Filacium · Privacy Policy

Current privacy policy; older app versions may show an earlier copy.

中文

In one sentence

Filacium keeps your records on your device by default, encrypted at rest. There is no account,

no advertising, and no third-party analytics. When you choose to sync, share, export, or back up data,

it can leave this device as part of that action. Care data reaches our server only if you enable care notifications.

Where your data lives

• Records, field definitions and attachments all stay on this device, in a database encrypted in full by SQLCipher.
• The database key lives in the system keychain, protected by the device's secure hardware. It is never sent anywhere.
• Photos, recordings and other attachments are encrypted before they are written to the app's sandbox.
• You can set a passphrase for the app or for an individual logbook. A forgotten passphrase cannot be recovered — we hold neither your passphrase nor a copy of your data, so there is nothing for us to reset.

What we don't do

• No accounts or sign-up, and no phone number or identity document is required to use the app. Values you separately choose to share through Care notifications are described below.
• No advertising or analytics SDKs, no cross-app tracking, no advertising identifiers.
• We never sell or trade your data.
• We do not store complete records or attachments on our care server. The selected fields you separately choose to share with a care contact may be held encrypted, then decrypted and included in an email.

The feature that uses our server: Care notifications

Care Check-in lets you set a recurring check-in for a logbook, so that a person you choose is notified

if you go quiet for too long — or hears the good news when you hit a streak. It is off by default.

If you have never enabled care notifications, your local check-ins are not sent to our care server. Turning the feature off after using it can still require an online request to remove an existing watch.

Before enabling care mail for a logbook, you choose its service region. That choice stays with the logbook and does not change automatically when you travel or change your device settings. For Mainland China, the care server runs on Alibaba Cloud in China and sends mail through Alibaba Cloud DirectMail from `care@mail.filacium.cn`. For other regions, the care server runs on DigitalOcean in Frankfurt, Germany, and sends mail through Resend's `us-east-1` region in the United States from `care@mail.filacium.com`. The selected server receives the encrypted care data described below; the corresponding email provider receives the recipient address and message content when a message is sent.

Only when you explicitly enable care notifications for a logbook does the following reach our server:

• random service tokens and, where needed, a derived care-group identifier used to coordinate the same person's logbook across paired devices. These are not advertising or hardware identifiers, but are associated with the care configuration and activity they serve;
• your care contact's email address and name, plus the name you want the message signed with — uploaded inside a public-key encrypted envelope, so the server holds only ciphertext at rest;
• your check-in times, cadence settings, time zone, pause settings and care-rule preferences. The server retains the check-in and delivery status needed to decide when to send mail;
• if you separately enable open fields, the names and values of your selected fields from the latest record are sent inside an encrypted envelope. You can select more than one field. Depending on your selection, this can include text, names, phone numbers, email addresses, postal addresses, amounts, dates or coordinates at their stored precision. This is off by default; photos and audio attachments cannot be selected.

The server decrypts the envelope in memory when sending care email, including a designation notice, missed-check-in alert, or positive update. The recipient address and message content then go to the email provider and recipient. Our Guard stores contact details and shared-field snapshots as ciphertext, not complete records or attachments. Encryption at rest does not make this processing anonymous: the service can decrypt the envelope, and names or shared values can identify people.

Turning care notifications off or removing a contact attempts to deregister the corresponding watch once the device is online; this can be delayed while offline. Deleting a watch does not delete all service tokens, operational logs or the email provider's delivery history. The server can also reclaim an unpaused watch after its alert quota has been exhausted and it has had no activity for more than 60 days; this is not a universal deletion deadline for all service data.

The app does not silently switch an existing logbook between these services. Mail providers may retain recipient addresses, message content and delivery information under their own policies. Deleting data on your device does not recall delivered email or delete copies held by the provider or recipient.

Permissions

These permissions are requested when related features are used. Local network access may be requested when you start pairing or a nearby transfer. Receiving sync requests from paired devices is a separate switch you can turn off. Declining a permission leaves unrelated features available:

• Camera / Microphone — attach photos and voice recordings to a record.
• Location — fill the current coordinates into a location field, and note where a Capture happened.
• Local network — sync with a paired device or send a logbook, form or backup straight to a nearby device, peer to peer, without a server.
• Face ID / Touch ID — unlock without typing your passphrase. Biometric data is handled by the system's secure enclave; the app never sees it.

Sharing and export you start yourself

Exported files, AirDrop, sending through the Files app — you initiate these and they go straight to the

recipient, never through our servers. Do keep in mind that an export contains your real data: once you

hand it to someone, where it travels next is no longer under your control or ours.

Backup and migration

Backup bundles created in the app are yours to keep. If you use Apple's iCloud or computer backups,

the device backup may include this app's data under Apple's rules — that part is governed by Apple's terms,

and we are not involved in it.

If you explicitly choose the app's iCloud Drive archive option, the encrypted backup bundle is copied to your iCloud Drive container for Apple to upload. This does not give us access to its contents, and saving the local copy does not guarantee that the upload has finished.

Deleting your data

• You can delete individual logbooks in the app. The release build does not have an "Erase all logbooks" shortcut in Settings.
• Deleting the app removes its local database and attachments. iOS may temporarily retain keychain credentials; on reinstall, the app clears orphaned credentials if its database is absent. Export or backup files you separately saved in Files or iCloud Drive are not automatically deleted with the app.
• Turning off care notifications or deleting a care contact makes the app attempt to deregister the matching server watch; completion can be delayed while offline.

Children

This app is not designed for children, and we do not knowingly collect personal information from them.

Changes to this policy

The current policy is published on our public privacy page with an updated date. The in-app copy is updated with app releases, so an older installed version may show an earlier copy. App Store privacy disclosures are maintained separately to reflect actual data practices.

Public support and privacy pages

Our public support and privacy pages are hosted by Cloudflare. Like other website hosts, it processes network request information such as your IP address and browser information to deliver and protect the pages. We do not add app records, care-contact details or service tokens to these page URLs, or add advertising or third-party analytics scripts to the pages.

Contact

For privacy questions, contact support@mail.filacium.com. If you send a support email, we and our support-email providers receive your sender address, message and any attachments you choose to send. Please do not include passphrases or sensitive records unless they are necessary for your request.

Last updated: 2026-10-15