is set by the consent rule: “Always record” keeps all voices; “Allow list only” keeps only your own voice if nobody from your people list can be heard. Until you confirm this decision during setup, “Allow list only” applies.

Notifications. Nudges, the morning brief, hints when you arrive at a remembered place and the notice that processing has fallen behind are local notifications scheduled by the app on the device. By default, nudges and the morning brief show only a neutral line on the lock screen. The app reports a backlog at most once every 12 hours, and at night only in the morning. Live Activities on the lock screen and in the Dynamic Island show that the iPhone is recording, or an urgent hint without names; they are created on the device as well.

Calendar and the “Today” view. For “Today”, the app reads your events for the next 14 days from the iPhone's calendar and shows them together with statements that are due. This reading stays on the device; the app does not store the events for it.

Background processing and backlog. The nightly analysis and the analysis after a conversation run in the background when iOS allows it. If processing falls behind, the app shows the backlog and offers “Process now”. If you tap it, the app asks iOS to let processing continue with a progress indicator, even if you leave the app or lock the iPhone; if iOS declines, it continues while the app stays open. The processing itself does not change: transcription happens on the device, and B.5 or B.5a applies to the AI analysis.

4. Permissions#

iOS or watchOS asks for each permission. You can revoke them at any time in the system settings; the affected function then stops, the rest keeps working.

• Microphone (iPhone and Apple Watch): recording conversations and setting up your voice profile. While recording, the system shows the orange dot.
• Calendars (full access): reading events to assign conversations, to prepare you and to show the next 14 days under “Today”. The app only adds an event if you tap to do so after a preview.
• Reminders: creating a reminder if you tap to do so after a preview.
• Location Services (“While Using”): approximate location of a conversation, only if “Remember where conversations happen” is on.
• Location Services “Always”: only for “Hints at places” (Settings → Nudges and morning brief, off by default). The app asks for it only once a nudge is tied to a place. It then registers up to 20 remembered places as 150 m areas with iOS, and iOS wakes the app when you arrive so that it can show the matching nudge as a notification. The areas and the evaluation stay on the device; no location goes to us or to an AI provider.
• Motion & Fitness: whether you were sitting, walking or driving during a conversation, only if “Remember movement during conversations” is on.
• Notifications: nudges, morning brief, hints at places and the notice that processing has fallen behind (B.3).

Classifying the sound environment uses Apple's on-device sound analysis and needs no permission; it can be switched off under Recording → Conversation context.

The app asks for no permission of its own for circles (B.7a). It uses the Apple ID you are signed in to iCloud with in iOS. Without iCloud, circles stay closed; everything else keeps working.

5. Transfer to the AI provider of your choice (Hintsight tier, own key)#

Statements, nudges, dossiers, the morning brief and answers to your questions are produced with a language model in the cloud. There are two routes: with your own API key (Hintsight tier, this section) or through the Hintsight proxy (starter allowance, Plus and Pro, B.5a). What is transferred and what never is applies equally to both. With your own key, requests go, depending on the provider you choose, to

• Anthropic (Claude API), USA, or
• OpenAI (OpenAI API), USA.

Requests go directly and encrypted (HTTPS) from your iPhone to the provider. On this route there is no intermediate server of ours; we see neither the requests nor the responses.

What is transferred

• the text of your conversations, with people replaced by placeholders (such as P_1 for a person, V_1 for a recurring unnamed voice);
• start and duration of a conversation, and a short context line such as “Event T_1 with P_1; place L_1; Tue afternoon; walking; surroundings office”;
• statements already stored, to the extent needed for the analysis;
• for nudges and dossiers, upcoming calendar events (time, title, attendees as placeholders);
• your questions in the question dialog.

The app also replaces place and company names and event titles with placeholders if you switch on “Mask places and companies”. Until you confirm the decision on cloud processing during setup, this masking is always on.

What is never transferred

Audio recordings, voice features, coordinates, your voice profile and the mapping of placeholders to real names. The mapping stays on the device; the names are only put back into the responses there.

