Privacy Policy
Draft notice. The operator's legal entity name and governing
jurisdiction have not been filled in yet (legal.entityName, legal.governingLaw in
site.config.json). Everything else in this policy describes the app as
it actually behaves.
The short version.
- Your speech is turned into text on your device. Fennec never stores an audio recording.
- Your tasks and messages are stored in your account so they sync across your devices.
- The text of a message is sent to an AI provider to pull the tasks out of it. Your name, email and account ID are not sent with it.
- Fennec does not sell your data, does not show ads, and does not use advertising identifiers.
- This website sets no cookies and loads nothing from third parties.
- Want your account and everything in it deleted? Email support@getfennec.app.
On this page
1. Who this policy covers
This policy explains how PLACEHOLDER_LEGAL_ENTITY ("we", "us") handles personal data in the Fennec: Voice to To-Do List apps for iPhone, Apple Watch and Mac, and on https://getfennec.app. For data protection purposes we are the controller of that data.
If you contact us about anything in this policy, write to support@getfennec.app.
2. What Fennec collects
Account information
To create an account you provide an email address and a password, or you use Sign in with Apple. Passwords are stored only as salted hashes by our authentication provider — we never see or store your password. If you use Sign in with Apple, we receive the email address you chose to share (which may be Apple's private relay address) and, on first sign-in only, the name you chose to share. Every account also has an internal identifier (a UUID) that we use to link your data together.
Onboarding details
During setup Fennec asks for a few optional things and stores them with your account: your first name, your preferred language, why you're using Fennec (for example "work" or "keeping the house running"), your date of birth (used only to check you are 18 or older), and where you heard about Fennec.
Your content
Fennec stores what you put into it, so that it is there on your other devices:
- the text of the messages you send Fennec, whether spoken or typed;
- the tasks created from them — the task text, its list or category, its due date and time, and whether it is done;
- your preferences: your custom category names, whether Fennec may invent new categories, and your reminder times.
Usage analytics
Fennec uses PostHog, hosted in the European Union, to understand how the app is used. We record events such as signing in, sending a message, confirming a list of tasks, completing a task, toggling calendar sync, and opening the subscription screen — together with the screen you are on and your account identifier and email address, so that a single person's sessions can be recognised as one person.
We deliberately do not send the content of your messages, your task text, or your category names to analytics. Where a length or count is useful, only the number is sent — for example "a message of 84 characters was sent", never the message.
Diagnostics
When something fails — a calendar sync error, a failed purchase, a sign-in problem — Fennec reports the error and its technical message so we can fix it. These reports are sent to PostHog alongside the analytics above.
Subscription information
If you subscribe to Fennec Pro, the purchase is made through your App Store account and managed by RevenueCat. We give RevenueCat your account identifier so your subscription follows you across your devices; RevenueCat and Apple hold the transaction record. We never see or store your payment card, billing address, or any other payment detail — those stay with Apple.
3. Your voice, specifically
When you hold the microphone button, your speech is converted to text using Apple's speech recognition on your device. Fennec asks iOS not to keep the audio, and no audio file is ever written to our servers, our database, or any storage bucket. What leaves the microphone step is text.
One thing that is not ours to promise: Apple's speech recognition may, depending on your device, language and iOS settings, process some audio on Apple's own servers rather than entirely on the device. That behaviour is controlled by iOS and Apple's privacy policy, not by Fennec.
On Apple Watch, dictation is handled by watchOS. The resulting text — not audio — is passed to your iPhone over Apple's local device-to-device connection.
4. How AI processing works
To turn "grab pasta and rice, review the PR before five" into two tasks, the text of that message is sent from our server to an AI provider. Depending on which provider is currently configured, that is OpenAI, Anthropic, or Moonshot AI.
What is sent: the message text, the names of your categories, today's date, and your time zone. What is not sent: your name, your email address, your account identifier, or any of your other tasks. The provider returns a structured list of suggested tasks, which is checked by our server and shown to you for confirmation.
These providers process the text on our behalf under their business API terms, which — unlike their consumer chat products — do not use submitted content to train their models by default. Requests are sent with retention disabled where the provider offers that option.
AI output is a suggestion, not a fact. Fennec always shows you the extracted tasks before saving them so you can correct or discard them.
5. What Fennec does not collect
- No audio recordings. None are stored by us, ever.
- No location data. Fennec does not request or use your location.
- No contacts, photos, or files. Fennec does not read your photo library, contacts, or documents.
- No advertising identifiers, no ad networks, no tracking across other apps or websites.
