Simory helps you save, search, and manage personal records from photos and voice notes. This policy describes what is stored on your device, what is sent to service providers, how long it is retained, and how to request deletion.
- Publisher: Fatih Uzulmez
- Privacy contact: fatihuzlmz@gmail.com
Information stored on your device
Simory stores the records you create, including text, titles, photos, dates, groups, reminders, pending photos, and app settings, in the app's storage on your device. Images shared into Simory may first be placed in its local App Group storage before the app imports them. Searches and Local photo scanning use on-device models. Choosing Local does not send the photo to Simory's scan service or Google Gemini.
Simory also keeps downloaded AI model files, local performance logs, and a randomly generated per-install token in the iOS Keychain for Cloud scan limits. The token is sent with Cloud scan requests. When performance sharing starts, Simory creates a separate random installation identifier for telemetry. The current Release build does not erase downloaded model files, local performance logs, or the Cloud token when you use Factory reset.
Your device's backup settings may include app data in an Apple device backup. Simory's Export backup feature creates a folder containing the records database, photos, pending photos, reminders, and selected settings. That exported folder is not encrypted by Simory. If you save or share it through Files, iCloud Drive, AirDrop, or another service, that service's storage and sharing practices apply. AI model files and performance logs are not included in Simory's exported backup. Simory does not store app backups in Railway.
Cloud photo scanning
Before you take a photo, Simory offers a choice between scanning on your iPhone and Cloud scan. The Cloud choice explains that it sends the photo to an external AI service. If you choose it and take a photo, Simory sends that photo as a JPEG over HTTPS to our scan service hosted by Railway, without a second confirmation. The request includes a random per-install token. Railway forwards the photo to Google Gemini for image analysis and returns extracted fields and a summary. Simory saves the photo and any result you choose on your device. If a Cloud scan fails, its pending photo is labeled Cloud and its retry button says Retry Cloud Scan. Compare, when offered, sends the photo through the same Cloud path and also processes it locally.
The Railway scan service processes the photo and result in memory and does not save them to its database or a persistent file store. Its PostgreSQL database stores a SHA-256 hash of the per-install token, a UTC date, and a scan count to enforce daily limits. The raw token is not stored in that table. These counter rows have no automatic expiration and remain until manually deleted or the database is removed. Railway currently has no configured database backup for this service.
Railway also creates infrastructure logs for requests to its public service domain. These logs include the source IP address, user agent, request path, timestamp, request ID, method, host, response status, timing and byte counts, and edge region. They do not contain the photo request body. Railway's staff has stated that logs may be retained for up to 90 days, cannot be disabled or individually deleted early, and are stored in the United States (US West), even though the application service runs in US East (Virginia). Railway's log documentation describes plan-based dashboard visibility periods; storage retention can differ from the visible period.
The service uses the Gemini API directly and does not use Google's Files API. The production API key is held as a Railway environment variable and is not included in the app. Google receives each Cloud photo and its generated response. Under Google's Gemini API terms for Paid Services, Google does not use prompts, photos, or responses to improve its products, but retains prompts, contextual information, and outputs for 55 days for abuse monitoring and required legal or regulatory disclosures, as described in its abuse-monitoring guidance. Google may process or temporarily cache this information in countries where it or its agents operate. Google's approved zero-data-retention arrangement can change what is retained. We have not yet confirmed that the production API key is attached to an actively billed Paid Services project or checked the project's logging and dataset settings; this draft must be verified against those settings before publication. If the project is treated as an Unpaid Service, Google's terms allow it to use submitted content and generated responses to improve its products, and human reviewers may process that content.
Photos of personal documents can contain sensitive information. Review the selected scan route and the disclosure above before you choose to send a photo.
Voice notes and Speech
If you use voice entry, Simory asks for microphone and Speech Recognition permission. It requests on-device recognition when your device supports it. Otherwise, Apple's Speech framework may send audio to Apple servers for transcription. Simory stores the resulting transcript only when you choose to save it as a record. Apple's handling of server-processed audio is governed by Apple's privacy policy.