Limits of pseudonymisation

Before anything is sent, a guard checks the text. If it still contains a name from your people list, it aborts the transfer. For many requests it also checks the text against a built-in list of common German first and last names. The guard does not recognise names of other people that are on neither list; the app replaces them beforehand using an automatic process. This process can miss names, nicknames or other details that make a person identifiable, such as a role (“my boss”) or an unusual event. The transferred texts are therefore pseudonymised, not anonymous.

Your contract with the AI provider

You obtain the API key directly from the AI provider. For this you conclude your own contract with the provider, and its terms and privacy information govern the processing of the transferred texts, including how long the provider retains them and whether content is used for training. We are not a party to this contract and receive no data from the provider. The provider bills you directly.

• Anthropic: anthropic.com/legal
• OpenAI: openai.com/policies

Legal basis and third country

You initiate the transfer yourself by storing a key and giving your explicit consent to the AI analysis. Without this consent no text goes to a language model, whichever route; you can withdraw it at any time in the settings under “Your decisions” → “AI analysis” (C.2). Where data of other people is concerned and the GDPR applies, you are responsible for a legal basis (B.7). The providers are based in the USA; processing may take place there. Whether an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses apply to the provider of your choice follows from that provider's terms.

Without a key and without a starter allowance or subscription, the app sends nothing to an AI provider (“waiting room”). Recording, transcription, speaker separation and reading back still work; new conversations wait to be analysed.

Price table. In the waiting room and on the tiers without your own key, the app fetches the public price table from the Hintsight proxy at most once a day, so that the paywall and the allowance show the current hours and prices. This request contains no content, no identifier of your device and no sign-in; the proxy only receives the technical connection data such as the IP address (B.5a). With your own key it does not take place.

5a. AI analysis via the Hintsight proxy (Starter, Plus, Pro)#

With the starter allowance (5 hours of conversation once per device) and with the Plus and Pro subscriptions you do not need your own key. The app then sends requests to our relay server, the Hintsight proxy (called “Hintsight server” in the app, api.hintsight.app), which forwards them to OpenAI. We run the proxy from the launch of the starter allowance and subscriptions; the following information describes that operation.

• Operator and location: us (A.1); the server is located in Germany with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, under a data processing agreement pursuant to Art. 28 GDPR. This website is hosted on the same server (A.2).
• Content: the same pseudonymised text as in B.5 (“What is transferred”). Pseudonymisation and the name guard run beforehand on your iPhone; the proxy sees no real names from your list of people. It only passes requests and responses through and neither stores nor logs any content, not even in case of errors.
• Recipient of the content: OpenAI (OpenAI API), USA, as our processor. The proxy decides which model computes. Requests are sent with the setting that OpenAI does not store them for the response (store: false). According to OpenAI, it does not use data from the API for training.
• What the proxy stores about your device: the public key and key ID from Apple's App Attest (they prove that a request comes from a genuine Hintsight app), a counter, short-lived session tokens (15 minutes), the transaction number of your subscription (originalTransactionId, B.5b) and, per request, time, model, number of tokens, costs and the resulting hours used. The proxy does not store your IP address; to limit requests per minute it only uses a short-lived hash.
• Logs: time, shortened device identifier, model, tokens, costs, status and duration, 14 days; no request or response text.
• Price table: the proxy serves the public price table (B.5) without sign-in and without a device identifier. It only processes the technical connection data that every request carries.
• Preventing a second starter allowance: on first launch the proxy uses Apple's DeviceCheck to query two flags that Apple keeps for your device and sets one of them once the starter allowance has been granted. The flags are held by Apple, not by us, and remain after the app is deleted; they reveal nothing about you except “starter allowance already granted”.
• Purpose and legal basis: the AI analysis and the allowance you use with the starter allowance or a subscription (Art. 6(1)(b) GDPR); protection against misuse and cost fraud (Art. 6(1)(f) GDPR, our interest in a secure and affordable service).
• Retention: device data until you choose “Delete all data” in the app (B.12) or 90 days after last use; usage records are aggregated after 13 months; totals without reference to a device as far as tax or commercial law requires.

