Privacy

Privacy Policy – Mamoism Last updated: 22 October 2026 1. Controller and contact Mamoism is developed and operated by: Marco Thiel Mamoism Virgilstraße 31 81673 München Germany Email: info@mamoism.com Marco Thiel is the controller for the personal data processed by Mamoism as described in this policy. Apple, Google and other providers named below may act as independent controllers for data they process for their own purposes under their respective privacy notices. 2. Scope and privacy at a glance This Privacy Policy explains how the Mamoism website, the current Mamoism app for iOS and macOS, account and Cloud services, and contact enquiries process personal data. It is a privacy notice, not a request for consent to all processing merely by visiting the website or using the app. The public copy is available without an access code or sign-in at https://mamoism.com/?document=privacy-policy and is linked in the App Store listing. You can also read the notice inside the app without opening the website or signing in to a Mamoism account. Website availability does not determine access to the app's privacy notice. Website The website provides public information and links without requiring an access code. It does not offer app accounts, purchases, Cloud Sync or a contact form. It uses Cloudflare Web Analytics for aggregate website-use and performance reports, as described in Section 3. It does not include advertising pixels or social-media plugins. Cloudflare also processes operational request, traffic and security data when delivering the website. When its Privacy Policy reader is opened, the website requests public policy text from Google Firebase; see Section 3. Website reading positions and text selections are held only in the running page's memory. A copy of the public policy text is cached locally for availability. Email communication involves STRATO and the sender's email provider; see Section 4. App and Cloud Mamoism can be used locally without creating an account. An account is required if you choose to synchronize a selected catalogue location, use Cloud Sync or use another account-based service. Each iPhone or Mac uses its own system settings for language, date and time formats, calendar, 12/24-hour display and numbers. For currency and regional measurement-unit defaults, Mamoism uses the country of the active catalogue location instead of the device region. Apple provides the formats and units, retaining other supported device preferences. Device formatting settings are not synchronized with your Mamoism account. In the updated iOS release, countdown display and input place the time before the date while retaining the device's date and time formats; that release has no countdown-order setting. Earlier app builds may offer a separate System, Time first or Date first choice, as described in Section 6. If you sign in, a weather and catalogue city you have selected is stored with your Mamoism account and synchronized between signed-in devices. The initial city suggested from the device region is not uploaded merely because you sign in. Synchronization of a selected catalogue location is included with every account plan, does not require a Cloud Data subscription and has no separate Cloud Sync switch. Created content is stored on your device by default. If you sign in, have an active Cloud Data subscription and turn on Sync data across devices, the content described under "Content synchronized when Cloud Sync is enabled" in Section 6 is uploaded to Firebase and synchronized between your devices. Ask is optional. In versions with local Ask, supported requests can be handled on the device by local app code, including calculations and bounded action plans, or by Apple Foundation Models on supported devices. Requests resolved by app code do not invoke an AI model. If cloud processing is needed, Mamoism checks your permission before sending your question and the relevant context to OpenAI through its Firebase backend. This context can include selected text, conversation history, app context and, for a search you request in a version that supports it, text excerpts and source labels from synchronized files or photos. Earlier versions use the cloud path without a local-model step. You can decline cloud sharing and continue using the other app features and available local Ask processing. See Section 9a for details and how to stop sharing. Mamoism does not use personal data for advertising or cross-app tracking and does not sell personal data. The current release does not integrate Firebase Analytics or Firebase Crashlytics. Providers such as Apple and Google may still process operational data for their own services as described in their privacy notices. 3. Accessing this policy and the website Public website copy The public version of this notice is available at https://mamoism.com/?document=privacy-policy without an access code, a Mamoism account or a subscription. Opening that page connects your browser to the website's delivery provider and, when the policy reader requests its current text, to Google Firebase as described below. The in-app reading view is described separately below. Hosting and delivery through Cloudflare The website files are hosted with Cloudflare Pages and delivered through Cloudflare's network. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. The domain is registered through STRATO, while Cloudflare provides the authoritative DNS and website delivery. When the website is opened, the browser sends the visitor's public IP address and ordinary technical request data to Cloudflare. Depending on the request, these data can include the requested address and path, date and time, referrer information supplied by the browser, user-agent and device or system configuration information, and routing, security and response information. Cloudflare processes these data to deliver and cache the requested files, provide DNS and HTTPS, maintain the service, detect and mitigate malicious traffic and produce operational traffic and security information. Cloudflare may process Customer Logs and Network Data for these purposes. Cloudflare's operational traffic and security statistics are separate from the browser-based Web Analytics described below. Cloudflare states that end-user activity logs are stored for a limited period and that the default period is seven days, while particular security, network or legally required records may follow different periods. Current details are available in Cloudflare's privacy and contractual information. The purpose is to provide the website reliably and securely. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the delivery, stability and security of the website. Cloudflare processes personal data on Mamoism's behalf under its Data Processing Addendum, including the transfer safeguards described there. Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ Cloudflare Data Processing Addendum: https://www.cloudflare.com/cloudflare-customer-dpa/ Cloudflare Web Analytics We use Cloudflare Web Analytics to understand overall website use and identify performance problems. Cloudflare adds a JavaScript beacon to the pages delivered by Cloudflare Pages. Browsers load that script from static.cloudflareinsights.com and send its measurements to https://cloudflareinsights.com/cdn-cgi/rum, operated by Cloudflare. These requests involve the ordinary connection data described in the hosting section above. The reports include page views and visit estimates, website host and path, referring website information, browser, operating system, device category, country, and page-loading and interaction-performance measurements. Core Web Vitals cover loading speed, responsiveness and visual stability. Performance diagnostics can also include the relevant page-element selector, resource address or layout measurements. Reports may use sampling and are not a count of identifiable people. The current service does not record URL query strings or provide custom-event tracking. According to Cloudflare, Web Analytics does not use cookies or localStorage to collect its usage metrics, does not fingerprint individuals using IP addresses, user-agent strings or other data, and does not track users across customers' websites. This does not prevent the network requests described above. Mamoism uses aggregate reports rather than individual visitor profiles. Website text selections, reading positions, app-account information and private app content are not added to analytics events. Cloudflare currently provides access to the previous six months of Web Analytics data. Its documentation states that unsampled beacon data is retained for seven days and older data is reduced for longer-term reporting. Cloudflare's operational logs have separate retention arrangements described above. Cloudflare Web Analytics documentation: https://developers.cloudflare.com/web-analytics/data-metrics/data-origin-and-collection/ https://developers.cloudflare.com/web-analytics/data-metrics/dimensions/ https://developers.cloudflare.com/web-analytics/data-metrics/core-web-vitals/ https://developers.cloudflare.com/web-analytics/faq/ Website storage and locally loaded assets The website does not offer app accounts or a contact form and does not include advertising pixels or social-media plugins. Cloudflare Web Analytics is described above. The public website application does not set an access-session cookie or send access codes for verification. Fonts and the bundled text files are loaded from the website itself, not from an external font service. The public Privacy Policy is additionally loaded from Firebase when its website reader is opened, as described below. The website does not upload visitors' text selections or reading positions. It reads the public Privacy Policy from Firestore without creating an app account. Cloudflare delivers the website, Google provides the public policy text, and email providers deliver and store messages. Their processing must be distinguished from the website's local display functions. Records from the former website access gate Earlier restricted website versions used an access-code check and an HTTPS-only session cookie unavailable to page scripts, with a maximum lifetime of eight hours. The public website no longer requests this code, uses that cookie to restrict entry or sends verification requests. A cookie from an earlier visit may remain in the browser until it expires or the site's browser data is cleared. Earlier verification attempts could create limited security records in Firebase: a keyed cryptographic hash derived from the request's IPv4 address or IPv6 /64 network prefix, failed-attempt counts and times for blocking or expiry. These application records did not contain the raw IP address or entered code. Removing the website gate does not itself erase existing records; they may remain until server-side cleanup removes them. Provider-held operational logs are separate. The purpose of that earlier processing was access protection and abuse prevention, based on Mamoism's legitimate security interests under Article 6(1)(f) GDPR. Privacy Policy in the app and public browser copies The current app release displays the policy text bundled with the installed app. Opening its policy reading view does not request the website or a remotely cached policy. It works without a Mamoism account, subscription or network connection. The last-updated date identifies the installed text. Changes to the public website or its shared policy document do not automatically replace this bundled app copy; an updated app release is needed to deliver a revised bundled notice. In earlier versions with a separate Ask permission dialog, its policy link also opens the bundled text. The website's policy reader separately requests a public policy text document from Cloud Firestore, a Google Firebase service. Google receives the public IP address, the requested document address and ordinary technical connection and request data, such as the time and browser information. The website sends no Mamoism sign-in token, cookies, referrer, private user content, text selection or reading position with that policy-text request. The website caches its most recently downloaded public policy text in browser local storage. That cache contains the public text, not a visitor identifier or reading history. It can be removed by clearing the website's browser data. A cached or downloaded copy older than the website's bundled notice is not used in place of that notice. If the current text cannot be downloaded, an eligible cached or bundled copy remains readable; its last-updated date identifies that version. An already open reading view stays unchanged until reopened so that a background update does not interrupt reading or text selection. Some earlier app versions may refresh their local policy copy from the same public Firebase document using their existing Firebase connection. That connection may include a sign-in token if the user is signed in and app-integrity information. Those versions may store the public text in app preferences and show a cached or bundled copy when offline. Other earlier versions use only their installed bundled text. The date shown in each copy identifies the version being read. The purpose is to provide an accessible privacy notice and keep it available during connection failures. The legal bases are Article 6(1)(c) GDPR for providing legally required privacy information and Article 6(1)(f) GDPR for reliable and secure delivery. Google's processing and applicable safeguards are described in Sections 10 and 13 and in Privacy and Security in Firebase: https://firebase.google.com/support/privacy Website Night Mode, reading positions and text selection The red Night Mode uses only the local clock on the visitor's device. It is enabled from 23:00 until before 04:00 and checked again while the page is open and when the visitor returns to it. This deliberately narrow late-night window is not a calculation of sunrise or sunset and cannot guarantee darkness everywhere or throughout the year. The website does not request GPS access, perform IP-based location lookups or contact an external service for Night Mode. The device time is used locally and is not transmitted by this feature. The reading position of each document and the current text selection are kept only in the running page's memory. They are lost when the page is reloaded or closed and are not sent to a server. Navigation containers open their destination when tapped, including when their text is tapped. Outside these containers, tapping an unselected word selects it or extends the current selection; this does not copy text. Tapping an already selected word copies the entire selected range to the device clipboard and clears that selection after successful copying. The standard keyboard Copy command also copies the selected text. The website does not read existing clipboard contents. Any clipboard synchronization provided by the operating system follows the visitor's device settings. The website's device-time Night Mode is separate from the app's catalogue-location and environmental-data features in Sections 5, 6 and 9. Website external links The App Store button is an external link. No data are sent to Apple through this link until the visitor activates it. After activation, the browser connects to Apple, and Apple receives the public IP address and other technical connection data. Apple's own privacy policy applies to that visit. The link is provided so visitors can access the Mamoism app. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is making the app available. Apple Privacy Policy: https://www.apple.com/legal/privacy/ Opening other external addresses connects to the relevant provider. Merely reading their addresses here does not make those connections, and selecting an address in this policy does not open it. The website reader's separate request to Firebase for the policy text itself is described above. Google Privacy Policy: https://policies.google.com/privacy 4. Website and app: contact by email The Contact button opens the visitor's own email application using a mailto link. Merely opening the link does not send a message or form data to Mamoism. If a visitor sends an email to the address listed in Section 1, Mamoism processes the sender's email address, name where provided, message content, attachments and technical email metadata for the purpose of answering and handling the request. The legal basis is Article 6(1)(b) GDPR where the message concerns a contract or steps before entering into a contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR; the legitimate interest is responding to legitimate enquiries and providing support. Article 6(1)(c) GDPR applies where retention is required by law. Emails are retained only for as long as necessary to deal with the request and maintain necessary support records, and are then deleted, unless legal retention duties or the establishment, exercise or defence of legal claims require longer storage. Emails are not used for newsletters or advertising without separate consent. The receiving mailbox for the email address in Section 1 is provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes message content, attachments, sender and recipient addresses and technical email metadata as necessary to receive, filter, transport and store messages. The sender's email provider also processes the message under its own terms. Emails are therefore processed and stored on mail servers; they are not submitted through or stored by this website. If Mamoism later configures forwarding or synchronization through another provider, that provider will also process the forwarded or synchronized messages. Any material change will be reflected in this policy. STRATO Privacy Notice: https://www.strato.de/datenschutz/ STRATO Data Processing Agreement: https://www.strato.de/agb/avv/ This section applies to enquiries about both the website and the app. 5. App: data stored on your device Depending on the features you use, Mamoism stores the following data locally: - countdowns you create, including titles, sub-events, dates, times and recurrence settings; - text files you create, including their titles and full text; - saved public countdowns and organizational information such as Created containers, titles, order and deletion state; - your Mamoism display name, selected or app-default catalogue location, app preferences, playback progress, storage-usage display and cached public event or chart data; - local notification and alarm information, including a title and scheduled time; and - where such file types are available or already present, imported image, video and audio files and related metadata such as file name, type, size, duration or aspect ratio. The selected or app-default catalogue location contains a country, region, city, that city's fixed coordinates and its time zone. Mamoism does not request or use your device's GPS location. On first use, the operating-system region code may be used locally to choose a default city. The region code itself is not included in account-preference synchronization. Local data is kept in the app's storage area and ordinary app preferences. Depending on your Apple device and backup settings, Apple may include some local app data in an iCloud or device backup under Apple's own terms. 6. App: account preferences and optional Cloud Sync Account data If you sign in with Apple or Google, Firebase Authentication creates a Mamoism account. Mamoism and Firebase may process: - a unique Firebase user ID; - the sign-in provider connected to the account; - your email address, which may be an Apple private-relay address; - your name or display name if the provider supplies it; and - authentication, security and technical request data such as tokens, IP address and user-agent information. Mamoism does not receive your Apple Account or Google Account password. Apple, Google and Firebase handle the sign-in credentials. Sign in with Apple is requested with name and email scopes; you can use Apple's Hide My Email feature. Google states that its Sign-In SDK for iOS and macOS may collect a user identifier to record authorized sign-ins and an IP address that may be used to estimate a device's approximate location for fraud prevention. This is separate from Mamoism's manually selected catalogue city and does not require GPS access. Google's SDK privacy declaration also identifies names, email addresses, phone numbers, account and device identifiers, other account or technical data, and usage information. Google declares app-functionality and analytics purposes for these data, depending on the type. Mamoism does not request a phone number for its own account profile. Google's Privacy Policy governs processing for Google's own purposes. See Google's Sign-In data disclosure: https://developers.google.com/identity/sign-in/ios/app-privacy Catalogue location synchronized after sign-in When you have selected a weather and catalogue city, Mamoism stores its stable continent, country, region and city catalogue identifiers in Cloud Firestore and synchronizes the selection between devices using the same Mamoism account. The record also contains a schema version and server-side last-updated time. A selection made before signing in can be uploaded on sign-in if the account does not already have a location preference. An existing account selection can be restored on another signed-in device. The initial city suggested from the operating-system region is local and does not create an account-location record merely because you sign in. The country of the active catalogue location is used locally for currency and regional measurement-unit defaults, including after a location is synchronized from another device. Apple provides the formats and units, retaining other