Privacy policy

In short

What	Where, and who sees it
Tasks, facts, attachments, the household’s activity	On your iPhones and in the household’s iCloud, shared between your Apple accounts. Not us.
Your voice, the reading of scanned papers, conversations with the assistant	On the iPhone. Your voice never leaves it. Conversations are never synced; like the rest of the app, they are included in the iPhone’s backup, and each message is erased thirty days after it was written.
The text of a capture; for the assistant, the conversation, the open tasks, the non-sensitive facts, the household’s date and time	At Claude (Anthropic), only with Fiou+ and once you allow it (“Allow Claude”). The family’s first names are sent as placeholders.
Notifications: what the other members do, reminders, the daily rundown, the week ahead	Our notification service, hosted by Cloudflare in the European Union. It keeps what it needs to reach each iPhone at the right time, never the text: titles, first names and notes travel sealed.
The Fiou+ subscription	The App Store (Apple). We never see your payment details.
The email you write us	We read it to answer you. Deleted on request.

Who is responsible

Fiou!’s publisher, named in the legal notice, is responsible for processing the emails received at feedback@fiou.app and the data of the notification service, which Cloudflare hosts as its processor. For everything else there is no processing on our side: the data stays between your iPhone, your iCloud account at Apple and, if you allow it, Anthropic’s Claude service, each under its own terms.

What the app stores, and where

Data	Where it is stored	Protection
Tasks, the household’s facts, attachments (scans, photos, PDFs and their text), activity (who took, handed off, finished what)	On each iPhone of the household and in the household’s iCloud database, shared between your Apple accounts	Encrypted at rest and in transit by iCloud; the assistant never reads facts marked sensitive, so they never go to Claude
Conversations with the assistant	On each person’s iPhone; included, like the rest of the app, in that iPhone’s backup (iCloud or computer)	Never synced, with the household or with any server of ours. Each message is erased thirty days after it was written: the app removes it from the iPhone at its next launch
Dictation and scanned papers	Transcribed and read on the iPhone; the text and the image join the task as source and attachment	Your voice never leaves the iPhone, and no sound is recorded
Your first name, your color, the Sign in with Apple identifier (if you use it)	On the iPhone; first name and color in the household’s iCloud database	The Apple identifier stays on the iPhone; it is not sent to us
Settings (quiet hours, daily rundown, week ahead, the Claude switch)	On the iPhone; quiet hours, the daily rundown’s time and the week ahead’s day and time are also given to the notification service	The Claude switch stays on the iPhone. The times leave it so each notification comes at the right moment, and the other members’ iPhones read them to plan your notifications
A JSON export	Wherever you save it	Not encrypted: it is your copy

What leaves your iPhone

iCloud (Apple)

Fiou! syncs the household through iCloud and shares its database between its members’ Apple accounts. Apple hosts this data under its privacy commitments; we have no access to it. Silent notifications sent by iCloud wake the app when another phone in the household changed something; they carry none of your data.

Our notification service (Cloudflare)

When another member creates, takes or finishes a task, or hands one to you, your iPhone tells you, even with the app closed; your reminders, nudges, the daily rundown and the week ahead also arrive on time. For that, once the household has two people, each iPhone registers with our notification service and, after each change, hands it the whole household’s schedule of upcoming notifications. Cloudflare hosts it as a processor (privacy policy) and its data is stored in the European Union. The service keeps:

• for each iPhone: the notification token Apple gives it and its environment (test or production), a random identifier for the device and another for the person, the language, the time zone, the quiet hours, the time of the daily rundown, the day and time of the week ahead, whether its version of the app can take that schedule, when it was last updated and, after a failed delivery, when to try again;
• for the household: a key that authenticates its iPhones, the time of its last request and of the latest change in the household, and, to cap their number, the times of its requests in the past hour;
• for each action to announce: its kind (created, taken, handed off, finished), the random identifiers of the action, the task and the person to notify, and its times, for as long as it takes to deliver; then, for seven days, its identifier alone, so it is never sent twice;
• for each planned notification (a reminder, a nudge, the daily rundown, the week ahead): its identifier, its kind, the random identifier of the person to notify and, except for the rundown and the week ahead, that of the task, its times (when to send it, and until when it is still useful), the nudges it replaces and its sealed content, until a later schedule withdraws it or it is too late to send;
• for each planned notification already sent, or already shown by the iPhone itself: its identifier, the time and, if the service sent it, the iPhone that received it, for thirty days, longer if a schedule still holds it, so it is never sent twice.

The household’s iPhones, and they alone, can read back each person’s time zone, quiet hours, rundown time, week-ahead day and time, and whether their iPhone can take the schedule: that is how each person’s iPhone plans the others’ notifications. They see no token, no language and no environment.

