Privacy Policy

Effective: September 26, 2026
Last revised: October 6, 2026

This translation is provided for convenience; the Japanese version prevails.

Takumi Nishimura (the "Operator") sets out below how information from users of the iPhone app "poitto" (the "App") is handled.

1. Information We Collect and How We Use It

(1) Account information

• The App automatically creates an anonymous ID with Google's Firebase Authentication the first time it launches, so you can use AI analysis and other features without signing in with Apple.
• The Operator's server stores an ID that identifies you (a Firebase user ID), whether your account is anonymous or registered, and the date/time your account was created and last used.
• Choosing "Sign in with Apple / Create an account" in Settings links your Apple sign-in to this anonymous ID. Your ID does not change, so your AI usage count and any poitto Pro purchase carry over. If that Apple ID already has a registered account, you're signed in to that account instead.
• An email address is stored only if Apple provides one. If you choose Apple's "Hide My Email," a forwarding address issued by Apple is stored instead.
• Purpose: signing in, distinguishing each user's data, managing the monthly AI usage limit, and preventing misuse.

(2) Content sent for AI sorting

• Text and images (including screenshots and photos) that you toss into the App are sent, for sorting, to the Operator's server (running on Cloudflare Workers), which forwards them to Google's Gemini API to produce draft tasks, events, and notes. The subject and body of email you forward with the email import feature (see (9) below), and the text, images, and PDFs you toss in from the desktop version (see (11) below), are sent to the Gemini API in the same way.
• To help with sorting, we also send your device's date/time and time zone, the App's language and region settings, the names and descriptions you gave your matrices and boxes, and your tag names.
• The original text and images you toss in from the App (iPhone) are not stored on the Operator's server. Only the text, images, and PDFs that arrive through the email import feature or from the desktop version are stored temporarily until you review them (register or discard) on your iPhone; they are deleted when you review them or 7 days after they were created (by the following day at the latest; see (9) and (11) below). Apart from that, the server stores a record of each analysis (the draft the AI produced, the model name used, whether text was present, the number of images and PDFs, token counts and similar counts, and the date/time) and your monthly AI usage count. Analysis records are automatically deleted within 1 day after they pass 7 days old (deletions run once a day, in a batch).
• To prevent rapid repeated AI requests, each request temporarily records only your user ID and the date/time (no content). This record is automatically deleted after 1 day.
• To improve the service, manage costs, and respond to incidents, we keep a usage record for each AI analysis (the date/time, the type of entry point (App, share extension, desktop version, etc.), counts such as the number of characters, images, and files, the outcome, the processing time, the number of tokens used, your plan (Free / poitto Pro), and your user ID) for 90 days, without any of the content, and then delete it automatically (deletions run once a day, in a batch). Totals such as daily numbers of users and requests are kept without a time limit, in a form that is not linked to any individual.
• Whether the original text and original images are kept in the App is controlled by the "Save original text and images" setting (poitto Pro). When turned on, the original text and original images (the images you tossed in) are stored, together with the registered task and so on, only on your device, and are not sent to the Operator's server.
• If your text contains a URL, or you share a URL, the server may fetch the linked page to read its content. For posts on X (formerly Twitter), the server retrieves the post text using X's oEmbed, and may additionally use the third-party public service fxtwitter as a fallback when that fails (retrieval is not guaranteed).
• Purpose: sorting content into tasks, events, and notes, and managing usage within what can be offered for free.

(3) Information stored on your device

• Registered tasks, events, notes, tags, and matrices are stored on your device (in SwiftData).
• A copy of the data needed for display is stored in an App Group (an area shared between the App and its widgets) on your device, so widgets and Live Activities can show it.
• Original images (the images you tossed in, kept with the registered task and so on when the "Save original text and images" setting is on with poitto Pro) are stored only on your device and are not sent to the Operator's server. When every task and so on that has those images is deleted, the images are also deleted from your device. Turning the setting off does not delete images already saved.
• The contents of locked notes are encrypted and stored on your device. The encryption key (a random value that contains none of your notes) is stored in your device's Keychain and, when iCloud Keychain is on, synced to devices signed in with the same Apple ID through Apple's iCloud Keychain (end-to-end encrypted). It is not sent to the Operator's server.
• App settings are also stored on your device.

(4) Notifications

Reminders and other notifications are local notifications scheduled on your device, and no information is sent externally for them. Only the email import feature's notifications ("Got your email", "Drafts arrived") use Apple push notifications (see (10) below).

