Privacy Policy

Effective 21 September 2026 · version 2026-09-21

Favemark is a photo notebook. You take a photo, an AI reads it and suggests tags, you give it a rating, and later you find it again by tag, date, place, a similar photo, or by asking. Making that work means sending your photos to companies other than us. This page says exactly which ones, exactly what they get, and what we keep.

It describes the app as it is actually built today, not as it is planned. Where something is designed but not built, it says so.

1. What we collect

• Your account. Your email address and a one-way hash of your password — we never store the password itself. Signing up creates a short-lived email-verification token; signing in creates a random session token.
• Your photos. We keep the original file exactly as you sent it, byte for byte, and generate a small thumbnail from it. Note that some cameras write metadata — including GPS coordinates — inside the image file itself. Favemark does not strip that metadata out of the stored original. The same goes for the extra photos, and any video you attach to a note: the file as sent, with a small preview, until you delete it.
• What you record about a photo. Your rating, anything you type, the tags and categories the AI suggested or you corrected, the brand and any text the AI read off the item, a venue if you attach one, and a source URL if you saved something from the web. Beside each label we keep the vocabulary it belongs to — the other names your library uses for it and how your categories nest — and, if you read a script other than the label's own, a Latin-script spelling of each label, kept for display and search.
• Location — only if you switch it on. Favemark never asks for location by itself. The system permission dialog appears only after you tap to enable it. While it is enabled and granted, a capture records the coordinates where it happened. See §3 for what is done with them — the short version is that they never leave our server.
• A similarity fingerprint of each photo — a list of numbers produced by an embedding model, which is what makes “find similar” work across your own library.
• A record of each AI call: your account id, which feature ran, which model, how many tokens, and an estimated cost. For a call to Google, it also says whether the call worked or how it failed, and how long it took. A call to Google that failed gets a record too. The contents of the call are not stored in this record.
• Performance records — how long you waited. Each time you take a photo to rate, or snap something to check whether you have tried it, the app sends our server one small record of how long each step took. It is sent once the answer has appeared, or once the attempt failed or you left. It holds the photo's size in bytes, how long the upload took, and which of the app's upload methods sent it. It holds how long saving the note and our server's reply took, and when a location fix arrived (or that none did, or that location was off). It holds our server's own time for each step, such as reading the photo and the model call, and which model answered. And it holds how long until the answer appeared, whether it failed or you left first, and which build of the app was running. It never holds the photo, anything about what is in it, where you were, your network type or your phone's model. We keep the newest 500 per account (see §5). Only the operator reads them, and only as medians and percentiles, to find what makes the app slow. They are never sent to anyone else and never used for anything else.
• Your assistant conversations. The conversation attached to a note, and each research chat you start, are saved so you can reopen them — the newest 40 messages of each; older turns drop off the saved copy. Chats you have from the home screen or the search screen are not saved. A note's conversation is deleted with the note; research chats go only with your account (see §5).
• Your reactions to the assistant. Each thumbs up or down you give a reply, together with the reply it was on, kept to measure how the assistant is doing. Deleted only with your account.
• Reports you file about a reply. The reply you flagged, a few of the turns before it, and the reason you gave, if any. The operator reads them. Deleted only with your account.
• Your Recent list. The last 100 things you looked for — a photo find, a shelf scan, a search, a research chat — each with a trimmed snapshot of the answer, so you can get back to it. Once there are 100, each new one deletes the oldest.
• Shelf scans. A few records per shelf you read: which products it resolved to, which model read it, how many items it recognised, how many tokens it used, what it cost and how long it took — never the photo — kept to measure how the shelf reader is doing, and deleted only with your account. A per-scan budget row that limits how much research one scan can trigger is deleted after seven days.
• Undo snapshots. When the assistant applies a change to a note, a copy of the note's fields from before and after, so that a thumbs-down can put them back exactly. Deleted with the note.
• A connector, if you set one up. A token (stored only as a one-way hash) that lets an AI assistant you use elsewhere save to-try notes into your library over the MCP protocol, and when it was last used. It can create to-try notes and read nothing. Regenerating or revoking it in Settings deletes it at once.
• Your settings — the language your tags are shown in, which scripts you read, how much effort the AI spends on your requests, a display name if you set one — the only setting another person can read, and only through a link you created (§6) — and your image-processing agreement: whether you have agreed, which version of this disclosure you agreed to, and when. If you create a link (§6), we also keep the link itself, the claims guests make through it, and a per-day count of the questions guests asked across all your links.