The limits of pseudonymisation described in B.5 apply in the same way: the text is pseudonymised, not anonymous. With your own key (Hintsight tier), nothing goes through the proxy.

5b. Subscriptions and purchases#

You buy subscriptions (Hintsight, Plus, Pro) and top-ups through the App Store. Apple handles the purchase and payment under its own responsibility (apple.com/legal/privacy). We receive neither your name nor your e-mail address nor your payment data from Apple.

• Receipt: the app sends the proxy the transaction receipt signed by Apple. It contains the product, purchase and expiry dates, a transaction number and the number of the subscription's first transaction (originalTransactionId). The proxy uses it to link your device to your subscription; several devices with the same Apple ID thus share one allowance.
• Messages from Apple: on renewal, change of tier, cancellation and refund, Apple sends our server a signed message (App Store Server Notifications) with the same information.
• Legal basis: Art. 6(1)(b) GDPR (performance of the subscription).
• Retention: for as long as the subscription exists and thereafter as far as statutory retention obligations require.

With the Hintsight tier you continue to use your own API key (B.5); the proxy then only learns that a subscription exists.

6. Voice features (biometric data)#

To recognise who is speaking, the app computes numeric vectors from speech samples. Such voice features may be biometric data within the meaning of Art. 9 GDPR. They are computed, stored and compared only on your iPhone and are never transferred.

• Your own voice profile is created during setup: you speak given sentences for about 30 seconds. It serves to distinguish your voice from others. It is computed and stored only on your iPhone; we do not receive it. The profile is voluntary: you can skip the recording and record or refresh it later.
• Other people's voices only with consent (Germany, Austria, Switzerland, the EU, the EEA, the United Kingdom and US states where all parties must consent; what counts is the jurisdiction chosen in the app): a voice profile of another person is created only if you have named that person and recorded their explicit consent in the app with a date. The app checks this itself every time it stores voice data. Without consent it separates speakers only within one conversation and does not remember anyone else's voice beyond that conversation. Voice data for which consent is still missing (for example after a change of jurisdiction) is not used and is deleted after a period of 14 days. Withdrawing consent deletes the person's voice data immediately.
• Recognise the voices of people who consented: once consent is on record, the app adds to that person's profile from later conversations in which it recognised the person with certainty. The function is on by default and can be switched off under “Your decisions”.
• Recognising unnamed voices exists only in the other jurisdictions (other US states, other countries): there, unknown voices receive a numeric vector and are recognised across several conversations. A voice that you do not name within 30 days is deleted together with its vector. You confirm the function during setup under “Your decisions” and can switch it off there at any time. In the jurisdictions named above it is blocked.
• Recognise people in the moment: at the start of a conversation, the app takes a few seconds of samples of the other voice, matches them on the device against the voice profiles it may keep under the rules above and then discards the samples. A sample is kept only if you confirm that it is the suggested person and, where consent is required, that consent is on record; it then improves that person's profile. This function only runs after you have explicitly confirmed it.

You process the voice features of other people on your own responsibility (B.7). How to remove your own voice profile is described in C.2.

7. Data of other people#

Recording conversations almost always means recording other people as well. Their voice, words, voice features and the statements derived from them are their personal data. The following applies:

• In Germany, the privately spoken word is protected by Section 201 of the German Criminal Code (StGB). You may record others only with their consent. Other countries have other rules; the app shows a note for your jurisdiction, which does not replace legal advice.
• Setup requires you to confirm this before the app may record. Without this confirmation, neither the iPhone nor the Apple Watch records.
• If you use the app exclusively for personal or household purposes, the GDPR generally does not apply under Art. 2(2)(c) GDPR. If you use it for work or business, you are yourself the controller of this data within the meaning of the GDPR and must, among other things, have a legal basis and inform the people concerned.
• Every recording starts with a vibration and a sound, even when the Apple Watch starts by itself. While recording, the recording device shows “Recording”, the iPhone on the lock screen and in the Dynamic Island. The indicator cannot be switched off, the sound only deliberately after a confirmation question. In Germany, Austria, Switzerland, France and the US states where all parties must consent, the watch starts by hand by default; automatic start is only available there once you confirm that you inform everyone present.
• “Quick ask” shows a sentence and a QR code to our information page for conversation partners on the watch and the iPhone. A “Yes” is recorded with its time for the conversation, a “No” discards the recording.
• If someone does not want to be recorded or asks for deletion, you can do this in the app: pause recording, discard the current recording or the last 5 or 15 minutes, delete conversations or periods, forget a person.

We cannot assist data subjects who contact us, because we have no access to your data. We refer them to you.

7a. Circles (sharing via iCloud)#

In a circle, you share part of your memory with other people who use Hintsight, for example your team, a building site or your household. Circles are voluntary. Without a circle, none of this leaves your device, and the app works in full. Circles run on Apple's iCloud. Everyone involved needs an iPhone with Hintsight and an Apple ID with iCloud. We do not run a server for this, and we receive no data from circles.

What is shared

Only what you yourself share with a circle is shared. That can be:

• a project: all shareable statements about the project, including future ones;
• the circle's place: everything shareable you talk about there;
• a topic: in the graph, you share a topic node with “Share with others”. Every shareable statement that hangs on this node goes along, under the node's name. From an answer in “Ask your memory”, the app suggests the topics and projects that the answer's statements hang on; people are offered next to them and are only preselected if the answer hangs on no topic and no project. The app shows these connection points beforehand, and you can deselect individual ones. Anything added later goes along too (“keeps growing”). Statements that are merely similar in content but lack this connection do not go along;
• a fixed selection only when an answer hangs on no node at all: exactly the statements the preview shows at the time of sharing. If you change or delete one of them, it changes for the others too; no new ones are added.

The “Shared” overview at the top of the People tab shows what you share with whom, grouped by circle; you can also withdraw a share there.

New projects are never shared by themselves. Before you share, the app shows under “What the others see” exactly the sentences that will go out. You can “take out” individual sentences at any time; they then stay out until you add them back. For each statement, the circle receives:

• the type of statement, which is only ever a decision, commitment, deadline, fact or open question. Only confirmed statements that are open or done are shared;
• the text of the statement as the preview shows it, without a quote from the conversation;
• the name of the project, the name you give a topic or a selection, or, if you share the place, the name of the circle;
• the time the statement was made and, if there is one, the deadline and the time the statement refers to;
• encounter markers: check values that the app computes with the circle's secret key from the conversation's calendar event, or from the circle's place and a five-minute time window. They contain neither place nor time in plain text. Members can tell from them whether they were in the same conversation and whether a conversation took place at the circle's place.

The members also see your display name as iCloud holds it for your Apple ID, and whether you have accepted the invitation. Invitations are sent through the iOS share sheet (message, mail or link); Apple processes the contact detail you send the invitation to.

Never shared: audio, transcripts, quotes, voice features, coordinates and remembered places, your people list, unconfirmed statements, and concerns, life events, relationships and preferences. Nor your question to the app, its answer, or statements others have shared with you: the app never passes on what you receive from a circle, not even when an answer is based on it.

Send as a message

Instead of sharing in a circle, you can also send the sentences of a preview as a message. The app opens the iOS share sheet for this; you choose the recipients and the channel (such as Messages or Mail) there yourself. What is sent is plain text: the filtered sentences, in which every person other than you is called “someone outside”, and the line “From Hintsight, as of {date}”, and for mail the topic's name as the subject if it passes the name check. The question and the answer are not included. The terms of the chosen service apply to the transmission. The app does not keep a record of what you sent to whom. A message cannot be taken back; the app says so before sending.