supported device preferences. Date and time formats, calendar, 12/24-hour display and number formats continue to follow each device's system settings; those settings are not synchronized. The location does not change the general display time zone. The updated iOS release places the time before the date. The operating-system region code itself, GPS data, live device location, fixed coordinates and the time zone are not uploaded for account-preference synchronization. Coordinates and the time zone are instead resolved from the app's bundled catalogue on each device. This selected-location synchronization is included with every account plan and has no separate Cloud Sync switch. Signing out stops it on that device but does not delete the account copy. Without an account, the selection remains device-local. See Section 11 for retention and deletion options. The updated iOS release does not read, store or synchronize a countdown-order preference. Countdown display and input use the fixed time-then-date order on every device, including when signed out. Any countdown-order records stored by earlier versions are ignored; see Section 11 for retention and deletion options. Countdown-order preferences in earlier app builds Earlier iOS or macOS builds that offer System, Time first and Date first store that selection locally. After sign-in, those builds may synchronize the explicit selection with the same Firebase account, together with a schema version and update time. This is an account preference, does not require a Cloud Data subscription, and does not upload the device's other regional formats. In those builds, Delete all data removes the account preference and resets the local choice to System. The updated iOS release no longer offers or synchronizes this preference. A still-installed earlier build can continue using it until updated or signed out. Content synchronized when Cloud Sync is enabled Cloud Sync is optional. It is available only for the authenticated Mamoism account associated with an active Apple subscription and only after you turn it on. When enabled, Mamoism stores the following in Cloud Firestore and Cloud Storage for Firebase: - saved-countdown identifiers and automatic-save groups; - created countdowns, their titles, sub-events, dates, times and recurrence; - full text-file contents and titles; - Created container and title structure; - imported audio file contents, together with track titles, duration, file type, size and storage identifiers; - ordering, modification and deletion metadata; - storage usage and quota information. When Cloud Sync is enabled, original audio files are uploaded without re-encoding and downloaded into local app storage on your other signed-in devices. Downloaded files remain available locally when you are offline or Cloud access ends. Audio cover photos and videos remain device-local. For ordinary Created photo and video collections, standard builds do not upload or download the media file contents through Cloud Sync; their container and title structure can still be synchronized. The separately enabled Synchronized source mirroring described in Section 9a can include supported image and PDF files from connected sources. Private Cloud content is protected by account-based access rules and is not made public. It is used to provide synchronization, restore content on another device, enforce the storage allowance and resolve changes or deletions between devices. When your subscription is active, tapping Sync data across devices opens Apple subscription management. Cancelling stops automatic renewal; synchronization remains available until the paid subscription period ends. Signing out stops synchronization on that device, and an expired subscription prevents it. These actions do not delete data already stored in the Cloud. See Section 11 for deletion options. 7. App: Cloud Data subscription and Apple payments Mamoism offers an optional monthly, automatically renewing Cloud Data subscription through Apple's in-app purchase system on iOS and macOS. The subscription enables optional Cloud Sync with a current storage allowance of 10 GB (10,000,000,000 bytes) per Mamoism account. Local countdown and text creation is not limited by the subscription. The applicable price, currency, renewal period and purchase terms are displayed by Apple before purchase. Apple processes the payment. Mamoism does not receive or store your card number, bank details or other payment-method credentials. To verify, restore and manage Cloud access, Mamoism sends Apple-signed transaction evidence to its Firebase backend and processes pseudonymous subscription information, including: - the product identifier; - an App Account Token associated with your Mamoism account; - original and latest transaction identifiers; - purchase, expiration and revocation dates; - subscription environment and status; and - Apple server-notification and verification metadata. After you sign in on iOS or macOS, Mamoism may create and store an App Account Token and related purchase-context record before you make a purchase. This lets Mamoism associate a later StoreKit transaction with the correct Mamoism account and helps prevent a transaction from being assigned to more than one account. The backend processes the complete signed transaction for verification, but Mamoism's application code stores only the extracted entitlement metadata, not the complete signed payload. Deleting your Mamoism account does not cancel an Apple subscription. You must manage or cancel it separately in your Apple Account subscription settings. Apple keeps its own purchase and payment records under its App Store & Privacy notice (https://www.apple.com/legal/privacy/data/en/appstore/). 8. App: notifications and alarms If you enable a reminder or alarm, Mamoism requests the relevant operating-system permission and schedules it on your device. Mamoism does not use a remote push-notification service for countdown reminders. The local reminder record is not separately uploaded as a notification record. However, if Cloud Sync is enabled, the underlying countdown title and time from which a reminder is created can be synchronized as part of that countdown. You can withdraw notification permission in your device settings and remove scheduled reminders in Mamoism. 9. App: public data and external links Mamoism downloads public events, releases, charts and other informational data from its Firebase backend. Normal requests may expose technical information such as an IP address, app or device-attestation data and request timestamps to Firebase. Viewing public data does not upload your private countdowns or text files. Firebase SDKs also collect technical diagnostic information about the SDK and platform environment for provider analytics. Firebase describes its user-agent information as unlinked to a user or device identifier. Separately, Mamoism's backend can record Cloud upload errors with account-linked storage paths to diagnose failures and protect storage consistency. This provider analytics exists even though the current release does not integrate the Firebase Analytics or Firebase Crashlytics products. For location-based environmental charts, Mamoism sends the selected catalogue country, region, city, fixed city coordinates and time zone to a Firebase Cloud Function. These are catalogue coordinates, not a live GPS reading. The backend uses the coordinates to request weather and air-quality data from Open-Meteo. It does not send your Firebase user ID or private files to Open-Meteo. Open-Meteo may process API request logs under its Terms & Privacy notice (https://open-meteo.com/en/terms). Other public-data sources are generally contacted server-to-server by Mamoism's backend without your account ID or private content. If you choose to open a third-party source or support link, the destination website receives ordinary browser and network information under its own privacy policy. The app's Privacy Policy displays the bundled notice as described in Section 3. If you separately open the public copy on the Mamoism website, the website processing in that section applies. 