We do not use third-party analytics, advertising SDKs, crash reporting, or any tracker. There are none in the app. What we do measure is our own and listed above — how long you waited (the performance records), how the assistant is doing (your reactions), and how the shelf reader is doing (the shelf scans) — and all of it goes only to our server.

2. Who else receives your data

Five outside services are involved. Three of them receive your photographs. What each of them does with what it receives is governed by its own policy, linked below; we have no arrangement with them beyond their standard terms for developers.

Agreeing to this, and taking it back

The app asks before your first photo is processed. The screen describes the processing — what is sent, why, and that it runs both automatically and when you ask — and points here for the companies currently doing it (see §9 for why it is worded that way). It records which agreement you accepted. You can decline, and you can change your mind later in Settings → Image processing.

Your agreement covers processing, not just uploading. While it is switched off, no photo of yours is sent to any of those companies — not a new capture, and not one already stored on our servers. That includes re-tagging a photo, re-framing it, making a different photo the main one, “find similar”, reading a label shot, looking up the maker's own page for something you rated, and asking the assistant about a note that has a photo. Those last ones matter because they happen after the capture, at a moment of your choosing rather than ours, and until August 2026 several of them ran without consulting your agreement at all. They no longer do.

Two limits, stated plainly. Turning it off does not reach back into anything already sent — see §5. And notes without a photo still work: asking the assistant about one sends text, not an image, so it is not held back.

A note on web search

“Identify this” and the assistant's research answers use a web-search tool that runs inside Anthropic's service. Search terms derived from your photo or your question are sent by Anthropic to its search provider and reach the public web. We do not control or see that onward step beyond the results that come back.

Since 23 August 2026 this can also happen without you asking. On a paid account, when you rate something and we cannot identify it from a barcode, the app sends that photo to Anthropic in the background and asks it to find the manufacturer's own page for the item. It is the same company, the same downscaled copy and the same web search as “Identify this” — what is new is that nothing you tapped named the item. The agreement the app asks for covers this: it says plainly that processing runs both automatically and when you ask, with no condition attached. §9 explains when a change would make us ask you again — and why this kind does not.

Fetching a picture from the maker's website

When that lookup finds the manufacturer's page, our server downloads the product photograph published on it and stores it beside your own, labelled as not yours. Those websites receive nothing about you. The request is made by our server rather than by your phone, so the site sees our address and the picture we asked for — never your IP address, your account, your photo, or your notes.

They are not listed above with the five named services because they are not a fixed set with a policy we could link: it is whichever page turns out to describe the thing you photographed. If you hold rights in such a picture, §10 says how to have it removed.

3. What never goes to an AI model

These are properties of how the app is built, not statements of intention:

• Your location coordinates. When location is on, coordinates are used only by our own server, as arithmetic that re-orders candidates the model already produced — nudging results toward things you have recorded near this spot. They are never placed in a prompt and never leave our server. The consent you grant in the app does cover place features that would include where you captured something; no such feature exists yet, and this policy's version will move — and this line with it — before one does.
• Your email address, your password, and your session token. Prompts carry an opaque account identifier so the request can be scoped — never your credentials or your address.
• Anyone else's photos, notes, or tags — in anything you ask. And your own reach a model at someone else's request only through a link you created (§6). Every database read is filtered to one account before anything reaches a model: yours when you ask, and the link's owner's — never a photo — when a guest asks through a link the owner made.
• Your library, in our own testing. The evaluation and prompt-tuning tools we run against this app operate on fixed test cases, our own prompt files, and screenshots of public pages. They never read a real library.