(5) Technical logs

For server operation and troubleshooting, request records (date/time, processing result, etc.) may be retained for a period on Cloudflare's services.

(6) Crash reporting and usage analytics

• The App incorporates Google's Firebase Crashlytics (crash reporting) and Google Analytics for Firebase (usage analytics) to help us fix bugs and improve the App.
• Crashlytics sends your device model, OS version, App version, and the crash location (stack trace) when the App crashes.
• Analytics sends the type, count, and rough category (such as an approximate text-length range or number of images) of predetermined actions — for example, tossing content in, receiving an AI draft, registering an item, or opening the poitto Pro screen. It does not send the text or images you toss in, or the content of your registered tasks, events, or notes.
• It also sends a rough classification of you as a user — your plan (Free / poitto Pro) and whether you have registered with Apple (registered or anonymous) — and purchase-related actions: a purchase left pending, a purchase failure (the type of failure), and a restore of purchases (the result).
• We do not link this information to your account's user ID.
• We do not use it for advertising purposes, and we do not collect an advertising identifier (IDFA).
• This measurement and reporting is disabled in development builds and in the demo mode used for promotional recordings.
• The information sent is processed and stored by Google LLC (including in the United States) and handled in accordance with Google's Privacy Policy.

(7) App Store purchase information

• When you purchase poitto Pro, the Operator's server verifies the transaction information issued by Apple's App Store (StoreKit) and stores your plan, product ID, transaction ID, the environment of the purchase (Production / Sandbox), an identifier the App creates at purchase time (app_account_token), and the expiration date.
• If Apple notifies us of a refund or revocation, that record is also stored.
• Purpose: determining whether you have poitto Pro (managing access to features).
• Deleting your account also deletes this purchase information.
• For App Store Server Notifications sent by Apple (purchases, renewals, stopping of auto-renewal, expiration, refunds, etc.), we record the notification type, date/time, product ID, price, currency, country or region, the environment of the purchase (Production / Sandbox), and your user ID and a marker that distinguishes the subscription (a value derived from the transaction ID). Purpose: improving the service and checking the state of purchases. (For how account deletion affects this record, see Section 4: your user ID and the subscription marker are removed, and the record remains.)

(8) If you use Google Calendar integration

• Only if you turn on Google Calendar integration in Settings, the App obtains permission to read and write your calendar via Google Sign-In. Fetching your calendar list and reading/writing events happens directly between your device and Google's servers.
• Information we receive: your calendar list (calendar name, color, your access role, and whether it's your primary calendar), and, for the calendars you choose under "Calendars to show" in Settings, their events (title, location, start/end time, your own RSVP response, and a marker the App attaches).
• Information we write: if you turn on writing, the App adds and updates events in your chosen calendar for the App's own tasks and events that have a due date (title, notes, links, guest names, location, and start/end time). If you turn on the completion log, it adds a record when you complete a task (an event titled "Completed: (task title)", 15 minutes long, starting at the time you completed it).
• Purpose: solely to show events in the Calendar tab and to reflect the App's own tasks, events, and completion records in Google Calendar. We use it for no other purpose.
• Storage: the authorization token is stored on your device (in the Keychain). The calendar list and events we fetch are also stored in a cache on your device. None of this is sent to the Operator's server.
• We do not send it to AI (Gemini). Information fetched from Google Calendar is never used for AI sorting.
• We do not disclose this information to third parties, and we do not use it for advertising.
• No one reads this information, except with your consent or as required by law.
• Disconnecting removes any events and completion-log entries the App wrote to Google Calendar, then revokes Google's permission, and also deletes the on-device cache of the calendar list and events. You can also revoke the App's access at any time from your Google Account permissions page.
• Integration with your iPhone's calendar and reminders (Apple's EventKit) reads and writes only on your device. It is not sent to the Operator's server.

poitto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

(9) If you use email import

Only if you create an import address under "Import from Email" in Settings do we handle the following. This feature is rolled out gradually; while it is not available to you, nothing is collected.