Names of other people

Members of the circle appear by name in shared sentences once you have linked them to a person in the app. Everyone else appears by role, such as “the structural engineer”, or as “someone outside”. If a placeholder or any doubt remains, the sentence is not shared. If you remove a person from the app, the app withdraws from every circle all of your shared statements that name this person.

The name of a topic or a selection is checked too: if it contains the name of someone outside the circle, or a name the app cannot match, you can only share after renaming it. The check is repeated at every sync.

Limits: the replacement works with your people list and an automatic method. It can miss a name that is on no list. A role or the content of a statement can also make a person identifiable. Check the “What the others see” preview for this reason.

Recipients

• The members of the circle: everyone who was invited and accepted the invitation. Anyone who joins later also sees what was shared before. Only the person who created the circle can invite.
• Apple as the operator of iCloud: the shared statements are stored in a separate area in the iCloud of the person who created the circle. The app puts the content, project and circle name, times and encounter markers into fields that iCloud encrypts. According to Apple, Apple cannot read these fields. Apple does see who shares a circle with whom, the Apple IDs of those involved, and when and how much is written. Apple also stores the name of the circle unencrypted as the title of the invitation, so choose a name without confidential details. Apple notifies the members' devices of changes with a silent notification that displays nothing. Apple's terms apply to iCloud (apple.com/legal/privacy).
• We receive no data from circles.

What the others can do with your statements

On a member's iPhone, your shared statements are kept apart from that member's own. They never become the member's statements and do not flow into the nightly analysis or into dossiers. The member's app compares them on the device, without a language model, with the member's statements and shows, for example, “understood differently” or a different deadline. In a circle of the “Home” type this comparison only covers conversations both people were in. When a member asks something in “Ask your memory”, the app may include your shared statements in that member's request for AI analysis (B.5, B.5a); it replaces members' names with placeholders. The statements are also part of the member's iCloud device backup if the member uses it (B.10).

There is no access for employers or administrators, no counters and no analysis of individual people, such as who says how much or who keeps their commitments.

Legal basis

You initiate the sharing yourself by creating a circle or accepting an invitation and sharing a project, the place, a topic or a fixed selection. You send a message yourself through iOS. Storage in iCloud is based on your agreement with Apple for iCloud. If shared statements concern other people and the GDPR applies, you need a legal basis of your own for sharing them (B.7). Someone's consent to being recorded does not automatically cover sharing in a circle. At work, the rules on employee data protection and, where applicable, co-determination also apply.

Retention, withdrawal and end

• Withdrawing: if you tap “Stop sharing” on a project, the place, a topic or a selection, take out a sentence, delete a statement, remove a person or leave the circle, the app deletes your affected entries in iCloud. “Stop sharing” takes effect in the app at once; for a few seconds you can undo it, and only then does the app delete in iCloud. The other devices remove the entries at the next sync. Without a connection, the withdrawal waits until you are back online.
• Sync: not in real time, but after the nightly analysis, when the app starts, when you share something or stop sharing it, and when you tap “Sync now”.
• Leaving: anyone who leaves a circle, or is removed by the person who created it, takes their statements with them. If the person who created the circle leaves it, the circle ends for everyone, and its area in iCloud is deleted with all entries.
• Other people's statements stay on your iPhone until they withdraw them or you leave the circle.
• Limits: the app cannot take back what a member read, copied or photographed before the withdrawal, nor a message that has been sent. Copies in members' iCloud device backups remain until those backups are replaced or deleted. If you delete the app without leaving the circle first, your shared statements remain in iCloud and visible to the others. Leave your circles before you delete the app.

