Privacy Policy of Fast Memo

Data Controller

Andrea Losavio - Milan, Italy

Owner's email address: losavio.business96@gmail.com

Write to this address for any question about this policy or to exercise your rights.

Data stored on your device

Your notes, categories and settings are saved on your device. The developer has no copy of them and no access to them. Keep in mind that:

• notes are stored as files on the device and are not encrypted there;
• locking a note hides it behind biometrics or your secret code, but does not encrypt it;
• exported backups are encrypted with the passphrase you choose.

You can delete everything from the App at any time: notes one by one, the trash, or all the App's data from Settings (wipe data). On Android, uninstalling the App also removes its data.

Crash and error reports (Sentry)

When the App crashes or hits an error, it sends a report to Sentry (Functional Software, Inc., USA), which processes it on the developer's behalf on servers in the European Union (Frankfurt). A report contains the error and where it happened in the code, the recent technical events that led to it, the App version, the platform, the device model and operating system. Reports do not contain the content of your notes, and the App does not send your IP address or other identifiers to Sentry on purpose (Sentry's “send default PII” option is off).

• Purpose: finding and fixing bugs.
• Legal basis: the developer's legitimate interest in keeping the App working (Art. 6(1)(f) GDPR).
• Retention: reports are deleted automatically after at most 90 days.

You can object to this processing by writing to the email address above.

Updates and version checks

To keep the App up to date, it contacts these services on its own:

• Expo (EAS Update), by 650 Industries, Inc. (USA), on Android at every launch, to download fixes. Expo receives your IP address, a random identifier created when the App is installed, the platform, and the versions of the App and of the update you have.
• The Fast Memo website (hosted by Vercel Inc., USA), at launch and when the connection comes back, to tell you when a new version is out. It receives your IP address and the App's technical details (user agent); nothing else is sent.
• GitHub (GitHub, Inc., USA), on Windows, macOS and Linux at launch, to check for and download new versions. GitHub receives your IP address.

On Windows, macOS and Linux the App also checks whether you're online by contacting a Google address (gstatic.com) every 30 seconds; Google receives your IP address. The About the developer screen reads the project's star count from GitHub when you open it.

Legal basis: the developer's legitimate interest in delivering fixes and updates (Art. 6(1)(f) GDPR). These services keep their logs according to their own privacy policies.

Cloud Sync (optional)

Cloud Sync is off until you turn it on. It syncs your notes through a service you choose and control: your own Google Firebase project, or your own FastMemo Server. The data goes to that service, never to the developer, and is processed under your agreement with its provider.

Note contents are encrypted on your device before they are sent (end-to-end), with a key protected by your password. Your password and recovery key never leave your devices. What is encrypted and what is not:

• Encrypted: the text of text notes, to-do items, kanban cards, and the code and tab names of code notes.
• Not encrypted: note titles, category names and icons, kanban column names, dates, note settings (such as important or locked), the model and brand of your connected devices, and which note each device has open.

You can disconnect a device, turn Cloud Sync off, or wipe the synced data from the App. The address and credentials of your sync service are stored on your device.

AI assistant (optional, Android)

The AI assistant is off until you turn it on. When you pick a model, the App downloads it once from Hugging Face (Hugging Face, Inc., USA), which receives your IP address and the file requested. After that the model runs on your phone: the notes you use it on are not sent anywhere.

Voice dictation

When you tap the microphone, the App uses your device's speech recognition service to turn your voice into text. On Android this is Google's speech service; on Windows, macOS and Linux it is the one built into the system's web engine. These services may send the audio to their provider's servers (for example Google) to recognise it, under their own privacy policies. The App does not record or keep the audio, and dictation only starts when you tap the microphone.

Webhooks (optional)

If you set up webhooks, the App sends the events you choose to the addresses you enter. For note events the message contains the whole note (title and content) without encryption, so only use services you trust. Webhooks are off until you add an address.

Bug reports from the App

When you send a report from Settings, the App sends:

• the topics you choose, your description and the App version;
• up to 3 images you attach;
• only if you tick the box: your device's brand, name, type, model and operating system version. The device name may contain your name (for example “Mario's phone”).

The report goes through the Fast Memo website (Vercel Inc., USA) and is emailed to the developer with Resend (Resend, Inc., USA), together with the IP address it was sent from in the website's logs.

• Purpose: understanding and fixing the problem you report.
• Legal basis: your request (Art. 6(1)(b) GDPR).
• Retention: as long as needed to handle the report, and no longer than 24 months, unless it is needed to establish or defend a legal claim.

Device permissions

The App asks for a permission only when you use the feature that needs it:

• Microphone and speech recognition: voice dictation.
• Biometrics (fingerprint, face, Touch ID, Windows Hello): opening locked notes.
• Photos (system picker): adding images to notes and to bug reports.
• Network: Cloud Sync, updates, the AI model download, webhooks and bug reports.

The App does not use your location, contacts, calendar or camera, and does not send notifications.

Recipients and transfers outside the EU

Besides the services you choose yourself (Cloud Sync, webhooks, your device's speech service), the data described here reaches only the providers named above: Sentry, Expo, Vercel, Resend, GitHub, Google and Hugging Face. Some of them are based in the United States. Transfers rely on the safeguards of the GDPR: the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for certified companies, or the Commission's standard contractual clauses.

Children

The App is not directed at children under 14 and the developer does not knowingly collect their data. If you think a child has sent a bug report, write to the email address above and it will be deleted.

Your rights

Under Articles 15-22 of the GDPR you can ask the developer at any time to access, correct or delete your data, to restrict its processing, to receive it in a portable format, and you can object to processing based on legitimate interest. Write to the email address above: the request is free and you will get an answer without delay, and within one month at the latest.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.

Changes to this policy

This policy is updated when the App starts handling data differently. Changes are published on this page with the date of the last edit.