• Your import address: we issue one address per user, containing a hard-to-guess string, and store it on the Operator's server. If you regenerate it, the previous address stops working.
• Registered sender addresses: we store the email addresses you register as senders (up to 5). We accept email only from these addresses; anything else is bounced without being read.
• Subject and body of forwarded email: email is received by Cloudflare, Inc.'s Email Routing and handed to the Operator's server. The server extracts the subject and body (for long email, the beginning, up to your plan's character limit) and sends them to the Gemini API, just like other content you toss in, to produce drafts. The subject and body are stored until you review the drafts (register or discard) on your iPhone, and are deleted when you review them or 7 days after receipt. The raw email, attachments, and the sender's display name are not stored. Attachments are not read.
• Analysis settings: we store the language, region, and time zone settings used for sorting.
• Limits: up to 30 emails in any 24-hour period, and up to 10 MB per email. Automated email (such as auto-replies) is not accepted.
• Cloudflare's records: Cloudflare's Email Routing keeps a delivery log (sender, recipient, subject, message ID, sender authentication results, and date/time) for about 31 days. The body is not kept there.
• Purpose: turning forwarded email into draft tasks, events, and notes.
• Stopping: deleting the address in Settings deletes your import address and registered sender addresses. Drafts that have already arrived remain until you review them or 7 days pass.

(10) Push notifications (for email import)

• If you turn on notifications for email import, we use Apple push notifications (APNs) to tell you "Got your email", "Drafts arrived (count)", "No drafts could be made", or "Couldn't read your email". Notifications never include the subject, sender, or body. Each notification carries an identifier (a job ID, containing no content) so the App can open the matching drafts.
• For this, we store on the Operator's server the push device token Apple issues for your device (up to 10 per account). The token is deleted when you sign out, when you delete your account, when Apple reports it as invalid, or after 90 days without an update.
• Purpose: letting you know that drafts are ready from your email.

(11) If you use the desktop version

Only if you connect the desktop version (the Windows / Mac app) to your iPhone do we handle the following.

• Connecting (pairing): you approve by scanning a QR code shown on the PC with your iPhone. While approval is pending (5 minutes), we store a hash of the QR code value, the PC's name and OS type, and the PC's IP address (for IPv6, the leading part; to limit repeated attempts). These are deleted once approved or expired.
• PC records: for each approved PC, we store its name, OS type, desktop app version, and the time it was last used. Disconnecting from your iPhone's Settings stops that PC from being used. The PC record remains until you delete your account.
• Content tossed in from the PC: text, images, and PDFs you toss in from the desktop version are sent to the Operator's server and turned into drafts by the Gemini API. The drafts arrive on your iPhone as "Drafts from your PC". Until you review them (register or discard), the original text is stored in the database and the images and PDFs in Cloudflare storage (R2); they are deleted when you review them or 7 days after they were tossed in. The desktop version's history shows the first 60 characters of the text and the draft titles (not shown once the original text has been deleted).
• Purpose: reviewing and registering on your iPhone what you toss in from your PC.

2. What We Don't Do

• We do not show ads or track you for advertising purposes.
• We do not sell your information.
• The Operator does not use content you toss in to train AI.
• We do not read forwarded email for any purpose other than sorting.

3. External Services (Disclosure to and Entrustment with Third Parties)

The App relies on the following external services to provide its features, and each receives the information necessary for its role. Each provider's handling of information is governed by its own privacy policy.

In addition, when the server fetches a linked page's content, a normal access request is made to that page's server.

Except as required by law, we do not disclose your information to any third party other than those listed above.

4. Deleting Your Information

• You can delete your account at any time from "Settings → Account → Delete Account" in the App.
• Deleting your account deletes your data stored on the Operator's server (account information, analysis records, usage counts, purchase information, calendar integration settings, etc.), deletes your Firebase account, and revokes the Sign in with Apple connection. Data on your device is also erased (except the encryption key for locked notes; see the next item).
• To protect locked notes on your other devices signed in with the same Apple ID, the encryption key for locked notes stays in this device's Keychain and (when it is on) in iCloud Keychain even after you delete your account. The contents of locked notes are erased from this device.
• How stopping email import, disconnecting a PC, and signing out are handled is described in 1(9), 1(10), and 1(11) above. Deleting your account also deletes your import address, registered sender addresses, push device tokens, PC records, and any text, images, and PDFs awaiting review.
• Simply deleting the App does not delete data on the server.
• When you delete your account, your user ID and the subscription marker are removed from the AI usage records and the App Store notification records (the records themselves remain, but are no longer linked to you). Totals that are not linked to any individual (such as daily numbers of users and requests) also remain.

5. Security

Communications are encrypted with HTTPS. On the server, each user's data is kept separate and managed so that only that user can read or write it.

6. Minors

Minors should use the App only with a parent or guardian's consent.

7. Revisions

This Policy may be revised as needed. If there is a material change, we will notify you via this page or the App.

8. Contact

Operator: Takumi Nishimura
Contact: support@poitto.app