4. Where your data is kept

• Photo files sit on the filesystem of a single rented virtual server. Your notes, tags, ratings, coordinates and account record sit in a PostgreSQL database on the same machine.
• Both are backed up nightly, and the backup set is copied to a second server, where roughly the last two weeks are retained.
• Not encrypted at rest. Neither the photo files nor the database are encrypted on disk. Anyone with access to those servers — which means the operator and the hosting provider — can read them. Traffic between your device and us is encrypted in transit (HTTPS).
• No guaranteed processing region. We do not operate region-pinned infrastructure and make no claim about which country your data is processed in. Anthropic, Google, Voyage AI, Open Food Facts and the email provider may process it in countries other than yours.

5. How long we keep it, and how to delete it

• Photos are kept until you delete them. There is no automatic expiry. Deleting a photo in the app removes the note attached to it, its tag links, its similarity fingerprint, its undo snapshots and its conversation — immediately and permanently from the live system. The file itself, and its thumbnail, are removed by a follow-up step that retries until it succeeds — usually at once. Until it does, a removal record waits: the file's storage key, the account it belonged to, how many attempts have failed and when to try again, and nothing else. That record is kept even after you delete your account, because it is the only thing that can still find the bytes; the retries run when another deletion happens or when we run the sweep by hand, not on a fixed schedule.
• Performance records keep only the newest 500. The records of how long you waited (§1) are kept per account. Once there are 500, each new one deletes the oldest. They are deleted with your account.
• Backups lag deletion. Something you delete can survive in nightly backup copies for roughly two weeks before those copies age out.
• You can delete your whole account, from inside the app. Settings → Account → Delete account, confirmed with your password. That removes everything at once — every photo and every version we derived from it, notes, ratings, comments, tags, saved places, assistant conversations, reactions, reports, the Recent list, shelf-scan records, undo snapshots, the connector, any links you shared, the claims guests made through them and the per-day counts of their questions (§6), settings and the account itself — immediately and permanently from the live system, with the one exception above: the files' removal records stay until each file is confirmed gone. It signs you out on every device. We cannot restore it afterwards. Your email address is released, so you can sign up again later; it will be a new, empty account. If you no longer have the app installed, see favemark.app/delete-account.
• Some smaller things you still cannot delete yourself. Tags, and venues you have saved, have no individual in-app delete in the current build — notes and photos do, and so does the account as a whole. Neither do research chats, your reactions to the assistant, the reports you filed, the shelf-scan records or the per-day counts of guests' questions: those go only with the account (revoking every link leaves the counts). Email us at privacy@favemark.app and we will delete them by hand.
• What has already been sent out is out of our hands. Deleting a photo here does not reach back into Anthropic's, Google's or Voyage AI's systems, or into your email provider's. Their retention is governed by their policies.

6. Who can see your library

Only you, and the operator of the service — unless you choose otherwise, in the one way described just below. Every request is checked against your account before anything is read, and another account's photo is indistinguishable from a photo that does not exist.

There are no public profiles, no shared libraries, and no groups or circles. Nothing of yours is visible to another person by default, and nothing becomes visible as a side effect of anything else. The one exception is a link you create yourself, which is described next; the thing after it is shared with everyone and holds nothing of yours.

A link you can share: an assistant that answers about one category

You can give someone a link to an assistant that answers questions about your rated notes in one category — the wines you have tried, say — without them signing in or installing anything. You create it, it covers one category you pick, and it works for anyone who has the URL until you revoke it; revoking deletes the link and everything stored under it. The app has no screen for creating one yet: the service can serve a link today, but until that screen ships a link exists only if you made one yourself against the service directly. When the screen ships, this page will not need to change, because what a link can reveal is fixed here.

What a link discloses

• The display name you set, the name of the category, how many rated notes it holds, and the note to guests you wrote when you created the link, if any — shown on the page to anyone who opens it.
• Through the assistant's answers: your rated notes in that category — at most the hundred you rated highest — as the item's title and brand, its category and kind, your score, your comment, the place name you attached, and the date you captured it.
• That is what a guest can ask about. The assistant answers only from those notes and the note to guests; it has no web search and no other tools on this path.

What it never includes

• Any photo, or any pointer to one — not yours, and not a manufacturer's.
• Where you were: no coordinates, and only the date of a capture, never the time of day.
• Any other category, and nothing you have not rated — your to-try list stays yours.
• Your tags, your email address, your account identifier, or anything else in your library.
• One caveat, stated plainly: what you typed travels as you typed it. Your comment on a note and your note to guests are shown verbatim, so an address, a link or a name written into one reaches every guest.