Usage and performance data
After you complete onboarding, Share app usage and performance data is enabled. You can turn it off in Settings at any time. While on, Simory uploads events about feature use and performance, plus Apple MetricKit crash or hang diagnostics, to our Railway service to improve the app. Events include actions such as scanning, asking, saving, editing, and deleting; their timing, counts, and scores may be included. Uploads include a persistent random installation identifier, app version and build, device model, iOS version, timestamps, event names, durations, counts, scores, and diagnostic payloads. These events do not intentionally include record text, photos, questions, or transcripts. Diagnostic payloads may contain technical details about app failures. Only events recorded after onboarding is completed and sharing is enabled are eligible; turning sharing off stops future uploads, cancels an active request, and deletes queued diagnostics on your device. It does not delete information already received by Railway. Existing installations keep their saved sharing choice.
The /v1/batches and /v1/diagnostics
endpoints receive enabled telemetry. Event and diagnostic records are
stored in the Railway PostgreSQL database without automatic expiration.
There is no in-app or automated deletion endpoint. We can attempt to
locate and remove records manually after a request, using the
installation identifier available in Settings.
Railway infrastructure logs may also record request metadata for its public domain as described in Cloud photo scanning.
Model downloads and network information
Simory downloads AI model files from Hugging Face when needed. Hugging Face and network providers may receive ordinary connection information, such as your IP address, when downloads occur. Downloaded model files remain on your device and are not included in Simory's exported backup. Cloud scans send request data through Railway and Google as described above.
How information is used and who receives it
On-device records support capture, search, reminders, and backup or restore. Cloud scan photos are analyzed to return scan results. Railway uses a token hash, date, and counter to enforce daily scan limits. Opted-in performance events and diagnostics are used to investigate app reliability. Simory does not use records or photos for advertising.
The outside services involved are Railway, which hosts the scan service and its database; Google, which processes Cloud scan photos; Apple, which may process Speech requests and device backups; and Hugging Face, which provides model downloads. Railway's privacy policy, published Data Processing Addendum, and subprocessor list describe Railway's processing. We have not verified whether a separate account-specific DPA action has been completed. Google's Gemini API terms and data processing terms apply to its processing.
Retention and deletion
Records, saved photos, pending photos, reminders, and settings remain on your device until you delete them, replace them by importing a backup, use Settings → Factory reset, or remove the app. Deleting an individual record also deletes its associated app photo and reminder. Factory reset deletes the app's records database, app photos, pending photos, and reminders and resets selected settings. It does not delete copies you exported or placed in Apple or other backups. It also does not currently erase downloaded model files, local performance logs, or the Cloud scan token.
Railway's per-install scan counters and telemetry/diagnostic records currently have no automatic expiration. Railway infrastructure logs may remain for up to 90 days and cannot be deleted early by us. Google retains paid-service prompts, photos, and responses for 55 days under its published abuse-monitoring terms, unless an approved zero-data-retention arrangement applies; legal requirements may require additional retention. Google project logs or datasets may have separate settings and retention. Deleting a local record or using Factory reset cannot recall a photo already processed by Google or erase a copy kept by a service provider.
For privacy questions or to request deletion of data held by us, email fatihuzlmz@gmail.com. We may need the app installation's Cloud token or other details to locate a scan counter, or the telemetry identifier available in Settings to locate performance data. Do not email document photos or record contents unless we specifically need them to handle your request. We will review deletion requests and remove matching database records where they can be identified; Railway infrastructure logs cannot be individually deleted early. You can also delete local records one at a time, use Factory reset, and remove exported backups from each place you saved them.
Railway currently has no configured PostgreSQL backup. If we enable backups or change retention practices, we will update this policy.
Your choices
You can choose on-device scanning instead of Cloud scanning, cancel before taking a Cloud photo, turn off performance sharing in Settings, deny microphone or Speech permissions and type notes instead, delete individual records, or use Factory reset in Settings. You can remove exported backups from wherever you saved them.
Changes and contact
We may update this policy as the app or service providers change. The date at the top shows when it was last revised. For privacy questions or deletion requests, contact Fatih Uzulmez at fatihuzlmz@gmail.com.