Privacy policy

The short version

• We do not sell your data, and we do not share it for advertising. Tidbits shows no ads.
• You do not need to give us your name, email address or phone number. Tidbits signs you in with an anonymous account.
• To understand, organise and answer questions about your tidbits, we send your content to OpenAI for processing. Where your device can do the work itself, it does.
• We do not use your content to train AI models, and we do not allow our AI provider to train on it under our agreement with them.
• You can delete individual tidbits, or your whole account and its data, from inside the app at any time.

Information we collect

Content you create.The tidbits you type, dictate or capture as a meeting recap, and the information Tidbits derives from them to link them together: the people, places, things and dates they mention, the people in your library, and a numeric representation of each tidbit (an “embedding”) used for search. We also store simple metadata about each tidbit, such as when it was created, when you last opened it, how often it has been recalled, and how it was captured.

Questions you ask. When you ask Tidbits a question, the question and the recent conversation are processed to find and answer from your tidbits. Conversations are kept on your device for the current session and are not saved to our servers.

Voice.If you use voice capture, your microphone audio is turned into text (see “Voice transcription” below). We keep the resulting text, not the audio. Tidbits does not store recordings of your voice.

Account and purchase information. An anonymous account identifier created by Firebase Authentication, and an anonymous identifier from RevenueCat with your subscription status. Payments are handled by the Apple App Store or Google Play; we never see your card or payment details.

Usage analytics. Events about how the app is used, such as screens viewed, features used, onboarding steps, the topics you pick during onboarding, the length of a saved tidbit, which transcription method was used, your device language and region setting, and how long actions took. This is collected with Google Analytics for Firebase, which also records device and app details (such as device model, operating system and app version), an app instance identifier and approximate location derived from your IP address. Analytics events are designed not to include the text of your tidbits or questions.

Diagnostics.Crash reports, error reports and performance measurements (using Sentry), and records of each AI request (using Pydantic Logfire) such as which model was used, how long it took, how many tokens it used and what it cost, linked to your anonymous account identifier. These are designed not to include your content. In limited cases, to investigate a specific problem with an account, we may temporarily turn on recording of the inputs and outputs of that account’s AI requests.

Device integrity. To protect our services from abuse, the app proves it is a genuine copy running on a genuine device using Firebase App Check, which relies on Apple App Attest and DeviceCheck on iOS and Google Play Integrity on Android.

Promo codes. If you redeem a promo code, we keep short-lived counters keyed on a one-way hash of your account identifier and IP address to limit repeated attempts. They expire after 24 hours.

How we use it

• To store your tidbits and show them back to you.
• To extract the people, places, things and dates in your tidbits and link related tidbits together.
• To find the tidbits relevant to a question and write an answer.
• To turn your speech into text when you use voice capture.
• To manage your subscription and access to paid features.
• To keep Tidbits working and secure: fixing bugs, measuring performance and cost, and preventing abuse.
• To understand which features are used, so we can improve them.

We do not use your information for advertising, we do not build advertising profiles, and we do not send marketing messages.

AI processing and OpenAI

Tidbits uses AI models from OpenAI to process your content. The following is sent to OpenAI through its API:

• The text of each tidbit you save, to create its search embedding and, when your device cannot do it on its own, to extract the people, places, things and dates it mentions.
• Your questions, the recent conversation and the tidbits found to be relevant, to write an answer.
• Meeting recap transcripts, to turn them into tidbits.
• The people, places and things found in a tidbit, with nearby context, to match them to ones already in your library.
• Your voice audio, when on-device or system speech recognition is not available (see below).

Voice transcription requests carry a one-way hash of your account identifier, which OpenAI uses for abuse monitoring. We do not send OpenAI any other account details. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models, and OpenAI may retain it for up to 30 days to detect abuse before deleting it, unless it is legally required to keep it longer. You can read more in OpenAI’s API data commitments.

On-device processing.On supported devices, Tidbits first tries to extract entities from your tidbits on the device itself, using Apple’s on-device foundation model on iOS or Google’s on-device ML Kit generative AI on Android. When that works, OpenAI is not used to extract them. The tidbit text and the extracted details are still sent to OpenAI to create search embeddings and to match them to your library.

AI output can be wrong. Answers and extracted details are generated automatically and are not reviewed by a person.

Voice transcription

Voice capture asks for microphone permission (and, on iOS, speech recognition permission) before it starts. Tidbits tries these methods in order and uses the first one that works:

• Speech recognition on your device, provided by your operating system. Audio stays on the device.
• On iOS only, Apple’s speech recognition service, which may send audio to Apple under Apple’s privacy policy.
• OpenAI’s real-time transcription. Audio is streamed directly from your device to OpenAI over an encrypted connection, using a short-lived token issued by our servers, and is handled under the OpenAI terms described above.

