Filacium · Privacy Policy

This page is the same text shown in-app under Settings → Privacy Policy.

中文

In one sentence

Filacium keeps your records on your device by default, encrypted at rest. There is no account,

no advertising, and no third-party analytics. When you choose to sync, share, export, or back up data,

it can leave this device as part of that action. Care data reaches our server only if you enable care notifications.

Where your data lives

• Records, field definitions and attachments all stay on this device, in a database encrypted in full by SQLCipher.
• The database key lives in the system keychain, protected by the device's secure hardware. It is never sent anywhere.
• Photos, recordings and other attachments are encrypted before they are written to the app's sandbox.
• You can set a passphrase for the app or for an individual logbook. A forgotten passphrase cannot be recovered — we hold neither your passphrase nor a copy of your data, so there is nothing for us to reset.

What we don't do

• No accounts, no sign-up, no phone numbers, no identity documents.
• No advertising or analytics SDKs, no cross-app tracking, no advertising identifiers.
• We never sell or trade your data.
• We do not store complete records or attachments on our server. A field value you separately choose to share with a care contact may be held encrypted, then decrypted and included in an email.

The feature that uses our server: Care notifications

Care Check-in lets you set a recurring check-in for a logbook, so that a person you choose is notified

if you go quiet for too long — or hears the good news when you hit a streak. It is off by default,

and while it is off the feature runs entirely on your device and collects nothing.

Before enabling care mail for a logbook, you choose its service region. That choice stays with the logbook and does not change automatically when you travel or change your device settings. For Mainland China, the care server runs on Alibaba Cloud in China and sends mail through Alibaba Cloud DirectMail from `care@mail.filacium.cn`. For other regions, the care server runs on DigitalOcean in Frankfurt, Germany, and sends mail through Resend's `us-east-1` region in the United States from `care@mail.filacium.com`. The selected server receives the encrypted care data described below; the corresponding email provider receives the recipient address and message content when a message is sent.

Only when you explicitly enable care notifications for a logbook does the following reach our server:

• a random device token that carries no identity and links to nothing else you own;
• your care contact's email address and name, plus the name you want the message signed with — uploaded inside a public-key encrypted envelope, so the server holds only ciphertext at rest;
• your check-in cadence settings (how long counts as missing, how many reminders at most) and your time zone, which is what tells the server when a message is due;
• if you separately turn on the open-field option, the most recent value of that one field travels with the message, inside the same envelope. This is off by default.

The server decrypts the envelope in memory when sending care email, including a designation notice, missed-check-in alert, or positive update. The recipient address and message body then go to the email provider. The server does not retain that plaintext or receive your complete records; if you enable an open field, its selected value appears in the email. Turning care notifications off or removing a contact attempts to deregister the corresponding watch once the device is online; this can be delayed while offline. Watches that stay inactive for a long time are also reclaimed automatically.

The app does not silently switch an existing logbook between these services. Mail providers may retain delivery data under their own policies.

Permissions

These permissions are requested when related features are used. Local network access may be requested when you start pairing or a nearby transfer. Receiving sync requests from paired devices is a separate switch you can turn off. Declining a permission leaves unrelated features available:

• Camera / Microphone — attach photos and voice recordings to a record.
• Location — fill the current coordinates into a location field, and note where a Capture happened.
• Local network — sync with a paired device or send a logbook, form or backup straight to a nearby device, peer to peer, without a server.
• Face ID / Touch ID — unlock without typing your passphrase. Biometric data is handled by the system's secure enclave; the app never sees it.

Sharing and export you start yourself

Exported files, AirDrop, sending through the Files app — you initiate these and they go straight to the

recipient, never through our servers. Do keep in mind that an export contains your real data: once you

hand it to someone, where it travels next is no longer under your control or ours.

Backup and migration

Backup bundles created in the app are yours to keep. If you use Apple's iCloud or computer backups,

the device backup may include this app's data under Apple's rules — that part is governed by Apple's terms,

and we are not involved in it.

Deleting your data

• You can delete individual logbooks in the app. The release build does not have an "Erase all logbooks" shortcut in Settings.
• Deleting the app removes its local database and attachments. iOS may temporarily retain keychain credentials; on reinstall, the app clears orphaned credentials if its database is absent. Export or backup files you separately saved in Files or iCloud Drive are not automatically deleted with the app.
• Turning off care notifications or deleting a care contact makes the app attempt to deregister the matching server watch; completion can be delayed while offline.

Children

This app is not designed for children, and we do not knowingly collect personal information from them.

Changes to this policy

When the policy changes, this page and the store listing are updated together, and the date at the

bottom of this page changes with them.

Contact

For privacy questions, reach us through the developer contact details on the App Store listing.

Last updated: 2026-10-02