Titles, first names and notes leave sealed: your iPhone encrypts them with a key only the household holds, and only the iPhone that receives the notification opens them. Neither the service nor Apple, which carries the notification, can read them. In clear, a notification carries only its kind, random identifiers, how many actions it groups and, in a planned notification’s identifier, a date or a time. If the iPhone cannot open it, it shows a set line for that kind, never a title. The service keeps no name, no email address and no IP address. Its logs record only delivery errors (Apple’s error code and reason, or the name of an error), never a token, an identifier or any content.

Legal basis: providing the service you use. Erasure: when Apple reports that an iPhone’s token is no longer valid, which follows the app’s deletion, the service erases that iPhone’s row; an iPhone that joins another household erases its own row in the old one; a household with no activity for sixty days is erased entirely. Since the service knows neither your name nor your address, we cannot find your household from a request: these automatic erasures stand in for one.

Claude (Anthropic), if you allow it

Nothing goes to Claude before you agree: the app asks you in the Assistant tab, or you turn on “Allow Claude” in Settings › Intelligence. Turning it off stops anything more from being sent, even in the middle of an answer from the assistant. Once Claude is allowed, and with Fiou+, the app sends directly to Anthropic’s Claude service:

• to prepare a capture the iPhone cannot handle: the captured text (dictated, scanned, shared or typed), with today’s date;
• for the assistant, with every message: the last twenty messages of the conversation, yours included; the household’s open tasks (up to a hundred, with who holds each, its date and its category); the household’s members and children, as placeholders; every non-sensitive fact in the memory; the household’s date, time and time zone; and, during the exchange, what its tools look up in the list and the memory.

Before anything is sent, your iPhone swaps the family’s first names, the children’s and the household members’, for placeholders such as “[Child 1]”, then puts them back in the answer. Surnames and other people named in your text are not masked. Never sent: a fact marked sensitive, or messages older than those last twenty.

For tasks and the assistant alike, the app authenticates with Anthropic through App Attest, an Apple attestation that the copy of the app is genuine; there is no account in your name at Anthropic and we do not see these requests. Anthropic processes this content as a provider under its commercial terms.

The App Store (Apple)

The Fiou+ subscription is bought through the App Store. Apple handles the payment; the app only receives an anonymous confirmation of the subscription, never your payment details.

Us

When you write to feedback@fiou.app, we receive your address, your message and, if you use the app’s button, the iPhone model, the iOS version and the app’s version. We keep these emails as long as it takes to answer and for the support history, without sharing them, and we delete them on request.

What the app does not do

• No account with us. Our only server is the notification relay, which cannot read your tasks.
• No usage statistics, no analytics tool, no advertising, no tracker, no third-party kit beyond Apple’s frameworks and the Claude client.
• No sale or sharing of data.
• The microphone, the camera and notifications are requested when you use them, never before, and can be revoked in the iPhone’s Settings.

Children

Fiou! is for adults. Children appear as tags you create (a first name) on tasks and facts; they have no account. Their first names are swapped for placeholders in everything the app sends to Claude, then put back on your iPhone.

The App Store privacy label

It lists “User ID”, “Device ID”, “Other User Content” and “Other Data Types”, linked to you and not used for tracking. Your content and your identifier pass through iCloud and, if you allow it, through Claude: we do not receive them. The notification token, the random identifiers, the language, the time zone, the quiet hours, the times of the daily rundown and the week ahead, and the schedule of upcoming notifications, without their text, are kept by our notification service, to notify you and nothing else.

Your rights and your controls

• See and take: Settings › Export household produces a JSON file of the whole household.
• Correct: everything is editable in the app.
• Turn the AI off: Settings › Intelligence › “Allow Claude”; Apple Intelligence in the iPhone’s Settings.
• Delete everything: deleting the app erases local data and conversations (an earlier backup of the iPhone keeps a copy); the household’s data is deleted in the iCloud of the person who created it: Settings › your name › iCloud › Manage Account Storage › Fiou! › Delete Data. The other members do the same. The notification service erases an iPhone’s row when Apple reports its token as expired after the app’s deletion, or when that iPhone joins another household, and the whole household after sixty days without activity.
• For emails: access, rectification, erasure and objection on request at feedback@fiou.app. In the EU you can also contact your data-protection authority (the CNIL in France).

This site

fiou.app is a static site: no cookie, no script, no resource loaded from a third party; the site’s only font is served from fiou.app. The host keeps technical logs (IP address, page requested, date) to run the service; we draw no personal statistics from them.

Changes

This policy evolves with the app; the date at the top changes with every revision and important changes are announced in the app.

Back to top