9a. App: Ask and ChatGPT Local Ask and cloud processing Ask can provide an AI-generated answer or propose a supported app action, such as creating a text file or starting a timer. The app validates and executes supported actions through its existing controls. Availability depends on the installed app version, device, language and enabled features. Cloud requests require a signed-in Mamoism account and an internet connection, but not a Cloud Data subscription. Ask data sharing is separate from Cloud Sync. In versions with local Ask, app code can resolve supported calculations and bounded action plans without an AI model. Other locally supported requests can use Apple Foundation Models on supported iPhones and Macs. Neither local route sends the request or its context to OpenAI. Local processing can be unavailable or unsuitable because of operating-system, model, language, task or context limits. Ask can then use OpenAI through Mamoism's Firebase backend, subject to the permission described below. A local model safety refusal is not retried through OpenAI. Account, synchronization and public-data services have their separate data flows even while an Ask request is processed locally. Earlier app versions may use the OpenAI-backed cloud path without a local-model step. Existing ChatGPT conversations keep their cloud processing; local Ask does not make those conversations local. Separately enabled development services, including Codex, retain their own provider routes. Where Object generation is available, the Object input uses the same OpenAI sharing permission to interpret your description and refinements. It sends the submitted description, a bounded clarification history and the current saved design dimensions through Firebase to OpenAI, with a pseudonymous account identifier. The private CadQuery service receives only validated geometry parameters and returns new GLB and STEP files. Descriptions and clarification text are temporary and are not saved by Mamoism; the resulting files and dimensions are stored locally, without Object Cloud Sync. You can type stop sharing into Object to withdraw permission for future requests. A generated model does not establish manufacturing or ordering eligibility. Permission before cloud requests Before the first cloud request on a device, Mamoism asks you to allow sharing with OpenAI. Local Ask processing and local search do not require this OpenAI permission. In versions with the inline permission flow, the question appears in the answer area while your original message is held locally. Reply yes, ja or sí to allow sharing; no or any other reply declines. These replies are interpreted on the device, without AI or a server request. Only an affirmative reply allows the original message to be sent; the permission question and your permission reply are not included in the OpenAI request. After declining, a later request that needs cloud processing asks for permission again. Requests that can be completed locally can still use that local route. In the current Ask flow, this general permission alone does not send a request. Before each actual transfer to OpenAI, Ask shows your original question and the categories of context prepared for that answer, including a notice that they may contain sensitive information such as health data. Reply An OpenAI senden, Send to OpenAI or Enviar a OpenAI to give your explicit consent for OpenAI to process that captured question and context, including any special-category data, solely to answer or plan the supported action requested in that question. No or any other reply declines it. The prepared request remains in app memory while you decide. Approval applies only to that captured request; changes to the account, sharing permission, session, relevant source or target invalidate it. Another provider call requires another approval. Local answers and local model safety refusals do not show this transfer request. This additional Ask approval is not saved or synchronized, and its prompt and reply are not added to the provider conversation. Acceptance is recorded locally on that device for the current AI data-sharing notice version and is not synchronized with your account. Versions that add sharing of synchronized-source excerpts and source labels require renewed permission if only an earlier sharing version was accepted. Type stop sharing into Ask or the ChatGPT message input to withdraw permission for future requests from that device. Earlier app versions use a separate Allow/Cancel dialog and provide withdrawal under Action > Toggle > Device > AI data sharing > Stop sharing. After withdrawal, Mamoism asks again before another cloud request. Withdrawal does not undo processing of requests you already sent, delete saved content or automatically erase provider-held records. Context used and data sent Depending on the request, installed version and enabled features, Ask can use the following context for local processing and, with your AI data-sharing permission and the individual transfer approval described above, cloud Ask processing: - your current question, bounded recent Ask conversation history and text selected before opening Ask; - the name and relevant text, URL, event details or current state of a supported file or resource from which you opened Ask; - the device's local date and time, app language, available folder types, and a limited catalog of relevant folder names and identifiers and supported series or Generated content, including the selected catalogue country where relevant; - where an enabled development feature requires it, relevant research or news-feed subjects, preferences and resource identifiers; - for a requested synchronized search in a supported version, the bounded excerpts and source information described below. Directly selected text takes precedence over inferred selection context. Selection context is limited to 6,000 characters in total and may be shortened further to fit request limits. That selection can remain context for further questions until you close Ask. Merely selecting a link does not download its linked page. On the cloud path, this text and context pass through Mamoism's authenticated Firebase Cloud Function to OpenAI. When continuing an existing ChatGPT conversation, the included earlier conversation is also sent as context. The backend sends a pseudonymous identifier derived from your Firebase account ID to OpenAI for abuse prevention. This identifier