Privacy Policy

Effective 25 October 2026

This policy explains what personal data InsightApp (“the app”, “we”, “us”) collects, why, who we share it with and the choices you have. InsightApp is provided by its independent developer, based in the United Kingdom, who is the controller of your personal data. Contact: [email protected].

1. Data we collect

Account data

• Your email address, name and password (stored only as a secure hash by our authentication provider).
• If you sign in with Google or Apple: the identifier, email address and name those services share with us, and your Google profile picture if you have one. With Sign in with Apple you can choose to hide your email address, and we keep a token from Apple so that we can revoke InsightApp’s access to your Apple ID when you delete your account.
• Emails we send you about your account, such as confirming your email address or resetting your password.

Content you create

• Voice recordings and their transcripts, text notes, images and screenshots, saved links (“fragments”), drafts, storyboards and combined notes, projects, and tasks on your Today list (including ones you accept from a note’s suggested actions).
• Photos and screenshots are stripped of their hidden metadata – including GPS location and camera details – and resized before they are stored or analysed.
• Messages you send in the in-app chat.
• Names of people that you add, or that the app detects in your notes, to improve transcription accuracy.
• Feedback you send us from the app, including any details and screenshot you add. Feedback is private: only you and we can see it.

Usage and subscription data

• Monthly counts of certain features you use (for example storyboards and drafts), to apply free-plan limits.
• How much AI processing your account uses each month (for example the amount of text processed and minutes of audio transcribed), to apply fair-use limits and manage costs.
• Your subscription status, plan and renewal date. Payments are handled by Apple; we never see your payment card details.
• The date you agreed to AI processing (see section 3).

Data that stays on your device

• Voice search and dictation in chat are transcribed on your device where your iPhone supports it; this audio is not recorded or sent to us.
• Reminder notifications are scheduled locally on your device.

We do not use advertising, analytics or tracking tools, and we do not sell your personal data.

2. How we use your data

• To provide the app (necessary to perform our contract with you): storing and syncing your notes, transcribing recordings, generating titles, summaries, drafts, storyboards, briefs, chat answers, search results and spoken playback.
• With your consent: sending your content to our AI providers, OpenAI and Google (section 3). You can withdraw consent at any time in Settings.
• For our legitimate interests: keeping the service secure, preventing abuse, enforcing usage limits, answering your messages and improving the app based on feedback you choose to share.
• To meet legal obligations, for example responding to lawful requests.

3. AI processing by OpenAI and Google

InsightApp’s core features use OpenAI, L.L.C. Before your content is sent, the app asks for your consent. When you use these features, the following is sent to OpenAI:

• voice recordings, to transcribe them – only when your phone can’t transcribe them itself (where supported, transcription happens on your device);
• notes, transcripts, text and chat messages, to write titles, summaries, drafts, answers and search indexes;
• images you add, to describe what they contain.

Read-aloud uses Google LLC’s Gemini API: when you choose to hear a brief or note read aloud, its text is sent to Google to generate the voice. If you’re over your monthly AI allowance or offline, your phone’s built-in voice reads instead, and nothing is sent.

OpenAI and Google process this data to provide the service to us. Under their API terms for paid services, data sent through their APIs is not used to train their models. OpenAI may keep it for up to 30 days, and Google for a limited period, to monitor for abuse before it is deleted. You can withdraw your consent in Settings → Privacy → AI Processing; AI features will then be unavailable until you agree again.

4. Who we share data with

We share personal data only with service providers that process it on our behalf, under contracts that require them to protect it:

• Supabase – database, file storage and user authentication (hosted in the EU, Ireland).
• Railway – hosting for our application server.
• GitHub – stores our nightly database backups. They are encrypted before they reach GitHub, so GitHub cannot read them, and each one is deleted after 14 days.
• Cloudflare – our domain, network security and protection against abuse; traffic between the app and our server passes through it.
• Resend – sending account emails, such as email confirmation and password reset; receives your email address and the email content.
• OpenAI and Google – AI processing, as described above.
• RevenueCat – subscription management; receives an anonymous account identifier and your purchase status.
• Apple and Google – if you use their sign-in services, and Apple for in-app purchases.

We do not share your content with other InsightApp users. We may also disclose data if required by law or to protect the rights and safety of our users or others.

5. International transfers

Some of our providers, including OpenAI, Google, Railway, Cloudflare, Resend, RevenueCat and GitHub, process data in the United States. Where data is transferred outside the UK, we rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the provider is certified.

6. How long we keep data

• Your account and content are kept until you delete them or delete your account.
• You choose how long voice recordings are kept in Settings → Privacy → Voice Recordings: until you delete the note, for 30 days, or not at all (deleted straight after transcription). Transcripts and summaries are kept either way.
• When you delete your account in Settings → Delete Account, we delete your profile, notes, recordings, images, drafts, fragments, projects, tasks, usage records and feedback, and your login, straight away. If you used Sign in with Apple, we also ask Apple to revoke InsightApp’s access to your Apple ID. Copies in our encrypted database backups are deleted when those backups expire, within 14 days.
• OpenAI may keep data sent to it for up to 30 days, and Google for a limited period, as described in section 3.

7. Your rights

Under UK data protection law you have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time. You can delete your notes and your account directly in the app. For anything else, email [email protected]; we will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

8. Security

Data is encrypted in transit and at rest, recordings and note images are kept in private storage that is only reachable through our server, and each account can only access its own content. Each account has a storage limit. No system is perfectly secure, but we work to protect your data and will notify you and the regulator of a breach where the law requires it.

9. Children

InsightApp is only for people aged 16 and over, and everyone confirms their age when creating an account. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has given us personal data, contact us and we will delete it and close the account.

10. Changes to this policy

We may update this policy. We will change the effective date above and, for significant changes, tell you in the app before they take effect.

11. Contact

InsightApp · [email protected]