In every case, we keep only the resulting text.

We do not sell your data

We do not sell your personal information, and we do not share it with third parties for their own marketing or for cross-context behavioural advertising. We share information only with the service providers listed below, who process it on our behalf to run Tidbits, and in the limited legal circumstances described in “Other disclosures”.

Service providers

• Google Firebase and Google Cloud: anonymous sign-in, database storage of your tidbits, server functions, app integrity checks and usage analytics. Privacy
• OpenAI: AI processing and voice transcription, as described above. Privacy
• RevenueCat: subscription management, using an anonymous identifier and your purchase history. Privacy
• Sentry: crash reporting and performance monitoring. Privacy
• Pydantic (Logfire): monitoring of AI requests, hosted in the EU. Privacy
• Expo: delivery of app updates. Privacy
• Apple and Google: app distribution, payments, device integrity checks and, where used, speech recognition. Apple · Google

Other disclosures

We may disclose information if required by law, such as to comply with a subpoena or court order, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud. If Pamukk Ltd is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, and this policy will continue to apply to it.

Memory, fading and archiving

Like a human memory, Tidbits gives each tidbit a relevance score. Tidbits you recall often stay near the top, and ones you have not opened for a while gradually drift down. Tidbits with an end date are moved to your archive once that date passes.

Fading and archiving only change how tidbits are ranked and shown. They never delete anything. Your tidbits are only deleted when you delete them or your account.

Retention and deletion

We keep your tidbits and the information derived from them for as long as you have a Tidbits account, unless you delete them sooner.

• Deleting a tidbit removes it and its search embedding from our database.
• Deleting your account(You → Delete account) permanently deletes your tidbits, people, entities and all other data stored under your account, deletes your RevenueCat customer record, and deletes your anonymous sign-in account. This cannot be undone. Deleting your account does not cancel a subscription; manage that in the App Store or Google Play.
• Usage analytics and diagnostics are held by the providers above and are not removed by deleting your account. They are linked only to anonymous identifiers and are kept for up to 24 months.
• Data held by OpenAI is deleted on OpenAI’s schedule described above.

Your anonymous account

Because Tidbits does not ask for an email address or password, your account is tied to the app on your device. We cannot identify you by name, and we may not be able to restore your tidbits if you lose access to the app, for example by deleting the app or changing devices. When you contact us about your data, we may ask you to make the request from inside the app so we can match it to your account.

Security

Data is encrypted in transit between the app, our servers and our providers, and is encrypted at rest by Google Cloud. Our database rules let only your signed-in account read your tidbits, and our server functions accept requests only from verified copies of the app. Your tidbits are not end-to-end encrypted: they are processed on our servers and by OpenAI so that Tidbits can organise and search them. No system is perfectly secure, and we cannot guarantee the absolute security of your information.

If a data breach affects your personal data, we will notify you and the relevant authorities as required by law.

International transfers

Our servers and most of our providers are in the United States, and some processing happens in the European Union. If you live in the UK or the European Economic Area, your data is transferred outside your country. Where the law requires, we rely on adequacy decisions or Standard Contractual Clauses (with the UK Addendum where applicable) to protect those transfers.

Legal bases (UK and EEA)

• Providing the service: storing, organising and answering questions about your tidbits, voice transcription and your subscription are necessary to provide Tidbits under our Terms.
• Legitimate interests: diagnostics, security, abuse prevention and product analytics, which we keep limited and pseudonymous.
• Consent: microphone and speech recognition access, which you grant through your device’s permission prompts and can withdraw in your device settings.
• Legal obligation: where we must keep or disclose information by law.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent. You can delete your data yourself in the app. For anything else, contact us at hello@pamukk.com. If you are in the UK or EEA, you also have the right to complain to your data protection authority, such as the UK Information Commissioner’s Office.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information to infer characteristics about you. To exercise your rights, contact us at hello@pamukk.com.

Children

Tidbits is not intended for children under 16, or a higher age where the law requires it, and we do not knowingly collect personal data from them. If you believe a child has used Tidbits, contact us at hello@pamukk.com and we will delete their data.

Changes to this policy

We may update this policy as Tidbits changes. We will post the new version here with a new effective date. For material changes, we will take reasonable steps to let you know and, where the law requires, ask for your consent. Previous versions are available on request.

Contact us

Pamukk Ltd is responsible for your personal data in Tidbits. For questions about this policy or your data, email hello@pamukk.com.