- No sale of personal data, and no sharing of it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
- No push notification tokens. Fennec's reminders are scheduled locally on your device; nothing is sent through a push server.
6. Why we process it
If you are in the UK, EU or EEA, the UK GDPR and GDPR require us to name a legal basis for each purpose:
| What | Why | Legal basis |
|---|---|---|
| Account details, your messages, your tasks and preferences | To provide the app you asked for and sync it across your devices | Performance of a contract |
| Sending message text to an AI provider | To extract tasks — the core feature | Performance of a contract |
| Onboarding answers (reason for use, referral source, language) | To set the app up for you and to understand who Fennec is for | Consent (you can skip them) and legitimate interests |
| Date of birth | To confirm you are 18 or older | Legal obligation and legitimate interests |
| Analytics and crash diagnostics | To find out what is broken and what people actually use | Legitimate interests in maintaining and improving the app |
| Subscription records | To give you the features you paid for | Performance of a contract |
| Calendar and microphone access | To add tasks to your calendar and to hear you | Consent, granted through the iOS permission prompt and revocable in Settings |
7. Who else processes it
We use a small number of service providers. They act on our instructions and are not permitted to use your data for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Accounts, database, server functions | Your email, account identifier, messages, tasks, preferences |
| PostHog (European Union) | Product analytics and error reports | Your account identifier and email, event names, counts and screen names — no message or task content |
| RevenueCat | Subscription management | Your account identifier and App Store transaction status |
| OpenAI, Anthropic or Moonshot AI (whichever is configured) | Extracting tasks from a message | The message text, your category names, the date and your time zone — no identifiers |
| Apple | App distribution, Sign in with Apple, purchases, speech recognition, Calendar | Whatever Apple's own services require; governed by Apple's privacy policy |
| Cloudflare | Serving this website | Standard web request data such as IP address, for delivery and security |
We may also disclose data if we are legally required to, or to establish or defend legal claims. If Fennec is ever sold or transferred, your data would move with it and we would tell you first.
8. International transfers
Some of these providers are based in, or process data in, the United States and other countries outside the UK/EEA. Where that happens, the transfer is covered by the provider's standard contractual clauses, its Data Privacy Framework certification, or another approved safeguard, together with the technical measures described in this policy.
9. How long we keep it
- Your account, messages and tasks: until you ask us to delete them. They are not automatically expired, because a to-do app you can't scroll back through isn't much use.
- Analytics and error events: retained by PostHog under its default retention schedule and not kept indefinitely by us.
- Subscription records: kept for as long as needed for tax and accounting purposes, typically several years, as required by law.
- Backups: deleted data may persist in encrypted backups for a short period before being overwritten.
10. Your rights and how to use them
Depending on where you live, you have some or all of these rights: to access a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent you previously gave. If you are in California, you also have the right not to be discriminated against for exercising them — and, as noted above, we do not sell or share personal data.
Deleting your account. Fennec does not yet have a delete-my-account button inside the app. Until it does, email support@getfennec.app from the address on your account and we will delete the account and everything attached to it — messages, tasks and preferences — within 30 days. The same address handles access and data-export requests.
You can change some things yourself at any time: edit or delete individual tasks in the app, turn calendar sync and reminders on or off in Preferences, and revoke microphone, speech, calendar or notification access in the iOS Settings app.
If you think we've handled your data badly, please tell us first — but you also have the right to complain to your local data protection authority. In the UK that is the Information Commissioner's Office; in the EU it is the supervisory authority where you live.
11. Security
Data is encrypted in transit with TLS and encrypted at rest by our hosting provider. Database access rules restrict every row of your messages and tasks to your own account, enforced by the database itself rather than only by the app. AI provider keys are held server-side and are never present in the app. Access to production systems is limited to those who need it.
No system is perfectly secure. If a breach ever affects your data and the law requires it, we will notify you and the relevant authority without undue delay.
12. Children
Fennec is for adults. You must be 18 or older to create an account, and we ask for your date of birth during setup to check. We do not knowingly collect data from children. If you believe a child has created an account, email support@getfennec.app and we will delete it.
13. This website
https://getfennec.app sets no cookies, runs no analytics, and loads no third-party scripts, fonts or images. That is why you weren't asked to accept anything. Our host, Cloudflare, processes standard request information such as your IP address in order to deliver the page and protect it from abuse.
14. Changes
If this policy changes we will update the date at the top of this page, and for significant changes we will tell you in the app or by email before they take effect.
15. Contact
PLACEHOLDER_LEGAL_ENTITY
support@getfennec.app
We aim to reply within 2 working days.