Privacy policy
The server keeps counts, never words.
Last updated 1 October 2026
SameFold is made for two people to work through a decision. What you write in it is personal, and this policy says plainly where it goes and where it does not. Nothing here is hidden behind a summary; if a sentence is not here, it is not something we do.
What you write
Your positions, the shared picture, your decisions, assumptions and revisit dates are stored in your own iCloud account, in a private database that Apple runs and that we cannot read. When you invite your partner, the record is shared with them through iCloud sharing, so it also lives in their iCloud account. Nobody else is granted access.
When your side is summarised or a picture is generated, your text is sent from your phone to our server and from there to the model provider, Google, using its Gemini API. The request also carries the language the app is shown in, as a short code such as de, so that the picture comes back in that language. Our server does not store your text or the language and does not log them; the text exists on our side only for the seconds it takes to produce your picture. Every request we send to the model is made with storage switched off, and we use Google's paid service, under whose terms your text is not used to train models or improve Google's products. Google does keep requests for a limited period solely to detect and prevent abuse of its service, as its Gemini API terms describe.
What our server keeps about a decision is numbers and codes: how many tokens the model used, how long it took, whether it succeeded or failed and with which error code, next to the random household and decision ids described below so that a support request can be traced. Our logging code refuses to write anything outside that list or any free text, and an automated test checks that no user text can leak into logs or the database.
What our server knows about you
- A household id. A random identifier created when you first open the app. It links the two of you for the purpose of counting decisions. It is not your name, email or Apple ID.
- A device key. Your device proves it is a genuine copy of SameFold using Apple's App Attest. We keep the public key so we can recognise the device again. It does not identify you personally.
- Counts. How many decisions your household has opened and how many remain in your plan.
- Purchase state. Whether a purchase or subscription is active. This comes to us from RevenueCat (see below), keyed by the household id, never by your Apple ID.
We do not know your name, your partner's name, your email address, your location or the subject of any decision.
Purchases
Payments are handled by Apple. We never see your card. To know which plan is active we use RevenueCat, a subscription service that receives purchase receipts from Apple. RevenueCat stores the random household id, the product you bought and the dates, and forwards that state to our server. RevenueCat's own policy is at revenuecat.com/privacy.
Notifications
There are two, and only two: your partner has written their side, and it is time to look at a decision again. Both are sent by your own phone, through iCloud and local scheduling. They never contain what either of you wrote.
The safety screen
Before a picture is written, your text is checked by the model for signs that someone may be in danger. If the check is uncertain or positive, the flow stops and shows a helpline for your country. Your text is not stored or logged. The result is a single word (none, concern or crisis) and it is recorded only as that word, with no household, decision or device id attached, so that we can see how often the check fires and nothing more.
What we do not do
- No analytics kit, no tracking pixel, no advertising identifier.
- No account, no email address, no password.
- No selling, renting or sharing of data with anyone other than the processors named above, and to them only what is described.
- No use of your text to train any model, ours or anyone else's.
Deleting your data
Decisions are archived in the app rather than deleted, because the record is the point. If you want everything gone, delete the app's data from iCloud: on your iPhone open Settings, your name, iCloud, Manage Storage, then SameFold, and choose to delete. That removes your positions and pictures from Apple's servers for both of you if you are the owner of the shared record. To clear the counts and purchase state on our side, write to maotunko@gmail.com from the app's support screen so we can find the household id; we remove it within thirty days.
Children
SameFold is for adults working through a shared life. It is not directed at children and we do not knowingly collect information from anyone under 16.
Where data is processed
iCloud data is stored by Apple in the regions Apple uses for your account. Our server runs on Cloudflare's network and handles your text in memory only. The model is run by Google. Each of these companies is a processor bound by its own published terms.
Changes
If this policy changes, the date at the top changes. We will not widen what we collect without saying so here first.