What is kept, and what is not

A guest's questions and the assistant's answers are not stored. The conversation exists only in the guest's browser tab, and each question resends it to be answered. What you see is counts and a last-opened time only: how many times the link was opened and when it was last opened, how many questions were asked, and how many “I'll bring this” claims currently stand (claims, not people — one guest may claim several items). You never see what was asked, what was answered, or which items were claimed.

A guest's question — with the notes the link discloses and your note to guests — goes to Anthropic to be answered, under your account: it counts against your daily allowance and is logged in your record of AI calls. It is the same company and the same kind of processing your library already goes through, at a stranger's request; no photo is involved, and the request carries the link's identifier rather than your account's. Creating the link is what allows it — see §9 for why this is disclosed here rather than asked again in the app.

If you give the link an occasion, a guest can say “I'll bring this” about an item the assistant mentioned. That is stored as one row naming you, the link and the note — no text from the guest, no name, no address, no device fingerprint. Other guests are told only that someone may already be bringing that item, never who. The rows are deleted when you change the occasion, revoke the link, or delete your account.

If you are the guest, this is what Favemark holds about you: nothing that names you. Your network address is counted in our server's memory to limit abuse — an hourly count, held in memory until the server restarts or the entry is evicted, and never written to the database, to disk or to a log. If you say you will bring something, the secret that lets you take that back is kept in your own browser, not on our server.

One thing that is shared: a product index — and nothing of yours

When the packaging in one of your photos is read clearly enough to be sure what the product is, Favemark records that product's identity — as printed on the pack — in a shared index, and links your note to the entry. It is how the app comes to know a product exists at all: entries are grown by use rather than bought or hand-built, so the next person who photographs the same thing meets it already there.

What it holds

• The product's identity as read off the packaging: brand, product name, variant, and the pack sizes it has been seen in — kept in a canonical form (lowercased, accents folded) so that two readings of the same product meet each other, alongside the spelling that founded the entry.
• Public facts about the product — ingredients, nutrition, specifications, certifications, awards, third-party ratings — each stored as a value with a link to the page it was taken from, the kind of source it was (the maker's own site, a retailer, a review, an aggregator), and when it was fetched. At most one attributed sentence of quoted text is kept beside a value; no article text, no prose and no images are copied. A fact with no source link is discarded rather than stored.

What it never holds

• Any photo, or any pointer to one: no photo id, no crop, no thumbnail, no similarity fingerprint.
• Your account, or any pointer to it: no account id, no email address, no session.
• Anything you recorded: your notes, your ratings, your comments, your tags, your assistant conversations, or anything else you typed.
• Any count of how many people have photographed a product, or when the first of them did.

Any signed-in user, through the same authenticated routes as the rest of the app. The entries are about products, not about people: nobody reading one can tell who photographed the thing, or that you did. What an entry does reveal is that someone, at some point, photographed that product — and that is all it can reveal, because nothing in it points back at a person. Your own library is untouched by this; the first paragraph of this section still holds in full.

7. Cookies and device storage

The website sets one cookie, favemark_session, which identifies your signed-in session. It is strictly necessary — without it you cannot stay signed in. There are no analytics or advertising cookies.

The mobile app uses no cookies. Its session token is held in the device's own secure keystore (the iOS Keychain, the Android Keystore), not in ordinary app storage.

A shared assistant page (§6) sets no cookie. The only thing it keeps in a guest's browser is the secret behind an “I'll bring this” they made, so they can take it back; nothing else is stored on their device.

8. Children

Favemark is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.

9. Changes to this policy

This page carries a version stamp (2026-09-21). When what we disclose here changes materially — a new company receiving your data, a new category of data leaving our servers — the version moves, so you can always tell which text you were shown.