8. Apple services#

The app uses functions of iOS and watchOS. Apple may process data under its own terms (apple.com/legal/privacy):

• Speech recognition: Apple's speech recognition runs on the iPhone. iOS downloads the language assets for it from Apple when needed.
• Place name: if “Remember where conversations happen” is on and the position is not at a remembered place, the app asks Apple's map service (MapKit) for the city. The coordinate is sent to Apple for this. This is the only network request of the context functions.
• Location Services for “Hints at places”: iOS monitors the areas around remembered places on the device and tells the app when you arrive at one (B.4).
• Background tasks, Live Activities and MetricKit: iOS controls background processing, the progress indicator for “Process now” and the displays on the lock screen. Through MetricKit, iOS tells the app on the device when it ended a background task; this information only goes into the diagnostic log (B.3).
• Apple Watch: recordings and short voice samples travel from the watch to your iPhone via Apple's WatchConnectivity. The system chooses the transmission path.
• iCloud device backup and iCloud Keychain: see B.10.
• iCloud for circles: only if you use a circle, iCloud stores and distributes the shared statements and notifies the members' devices with silent notifications; see B.7a.
• App Store: when you download and update the app and when you make purchases in the app, Apple processes data under its own responsibility (B.5b).
• App Attest and DeviceCheck: so that the proxy recognises genuine Hintsight apps and grants a starter allowance only once per device, the app creates a key in the iPhone's Secure Enclave and has Apple confirm it (B.5a). This happens on first launch, even if you later choose the Hintsight tier with your own key.

9. Downloading the models#

During setup, the app downloads models for speaker separation, voice matching and search from GitHub (GitHub, Inc., USA) and Hugging Face (Hugging Face, Inc., USA). As with any download, these services receive your IP address and technical connection data. The app sends no other data in the process. The app verifies the models with a checksum and stores them in the app container.

Legal basis: Art. 6(1)(f) GDPR (providing the models the app needs for processing on the device). The providers are based in the USA.

10. Device backup and snapshots#

• iCloud device backup: if you have switched on iCloud Backup for your iPhone, the app's database is included, that is transcripts, statements, people, voice features, context and the diagnostic log. This way everything is available again on a new iPhone. Audio recordings, the search index and the downloaded models are excluded from the backup. Apple's terms apply to the backup. With “Advanced Data Protection for iCloud”, Apple offers end-to-end encryption of backups, which you can switch on in the iOS settings.
• Encrypted snapshots: the app regularly creates a snapshot of the database encrypted with AES-256-GCM. It is stored in the app container on your iPhone and is therefore also part of the device backup. The key for it is stored in your iCloud Keychain so that a new device can open the snapshot. The snapshot contains no audio and not your API key.

A backup does not replace your own backup on a medium you control. The app offers no export in its interface.

11. What the app does not do#

• no analytics or tracking tools, no advertising, no advertising ID;
• no crash reports to us or third parties; the diagnostic log of the background runs stays on your iPhone (B.3);
• no push messages from our server; all visible notifications are created on the device. Only for circles does Apple send silent notifications that trigger a sync and display nothing (B.7a);
• no user account with a name or e-mail address, no password sign-in; purchases only through the App Store (B.5b);
• no access to contacts;
• no sharing or selling of data by us; what goes through the proxy goes only to OpenAI (B.5a). What you yourself share in a circle goes to Apple and the members of the circle, a message to the recipients you choose (B.7a);
• no access for employers or administrators to circles, and no analysis of individual people.

12. Deletion#

In the app you can delete:

• the audio track of a conversation (transcript and statements remain);
• an entire conversation with its recording, transcript and the statements derived from it;
• a day or a period;
• remove a person (their statements remain but lose the attribution) or forget a person (voice data, all statements about them with their evidence, and their words in the conversations are deleted or replaced by “[removed]”).

Statements shared in circles (B.7a) are withdrawn by tapping “Stop sharing” under “Shared”, taking out a sentence, deleting the statement or the person, or leaving the circle. The other devices remove them at the next sync. Deleting the app alone does not remove your entries in iCloud; leave your circles first.