can link requests from the same account; it is not anonymous. Mamoism does not separately send your account email or display name to OpenAI, although personal information contained in your submitted text, context, folder names or source labels is included. Requested searches in synchronized sources In versions that support synchronized search, a direct search instruction can cause Ask to search locally accessible files, photos and PDFs from your existing synchronized sources. These are the sources exposed by Mamoism's separate Synchronized source feature: folders you authorize on a Mac, still images available through the Photos permission you grant on iPhone, and readable account-scoped copies received from those sources. Ask searches only content accessible through that feature and its existing permissions. Connecting a source alone does not enable cross-device mirroring. Mirroring supported source files, including images and PDFs, requires the separate cross-device option for synchronized sources, which is off by default, enabled Cloud Sync and confirmed Cloud access. When enabled, supported source files and their folder/file metadata are stored in your account's protected Firebase storage and synchronized to your other devices; the Cloud retention and deletion rules in Section 11 apply. This source mirroring is separate from synchronization of ordinary Created content described in Section 6. An Ask search does not turn mirroring on. Neither source access nor either synchronization setting gives permission to send content to OpenAI. File-name matching, text extraction and optical character recognition (OCR) take place on the device. The search index and progress are held in bounded app memory and rebuilt as needed after a restart. Source files are read, not changed by the search. Search coverage can be partial; the answer identifies incomplete coverage. A file-name match alone is not evidence of that file's contents. Relevant text can be included in the local model input and, with AI data-sharing permission and individual Ask transfer approval, an OpenAI request. The retrieved-source block of each request includes at most six source excerpts, with up to 1,200 Unicode characters per excerpt and 6,000 in total. Source information can include a request-specific label, file name, relative location, source version, file kind, extraction method and PDF page number, together with search-coverage counts and status. These labels and excerpts can themselves contain personal information. Raw image or PDF files, native access bookmarks and absolute filesystem paths are not attached to these AI requests. File-name-only or no-result responses can be produced locally without a model request. The source-access and mirroring controls described above remain independent of the AI request. Inline images from camera or gallery input are not sent as image attachments by the current Ask text-request path. This is separate from extracting text locally from already accessible synchronized photos. Ask does not automatically attach audio recordings, contacts or live device-location data. Avoid submitting, selecting or including information you do not want to share with the provider, including personal information about other people. Sensitive personal data Health information, including medical reports or blood-test results, and other special categories of personal data require additional protection. Mamoism does not require such data for general Ask use. The current Ask transfer approval described above explicitly covers the prepared question and context, which may include sensitive information, for that answer only. It does not authorize subsequent transfers or other people's data on their behalf. Declining leaves that request on the device. The general sharing permission alone is not this individual approval. Older Ask versions and the separate ChatGPT, Object and development-service flows do not provide this additional per-transfer Ask approval; do not include health or other special-category data in those general sharing flows. Purposes, storage and retention The purpose is to provide the answer, requested search or supported app action. Local processing necessary to provide the requested service is based on Article 6(1)(b) GDPR. Sharing submitted content and context with OpenAI is based on your consent under Article 6(1)(a) GDPR. If an individually approved Ask transfer includes health or other special-category personal data, that processing additionally relies on your explicit consent under Article 9(2)(a) GDPR for the specific request described above. Authentication, usage limits and abuse prevention serve Mamoism's legitimate interest in operating a secure and sustainable service under Article 6(1)(f) GDPR. The Ask overlay holds its current interaction in the running app session; it does not automatically save it as a cloud conversation. If you ask Ask to create or save a text file, or copy an answer into a file, the ordinary local-storage and optional Cloud Sync rules apply, including to source references saved in that file. Existing saved ChatGPT conversations follow those text-file rules. Where enabled in verified development installations, persistent research and news-feed actions can store their subjects, configuration and results locally or in the backend and use the relevant provider services for later research. These saved resources have a lifecycle separate from the temporary Ask overlay. Mamoism's Ask request handler does not intentionally store or log question, answer or retrieved-excerpt text on its server. It maintains aggregate usage budgets and can record response kinds, action types, development-feature admission flags, a pseudonymous account identifier and fixed failure codes for operation and troubleshooting. Firebase may separately keep technical request and security logs under its own retention rules. Local Ask diagnostics Versions with local Ask diagnostics keep up to 128 recent processing measurements in app memory to assess reliability, processing routes and performance. They contain fixed categories such as local or cloud route, fallback reason, action type without its arguments, outcome, call-attempt flags and elapsed durations. They exclude questions, answers, OCR or file contents, file names, locations, account or action identifiers, calendar timestamps and raw error text. These measurements are not uploaded by this diagnostics feature and the in-memory history ends when the app process ends. Verified Developer installations also keep a bounded snapshot of these measurements in the local app-support directory. A new snapshot replaces the previous one; it is not an indefinitely growing log. The last snapshot can remain after the app closes until it is replaced or deleted from local app storage. Ordinary production, Store and TestFlight installations do not create this additional diagnostic file. These local measurements are separate from the Firebase operational logs described above. Development quality checks use fixed artificial cases rather than real questions or private files. OpenAI storage and international processing Mamoism requests OpenAI responses with response storage disabled. This is not a promise of zero retention. OpenAI states that API content is not used