Privacy Policy

Last updated: July 22, 2026

Fond ("the app", "we", "us") is operated by Marar Inc. Fond is a personal voice journal: you record voice and text notes, optionally attach photos, and the app transcribes them and organizes the people, places, and moments they mention so you can look back and ask questions. This policy explains what we collect, why, who processes it, and the choices you have. We designed the app to keep your journal private to you.

Information we collect

• Account information — your email address, optional display name, and the identifier from your sign-in provider (Apple or Google) when you use social sign-in. Passwords for email accounts are stored only as a salted PBKDF2 hash, never in plain text. Before you create an account, you can use Fond as a guest: a guest session is identified only by a random identifier we generate on our servers — no email, name, or other personal detail is collected until you sign up.
• Your content — the voice recordings, text notes, and photos you create, and the transcripts and derived information produced from them (for example the people, places, activities, and tags the app extracts to build your personal knowledge graph). You can record your first few notes as a guest, before creating an account: those recordings and their transcripts are processed and stored the same way, under your guest identifier, and become part of your account when you sign up.
• Usage analytics — anonymous, behaviour-only product analytics (which actions you take, counts, and durations). We deliberately never send your note content, transcripts, names, search text, or questions to analytics. We do use masked session replay to understand how the app is used, but every piece of text, every image, and all audio is masked or blocked on your device before anything leaves it — so your journal content is never visible in a replay. Replays and analytics events are tied only to an opaque account identifier, not your name or email.
• Crash and error diagnostics — content-free crash and error reports (the app version, the screen or route where a problem happened, and a scrubbed technical error message) so we can find and fix bugs. These never contain your journal content, email, or name.
• Advertising and measurement — to run our own ads (to reach more people who might like Fond), we use Meta's advertising SDK. On iOS it collects your device advertising identifier (IDFA) only if you grant permission when the App Tracking Transparency prompt appears; on Android it uses your advertising ID. We also record a small set of app events — that Fond was installed and opened, that you created an account, started your free month, or subscribed — so Meta can measure and optimise our ads. These are counts and amounts only; your recordings, transcripts, names, and search text are never involved.
• Technical data — standard request information (such as device time zone for resolving "today") needed to operate the service.

How we use your information

• To transcribe your recordings and provide the core journaling, search, and "ask" features.
• To extract and organize entities (people, places, activities) and generate summaries, reflections, and answers grounded in your own notes.
• To operate, secure, debug, and improve the service.
• To measure and optimise our own advertising and understand which sources bring people to Fond.

We do not sell your personal information, and we never use your journal content — your recordings, transcripts, notes, names, or searches — to target or serve advertising. We do use Meta's advertising tools to measure and optimise our own ads, as described under "Advertising and measurement" above and "Service providers" below; on iOS this happens only with your App Tracking Transparency permission.

Service providers who process your data

We share data only with the processors needed to run the app:

• Cloudflare — hosting, storage of your audio and images, the database that holds your notes and knowledge graph, and Workers AI, which performs on-platform speech-to-text transcription and generates the embeddings used for search.
• Anthropic (Claude) — your transcript and note text are sent to Anthropic's API to extract entities and to generate the answers, summaries, and reflections you request. Anthropic processes this content to return results to the app.
• PostHog — anonymous, content-free product analytics, masked session replay, and crash/error diagnostics as described above.
• RevenueCat — manages your Fond Pro subscription and its entitlement across devices; it processes your subscription status and store transaction data, never your journal content.
• Meta (Facebook) — our advertising SDK. With your App Tracking Transparency permission on iOS, it receives your advertising identifier and the app events described above so we can measure and optimise our own ads. Your journal content is never shared with Meta.
• Apple and Google — only to verify your identity token when you choose "Sign in with Apple" or Google sign-in.

Data security and retention

All data is encrypted in transit (HTTPS/TLS). Session tokens are stored on your device in the system keychain and only as a hash on our servers. We retain your account and content until you delete them or delete your account. You can delete an individual note at any time, or delete your entire account and all associated data as described below. Canceling a Fond Pro subscription does not delete anything — your account and content remain available to you until you choose to delete them. Guest notes that are never attached to an account are automatically and permanently deleted after 14 days.

Your rights and choices

• Access & portability — your content is always visible to you in the app. Contact us for an export.
• Deletion — delete your account at any time in the app under Profile → Delete account, which permanently removes your account, recordings, images, transcripts, and derived entities. You can also request deletion on the web at keepfond.com/delete-account.
• Ad tracking — on iOS you can decline the App Tracking Transparency prompt, or change your choice any time in Settings → Privacy & Security → Tracking. If you decline, we do not collect your advertising identifier and Meta cannot use your activity to measure our ads. On Android you can reset or limit your advertising ID in your device settings.
• Depending on where you live (for example the EEA, UK, or California) you may have additional rights to access, correct, or restrict processing of your data. Contact us to exercise them.

Children

Fond is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

International transfers

Our providers may process data in the United States and other countries. We rely on their contractual safeguards for any cross-border transfers.

Changes to this policy

We will update this page and revise the "Last updated" date when this policy changes.

Contact

Questions or privacy requests: Email us.