Delete all data. In the settings, “Delete all data” deletes everything at once: recordings, transcripts, statements, people, voice profiles, context, the diagnostic log, the encrypted snapshots, planned notifications, the monitoring of your places and your settings. Beforehand the app shows how much is affected, and you confirm by pressing and holding (with VoiceOver through the button's action). If the app is analysing conversations at that moment, it deletes nothing and asks you to try again in a few minutes; a recording running on the iPhone is discarded. Afterwards the app starts afresh with setup. Your API keys are kept by default; a switch in the confirmation sheet removes them too. First the app asks the Hintsight proxy to delete the data relating to this device (see below); if it cannot be reached, the app waits at most 10 seconds and carries on deleting on the device. If something cannot be removed, such as a snapshot in iCloud Drive, the app says so instead of reporting “deleted”.

Deleting the app from your iPhone also removes the database from the device. In both cases: existing iCloud device backups contain older states until you delete these backups in the iOS settings or they are replaced. Neither “Delete all data” nor uninstalling removes data already held by the AI provider; for that, contact the provider. Neither removes your entries in circles in iCloud; leave your circles first. When uninstalling, the snapshot key in the iCloud Keychain and your API key in the device's keychain may also remain; remove the API key in the app beforehand (B.3). “Delete all data” also leaves the snapshot key in the iCloud Keychain in place; the snapshots it could open are deleted by then.

Data on the Hintsight proxy (B.5a) is deleted by “Delete all data” in the app: key, counter, sessions and usage records relating to this device. If you only delete the app, the proxy removes an unused device by itself after 90 days. What remains are the DeviceCheck flags held by Apple and totals without reference to a device, as far as the law requires. Deleting does not end a subscription; you cancel it in your Apple ID settings.

1. Rights against us#

Insofar as we process personal data about you, that is when you visit the website, when you e-mail us and on the Hintsight proxy (B.5a, B.5b), you have the right under the GDPR to

• access (Art. 15),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20).

To do so, write to support@hintsight.app.

Data in the app is held by you alone. You carry out access, rectification and erasure there yourself (B.12). We know data on the proxy only by device, not by your name; for access we therefore need an indication of which device or subscription is meant, and “Delete all data” in the app's settings handles erasure. You exercise rights against an AI provider with whom you have your own contract (Hintsight tier) directly with that provider.

2. Withdrawing consent#

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal. In the app it works like this:

• Recording: in the settings under Watch and microphone → Recording sources, press and hold the “Consent” row. iPhone and Apple Watch stop recording immediately.
• Voice recognition and recognition in the moment: switch them off in the settings under “Your decisions”.
• Consent of another person to their voice profile: switch off the consent switch on that person; their voice data is deleted immediately (B.6).
• AI analysis: withdraw your consent in the settings under “Your decisions” → “AI analysis”. From then on no text goes to a language model by any route, neither with your own key nor through the proxy; new conversations wait as transcripts. With your own key you can also remove the key.
• Sharing in a circle: tap “Stop sharing” under “Shared”, or leave the circle. The other devices remove your statements at the next sync (B.7a).
• Location, motion, calendar, microphone: switch them off in the app or revoke the permission in the iOS settings.
• Your voice profile and all other data are removed with “Delete all data” in the settings or when you delete the app (B.12); copies in iCloud device backups remain until you delete them or they are replaced (B.10).

3. Complaint to the supervisory authority#

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

4. Further mandatory information#

• Provision of data: you are under no statutory or contractual obligation to provide us with data. Without the technically necessary connection data, the website cannot be delivered; without an e-mail address, we cannot reply.
• Automated decisions: we make no automated decisions within the meaning of Art. 22 GDPR. The app's analyses are suggestions for you and have no legal effect on you.
• Transfers to third countries: only when the models are downloaded (B.9), to the AI provider (B.5), via the Hintsight proxy to OpenAI in the USA (B.5a) and to Apple (B.8, B.5b), and for circles via iCloud (B.7a).

5. Changes to this policy#

We update this policy when the app, the website or the law changes. The current version is always on this page, with its date and version number at the top.

This English version is a translation. The German version is legally binding.