Foremind
Back to login
Privacy

Foremind Privacy Policy

This page explains what user information Foremind processes across the web app, backend, iOS app, and admin console, why that information is used, and how you can control your data.

Last updated
April 24, 2026
Current page URL
https://note.theonly.ltd/privacy-policy-en
Information we process
Account and identity information

When you sign up, sign in, update your profile, or recover your account, we process your username, email, phone number, password hash, and related security records such as sign-in time, last active time, sign-in IP, and device or browser identifiers.

Content you choose to save

This includes notes, todos, tags, folders, saved web clip URLs and extracted content, uploaded files, images, social-style posts, AI conversations, conversation attachments, and profile or persona images that you choose to upload.

Device and network traces

To keep sign-in, security audits, and troubleshooting working, we process client session identifiers, device codes, request paths, referring sites, platform type, system and browser details, request timing, IP address, and user agent data.

Subscription and transaction identifiers

When you use iOS subscriptions, we process membership tier, entitlement status, order numbers, invoice snapshots, transaction identifiers, original transaction identifiers, and external subscription references for activation, renewal, restore, and reconciliation.

AI processing records

When you use AI features, the system stores the necessary prompts, request payloads, response text, reasoning content, tool calls, risk tags, and usage metrics to support ongoing sessions, safety review, debugging, and usage management.

Why we use it
To complete sign-up, sign-in, account recovery, session renewal, and device management.
To save, sync, display, and search your notes, todos, images, attachments, and web clipping content.
To process AI chat, image understanding, quick capture, and content organization features that you actively trigger.
To activate and maintain subscription benefits, including Apple subscription sync, restore purchases, billing snapshots, and operational reconciliation.
To perform abuse prevention, bot checks, audit logging, sign-in protection, and incident investigation.
To measure feature usage, request timing, and service stability so we can improve the product.
Who may receive it
Cloudflare Turnstile for bot checks during sign-in, SMS verification, and account recovery flows.
RevenueCat and Apple for iOS subscription state, product identifiers, and transaction synchronization.
Object storage and CDN providers for storing and delivering images, files, and media attachments that you upload.
AI model providers only when you actively submit text, images, or attachments to AI features.
Legal or security recipients when disclosure is required for compliance, lawful requests, or major security incidents.
Dedicated notice about third-party AI sharing
What data may be sent to AI providers

Only when you actively use an AI feature do we send data that is directly necessary for that request. This can include the chat text you enter, any full note or document body that you choose to attach, uploaded images or PDFs, recent conversation context, and profile or memory summaries used to keep the reply coherent. Your raw phone number is not sent to the model by default; phone region is used on our server to select a compliant route.

Who receives that data

The overseas route is currently served through Google Cloud Vertex AI for gemini-* models and the overseas models ending in -maas. Accounts registered with a Chinese mainland phone number default to the domestic route, where the current providers are Alibaba Cloud and Zhipu. If we later add OpenAI, Anthropic, or any other provider, we will update both this page and the in-app disclosure.

When it is sent and how consent works

On the web app and iOS, the app shows a disclosure before the first AI use and asks you to explicitly choose Agree or Decline. We send data to a third-party AI provider only after you explicitly agree. If you decline, the AI assistant stays disabled until you choose to re-enable it later.

Why we send it

The data is used only to complete the AI task that you triggered, such as chat, document understanding, task breakdown, content organization, or image understanding. We also retain the necessary AI request logs, safety tags, and usage metrics for continuity, review, debugging, and quota management.

Not found in this code review
This code review did not find active contact list collection.
This code review did not find active precise location collection.
This code review did not find active microphone capture.
This code review did not find active camera capture.
This code review did not find advertising tracking identifier collection logic.
The current iOS app uses the system photo picker only when you actively choose an image.
Your controls
You can update your username, email, phone number, and password.
You can delete AI conversations, messages, full threads, and saved content.
You can sign out of the current device or revoke other device sessions.
You can stop using the subscription or restore purchases through Apple.
If you need help with account or data issues, you can contact the service through in-app feedback or public support channels.
Additional notes
Photo access

The current iOS app uses the system photo picker only for images that you explicitly choose, such as note illustrations, social-style images, or avatar uploads. We did not find logic that bulk-reads your photo library automatically.

Security and retention

We retain the sign-in sessions, security logs, audit logs, risk-control records, and subscription records that are reasonably necessary for account protection, incident tracing, dispute handling, and reconciliation.

Scope of this page

This page is based on the current code review of this project. If new sensors, ad SDKs, payment channels, or third-party services are added later, this policy should be updated accordingly.