to train its models by default. Its abuse-monitoring records may include prompts, answers and related metadata and are normally kept for up to 30 days, with longer retention where required by law or reasonably needed to prevent harm. Deleting a Mamoism account or local answer does not automatically remove provider-held security records. OpenAI may process data outside the European Economic Area, including in the United States. Mamoism does not promise EU-only processing or zero data retention for these requests. The applicable service and data-processing terms describe the transfer safeguards. Further information: https://developers.openai.com/api/docs/guides/your-data https://openai.com/policies/privacy-policy/ https://openai.com/policies/data-processing-addendum/ 10. Service providers and recipients Website hosting and email - Cloudflare: Cloudflare Pages, authoritative DNS, HTTPS, caching, traffic delivery and website-security services. Cloudflare processes the request, traffic and security data described in Section 3 as Mamoism's processor. Cloudflare may also process Network Data for its own network-operation and security purposes as described in its privacy information. - STRATO: domain registration and the mailbox listed in Section 1. STRATO processes email and technical delivery data as described in Section 4 and acts as a processor where it handles personal data on Mamoism's behalf. The website also uses Google/Firebase for its public Privacy Policy reader. Website visitors do not sign in to the app's Firebase account services. Section 3 describes this processing and the limited security records that may remain from the former access gate. App and Cloud providers Mamoism uses the following providers where necessary: - Google/Firebase: Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Firebase App Check. Google generally acts as a processor for Mamoism's Firebase customer data. See Privacy and Security in Firebase (https://firebase.google.com/support/privacy) and Google's Privacy Policy (https://policies.google.com/privacy). - Apple: Sign in with Apple, StoreKit and the App Store for subscriptions, App Attest or DeviceCheck for app-integrity checks, operating-system notifications and any Apple-controlled backups. See Sign in with Apple & Privacy (https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/) and Apple's Privacy Policy (https://www.apple.com/legal/privacy/). - Google Sign-In: if you choose Google as your sign-in provider, Google processes the authentication request under Google's Privacy Policy (https://policies.google.com/privacy). - Open-Meteo: selected catalogue coordinates and a time zone are used for weather and air-quality API requests as described in Section 9. - OpenAI: submitted text, included conversation and app context, requested synchronized-source excerpts and source information where supported, and a pseudonymous account identifier for optional cloud Ask and ChatGPT processing, plus submitted Object descriptions, refinements and saved design dimensions where Object generation is available, only after the permission described in Section 9a. Local Apple Foundation Models processing does not send these inputs to OpenAI. Personal data may also be disclosed where required by law, to protect legal rights or security, or to professional advisers and technical providers who are subject to applicable confidentiality and data-protection obligations. Mamoism does not disclose private content to advertisers or data brokers. The current in-app Privacy Policy is bundled with the installed app. The public browser copy is available on the Mamoism website, as described in Section 3. 11. Retention, deletion and your controls Website data Website reading positions and text selections disappear when the page is reloaded or closed. A cookie from the former access gate expires within its original eight-hour maximum lifetime; remaining security records and Cloudflare's operational retention are described in Section 3. The public policy-text cache remains until replaced or the site's browser data is cleared. Email retention is described in Section 4. These browser-memory limits do not apply to app content, Cloud data or provider-held records. Local data Local content remains on your device until you delete it, use Delete all data, or remove the app's local container. Apple-controlled backups may follow separate retention rules. Deleting your Mamoism account removes the ordinary account profile, Cloud content, active access and subscription records, and Firebase Authentication account, subject to the limited security and subscription-integrity records described below. It does not automatically erase the countdowns, text files and other content still stored locally on that device. To remove both local and Cloud content, use Delete all data before deleting the account, or remove the remaining local data from the device afterwards. Cloud-held data The synchronized catalogue-location selection remains associated with your account until it is replaced, removed through Delete all data, or the account is deleted. Signing out stops synchronization on that device but does not delete the account copy. After Delete all data, the initial suggested city remains local until a catalogue location is selected again. A selection that remains on another signed-in device may be synchronized again. The updated iOS release continues to use the fixed time-then-date order. The updated iOS release does not read, update or synchronize any display-format or countdown-order preference records stored by earlier versions. Any such legacy account records may remain until Delete all data or Delete account removes them. Cloud content remains associated with your account after you sign out or a subscription ends. Deleting an individual synchronized entry removes it from the active synchronized content and retains a deletion marker to prevent unintended restoration by another device. Uploaded files can remain in Cloud Storage after their synchronized entry is deleted or replaced. This applies to uploaded audio, synchronized-folder files and media wherever those uploads are enabled, including files uploaded by earlier versions. Mamoism currently retains these objects to avoid deleting a file that another device or an explicitly restored record still references. There is currently no automatic age-based cleanup or fixed maximum retention period for these retained objects. They are removed when Delete all data or Delete account successfully completes. Disabling synchronization does not delete existing local or Cloud files. Delete all data requires recent authentication. It is designed to cancel Mamoism notifications and alarms, clear the current release's ordinary local content and settings, reset local app settings and the catalogue-location selection, and remove the account's synchronized user-created content and account preferences, including legacy preferences, from Firebase. It keeps the Firebase account, subscription, Cloud Sync preference and limited account, security and entitlement records. Delete account requires recent authentication. Mamoism revokes the Sign in with Apple authorization when Apple is connected, or disconnects a Google-only sign-in, then deletes the account-bound Cloud content and