What you agree to in the app is a category of processing, not a list of companies. The in-app agreement says what leaves (a downscaled copy of what you capture, text, an opaque account identifier — and, if you allow location, where you captured something, for place features), why (to tag, identify, organize and answer questions about it, including looking things up on the web), and that it runs both automatically and when you ask. The companies doing that processing are named on THIS page, which is versioned — so we can change an AI provider or model, for the same processing, by updating this page rather than by switching your photo features off until you re-agree. Your agreement covers the processing, not the vendor.

When would we ask you again? When the category itself widens: a kind of data leaving our servers that the agreement does not name, or a genuinely new purpose. Using your photos to train a model, for advertising, selling data, or showing your content to other users are all outside every agreement this app has ever asked for — any of those would be a fresh, explicit question, never an update to this page. And a new feature that needs more than you agreed to (place features are the example above) asks its own question at that feature's door — it does not switch off what you already use.

Not every change is that kind of change, and we would rather say so than imply a promise we do not keep. On 20 August 2026 we added Open Food Facts to the list above. It receives the barcode digits read from a photo's packaging and sends back the manufacturer's own picture of that product — it never receives a photo of yours. Nothing about where your photos can go became broader, so this page's version moved and you were not asked again.

On 3 September 2026 we added the shared product index described in §6. Nothing new leaves our servers and no photo is involved; what is new is that the identity of a product, read off its packaging, is kept in a table that is not yours alone. That is a change to what we keep and where, not to where your photos can go — so this page's version moved and you were not asked again.

On 18 September 2026 we added Google to the list above, and unlike the two changes before it, this one does change where your photos can go. Google now reads the same downscaled copy of a photo that Anthropic does, for the same jobs — suggesting tags, checking whether you have tried something, straightening a tilted shot — and is asked first, with Anthropic answering when it cannot. What leaves our servers and why it leaves are both unchanged, which is the rule above, so this page's version moved and you were not asked again. We use Google's paid service, whose terms do not let Google use what we send to improve its products.

On 20 September 2026 this page stopped saying that there is no sharing in Favemark, because that had stopped being true the morning before: the shared assistant link described in §6 went live on 19 September, and until this revision this page said nobody could see anything of yours while a link could show a guest your rated notes in one category. That is the kind of gap this page exists to close, and we would rather record it than tidy it away. The rule above holds: a guest's question goes to a company already named here, with text of yours that already goes there, for the same purpose — what is new is that a stranger can ask, and only through a link you chose to create. Creating the link is the question, asked at the moment you do it; so this page's version moved and you were not asked again.

On 21 September 2026 we checked every kind of record the service keeps against this page, and found eleven that §1 had never named: your saved assistant conversations, your reactions and reports, the Recent list, shelf-scan records, undo snapshots, the removal record that follows a deleted file, the connector token, video you attach, the Latin-script spellings of your labels, and the per-day count of guests' questions. None of them was new — the app had kept each since the feature it belongs to shipped — and none leaves our servers. What was wrong was this page, and it is now checked against the database schema by a test, so the next kind of record cannot ship unnamed. Nothing about where your photos can go changed, so this page's version moved and you were not asked again.

One correction, for the record. The 23 August 2026 revision of this page said we had asked everyone to agree again, after the automatic lookup in §2 outgrew wording that had been tied to you asking. That re-ask was queued but never reached anyone's device, and on 26 August 2026 we replaced it with the category-based agreement described above — which covers the automatic lookup outright instead of re-asking you about a condition we should never have promised. Nobody's photo features were switched off, and nothing about where your photos can go widened between those two texts.

10. Contact

Questions, corrections, or a deletion request from someone who no longer has the app installed (in the app it is Settings → Account → Delete account): privacy@favemark.app.

Reporting a picture we fetched. Some notes carry a manufacturer's product photo — pulled either from Open Food Facts, where contributors publish them under a licence that asks for credit, or, since 23 August 2026, from the maker's own website, where we hold no licence at all. Each is shown only to the person whose note it is, is stored with the page it came from and whatever credit that page carries, and is labelled in the app as not your own photo.

If you hold rights in such a picture and want it removed, write to the address above with the product or the page it came from. These images are derived and disposable, so removing one is a delete on our side and nothing else is lost. We can also switch the maker's-website step off outright, for everyone, without a release — so a request about a whole catalogue does not have to be answered one picture at a time.