Things you saw. Not things we see.

01Who we are

Things I Saw ("the app") is an app for iPhone, Mac and Android that saves things you come across in other apps, sorts them into categories and reminds you about them later. It is developed and published by Jan Aguja, an independent developer in the Philippines ("we", "us"). The app is not yet released. This policy covers all three versions and explains what the app handles, where it goes and how long it stays.

02What we collect

Nothing. There's no sign-up, and no server of ours for the app to talk to.

The app does not require an account, sign-in, email address or phone number. We do not collect, receive or store the things you save, your settings or any information about how you use the app. Everything described below stays on your devices, in your own iCloud, or goes directly from your device to a service you chose to use.

03What you save

Only what you hand it, and only on your side.

When you share something to the app (through the share sheet, the "+" button, Siri or Shortcuts, or by dragging it in on the Mac), it stores what came through, plus what you add, in the app's private storage on your device:

It does not save or collect:

Share extensions only receive the item you chose to share; the app can't see anything else in the app you shared from. On iPhone and Mac the data sits in the app's container, protected by Apple's data protection. On Android it sits in the app's private storage.

04iCloud sync (iPhone and Mac)

Your iCloud, your data. We can't open it.

If you're signed in to iCloud, the iPhone and Mac apps sync your saved things, including photos, through the app's private database in your own iCloud account, using Apple's CloudKit. That database belongs to your Apple Account: Apple stores it under the Apple Privacy Policy, and we as the developer have no access to its contents. If iCloud is off, the app keeps working with everything on the device.

Personal things are encrypted before they reach iCloud (section 5). Reminders only fire on the devices where you've left them on (by default the iPhone, not the Mac).

The Android app doesn't sync to any cloud in this version. Syncing through your own Google Drive may come later; if it does, this policy will describe it before it ships.

05The Personal drawer

Encrypted on your device, opened only by you.

Things you put in Personal are encrypted on your device (HPKE with Curve25519 and ChaCha20-Poly1305) before they're stored or synced. That covers the title, links, text, notes, tag, photos, the text read from photos and the raw share. To schedule reminders without unlocking, a few details stay unencrypted: that the item is in Personal, when it was saved, its status and its reminder dates.

• The key that opens Personal is protected by Face ID, Touch ID or a strong Android biometric, kept in your device's secure keychain or keystore, and by a Personal PIN that's separate from your device passcode. A PIN-protected copy of the key travels with your data so the PIN works on your other devices.
• The app never sees your face or fingerprint. Biometric checks are done by your device's operating system, which only tells the app "yes" or "no".
• Personal things never show up in search, and notifications only ever count them ("including 1 private item").
• While Personal is open, leaving the app hides the screen (blurred on iPhone; blocked from Recents and screenshots on Android) and locks it again.

Because only you hold the way in, if you forget your PIN and have no working biometric unlock on any device, Personal can't be opened by anyone, including us.

06Link previews & price watching

Your device visits the link, like opening it in a browser would. Nothing about you goes along.

A bare link isn't much use later, so for each link you save, your device fetches that page's public preview: its title, description and preview image. On iPhone and Mac this uses Apple's LinkPresentation framework plus a plain request for the page; on Android, a plain request. For Personal links this only happens while Personal is unlocked.

For things in Buy with a link to a shop's page, the app can also read the price the page publishes, at most once a day per item, so it can tell you when it drops. You can switch this off per item or for everything in Settings.

These requests go directly from your device to the site you saved, never through us. They carry no cookies and no login, and the app never signs in as you or tries to get past a login page. Like any page visit, the site sees your IP address and a standard app user agent, and its own privacy policy applies to that.

07On-device features

Reading the text in pictures

Photos you save are scanned for text so you can search them, and so the app can suggest a title, price or link. On iPhone and Mac this is Apple's Vision framework, which runs entirely on the device. On Android it's Google's ML Kit text recognition, delivered through Google Play services, which also runs on the device; your photos and their text aren't uploaded. Google states that ML Kit may contact Google's servers for model updates and send Google performance and usage metrics about the feature itself (not your pictures or their text), under Google's Privacy Policy. Link preview images aren't scanned.

Reminders and notifications

Reminders, check-ins and price-drop alerts are local notifications, composed and scheduled on your device. No push server of ours is involved. On iPhone, iCloud may wake the app quietly when your data changes on another device, so it stays in sync.

Siri and Shortcuts (iPhone and Mac)

You can save things, open your review and ask how many things are due through Siri and Shortcuts. When you use Siri, Apple processes your request under its own policy; the app answers on your device and never names Personal things.

08Backups, exports and moving phones

• Encrypted backup. Settings → Backup creates a single file encrypted with a password you choose (PBKDF2 with 600,000 rounds and AES-256-GCM). You decide where to keep it. We never see the file or the password, so we can't recover a forgotten one. Personal things stay sealed inside it and still need your PIN.
• Export. Export everything makes a readable .zip of your things for use elsewhere. It isn't encrypted, so keep it somewhere you trust. Personal things are only included if Personal is unlocked and you choose to include them.
• Your device's own backup. On iPhone, iCloud or computer backups of your device can include the app's data. Those are held by Apple or on your computer, never by us.
• Android. The app is excluded from Google's cloud backup. Your things can only move to a new phone through a direct phone-to-phone transfer (Android 11 and later), or with the encrypted backup file.

09Permissions

The app only asks when it needs something:

• Notifications: for your reminders and price drops. Asked when you first set a reminder or have something saved; reminders still show inside the app if you say no.
• Face ID / Touch ID / fingerprint: only to open Personal.
• Camera (iPhone): only when you choose "Take a photo" to save something.
• Internet (Android): for link previews and price checks.

Adding photos uses the system photo picker, which only gives the app the photos you pick; the app doesn't get access to your photo library. The app does not access your microphone, contacts, calendar or location.

10Third-party services

The app includes no advertising networks, analytics SDKs or crash-reporting SDKs, and no social sign-in. We do not sell, rent or share your information with anyone. The only outside services involved are the ones described above: Apple (iCloud, Siri, LinkPresentation), Google (ML Kit text recognition through Play services, on Android) and the websites you save.

If the app is paid, the purchase is handled entirely by the App Store or Google Play; we never see your payment details. Both stores may give us aggregated statistics such as install counts and crash rates, under their own policies. These don't identify you.

11Retention & deletion

You're in charge. Delete a thing, delete everything, or delete the app.

• A single thing: deleting it (or letting a reminder end with "then delete") moves it to Deleted Items, where it stays for 30 days in case you change your mind, then it's removed for good. On iPhone you can also clear it out sooner.
• Everything on a device: uninstall the app, or clear its data in your device's settings.
• Your iCloud copy: deleting things in the app deletes them from iCloud too. To remove the app's iCloud data entirely, use your device's iCloud storage settings.

We hold no copy anywhere, so there's nothing for us to delete on our side.

12Your rights

Depending on where you live, including under the Philippine Data Privacy Act of 2012, the GDPR or similar laws, you may have the right to access, correct, export or delete personal data held about you. We don't hold any. You can see, change, export and delete everything yourself in the app. For anything else, email us and we'll respond.

13Children's privacy

Things I Saw is not directed at children under 13. We do not knowingly collect personal information from children, and the app doesn't collect personal information from anyone.

14Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date. If a change affects where your data goes, such as Google Drive sync on Android, sharing or anything new that leaves your device, the policy will be updated before that change ships.

15Contact

Questions about privacy? Email [email protected]. It goes straight to Jan.