Firebase Authentication account. It does not cancel the Apple subscription and, as explained above, does not currently erase the device's remaining local content. After account deletion, Mamoism retains only limited records where needed for security and subscription integrity. These currently include a deletion-completion marker containing the former Firebase user ID, and Apple transaction or App Account Token lineage records from which the Firebase account association is removed. Limited processed Apple server-event and transaction records may also remain without a Firebase user ID. These records are used to prevent stale writes, transaction replay or conflicting subscription ownership, to process later Apple lifecycle events and to support legitimate purchase restoration. They are kept for as long as reasonably necessary for those purposes or a legal obligation; no fixed maximum period is currently promised. Firebase may retain authentication data, request logs and backup copies for provider-controlled periods after deletion. Firebase publishes current examples of those periods in its privacy and security documentation (https://firebase.google.com/support/privacy). Apple retains its own purchase records independently under its App Store privacy notice. Email retention is described in Section 4. 12. Legal bases under European data-protection law Where the GDPR applies, Mamoism uses the following legal bases for the stated purposes: - delivering and securing the website and providing external app links: Article 6(1)(f) GDPR; the legitimate interest is providing a secure, functioning information website and making the app available; - providing local app functions that you request, your account and its selected catalogue-location synchronization, optional Cloud Sync and subscription access: performance of the contract with you or steps you request before entering it; - Firebase App Check, authentication security, fraud and replay prevention, storage-limit enforcement, synchronization consistency, troubleshooting and necessary operational logs: Mamoism's legitimate interests in operating a secure, reliable and abuse-resistant service; - responding to support and privacy requests: performance of the contract where the request concerns the service, compliance with data-protection law, or Mamoism's legitimate interest in providing support and protecting legal rights, as applicable; - retaining or disclosing limited information where the law requires it: compliance with a legal obligation; and - any optional processing for which Mamoism separately asks for consent: consent. Local notifications additionally require the operating-system permission that you control in device settings. You may withdraw consent at any time for future processing. This does not affect processing that was lawful before withdrawal. A service may stop working where the withdrawn permission is necessary for that service. 13. International processing Some processing may take place outside your country or the European Economic Area. Mamoism's Cloud Functions are configured in a European Google Cloud region, but not every service is necessarily processed there. In particular, Firebase states that Firebase Authentication is operated from US data centers and that other Firebase services can use global infrastructure. Where required, Mamoism relies on the transfer mechanisms and safeguards made available under its agreements with the relevant provider, such as contractual safeguards or an applicable adequacy framework. More detail is available in the linked Firebase, Google and Apple privacy information. You may contact Mamoism for further information about safeguards applicable to a particular transfer. Cloudflare operates a global network and states that website traffic is generally processed at network locations near the visitor, while limited metadata may be processed in the United States and Europe. Cloudflare's Data Processing Addendum incorporates the EU Standard Contractual Clauses and describes additional safeguards for restricted transfers. STRATO provides the receiving mailbox from Germany; a sender's own email provider or a future forwarding destination may process messages in other countries under its own arrangements. The app's European Cloud Functions region is not a statement about where website or email data are processed. 14. Security The website is delivered over HTTPS through Cloudflare. For its app and Cloud services, Mamoism uses HTTPS, Firebase account-access rules, server-side subscription and quota checks, and Firebase App Check. On supported Apple devices, App Check uses Apple App Attest with a DeviceCheck fallback. Firebase states that the services used by Mamoism encrypt data in transit and relevant stored data at rest. No storage or transmission method can guarantee absolute security. You should protect access to your device, Apple or Google sign-in account and Mamoism account. 15. Your rights Depending on applicable law, you may have rights to information, access, correction, deletion, restriction, data portability, objection and withdrawal of consent. You may also lodge a complaint with the data-protection authority responsible for your place of residence or work. The European Commission (https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en) provides an overview of GDPR rights. To exercise a right or ask a privacy question, use the contact address in Section 1. Mamoism may need to verify that the request relates to your account before acting on it. Mamoism does not use your personal data for solely automated decisions that produce legal or similarly significant effects. These rights apply to processing for which Mamoism is responsible. Requests concerning a provider's independent processing may also need to be directed to that provider. 16. Required data Providing personal data through this website is not a statutory or contractual requirement. The technical processing of an IP address is unavoidable when a website is requested. The public website and privacy notice require no access code, app account or access-session cookie. Reading the bundled in-app policy also works without a network connection. The red Night Mode, reading-position memory and text selection work locally without a location lookup or an app account. Sending an email is voluntary; without a reply address, Mamoism may be unable to answer an enquiry. The app can be used locally without an account. Account-based features require the account and technical information described above. Optional content synchronization additionally requires the relevant subscription and Cloud Sync setting. 17. Changes to this policy This policy may be updated when Mamoism's website, app features, providers or legal obligations change. The date at the top will be updated. If a change materially affects how personal data is processed, additional notice will be provided where required by law. The combined notice is available under Privacy Policy in the Mamoism app and at https://mamoism.com/?document=privacy-policy, which is linked in the App Store listing. The app's bundled policy display does not depend on website availability. The bundled app copy and cached or bundled website copies described in Section 3 carry their own last-updated dates.