Privacy Policy

Effective 24 September 2026 · version 2026-11-17

Favemark is a photo notebook. You take a photo, an AI reads it and suggests tags, you give it a rating, and later you find it again by tag, date, place, a similar photo, or by asking. Making that work means sending your photos to companies other than us. This page says exactly which ones, exactly what they get, and what we keep.

It describes the app as it is actually built today, not as it is planned. Where something is designed but not built, it says so.

1. What we collect

• Your account. Your email address and a one-way hash of your password — we never store the password itself. Signing up creates a short-lived email-verification token; signing in creates a random session token; asking to reset a forgotten password creates a short-lived password-reset token (it lasts an hour and is deleted when used). Tokens are stored only as one-way hashes.
• Your photos. We keep the original file exactly as you sent it, byte for byte, and generate a small thumbnail from it. Note that some cameras write metadata — including GPS coordinates — inside the image file itself. Favemark does not strip that metadata out of the stored original. The same goes for the extra photos, and any video you attach to a note: the file as sent, with a small preview, until you delete it. If you take a photo with Auto-crop off, or with your phone's own camera, we record that and make no automatic cropped copy of it.
• What you record about a photo. Your rating, when you last rated it or put it on or took it off your to-try list (that is what orders your Recent activity), anything you type, the tags and categories the AI suggested or you corrected, the brand and any text the AI read off the item, a venue if you attach one, and a source URL if you saved something from the web. Beside each label we keep the vocabulary it belongs to — the other names your library uses for it and how your categories nest — and, if you read a script other than the label's own, a Latin-script spelling of each label, kept for display and search.
• Location — only if you switch it on. Favemark never asks for location by itself. The system permission dialog appears only after you tap to enable it. While it is enabled and granted, a capture records the coordinates where it happened. See §3 for what is done with them — the short version is that they never leave our server.
• A similarity fingerprint of each photo — a list of numbers produced by an embedding model, which is what makes “find similar” work across your own library.
• A record of each AI call: your account id, which feature ran, which model, how many tokens, an estimated cost, and how long the call took. For a call to Google that reads a photo or text, it also says whether the call worked or how it failed, and an attempt that failed gets a record too. For the product lookup, which has a time limit, it also says whether the lookup ran out of time or returned an answer we could not use, and either gets a record. Any other call gets a record only when it returns an answer. The contents of the call are not stored in this record.
• Performance records — how long you waited. Each time you take a photo to rate, or snap something to check whether you have tried it, the app sends our server one small record of how long each step took. It is sent once the answer has appeared, or once the attempt failed or you left. It holds the photo's size in bytes, how long the upload took, and which of the app's upload methods sent it. It holds how long saving the note and our server's reply took, and when a location fix arrived (or that none did, or that location was off). It holds our server's own time for each step, such as reading the photo and the model call, and which model answered. And it holds how long until the answer appeared, whether it failed or you left first, and which build of the app was running. It never holds the photo, anything about what is in it, where you were, your network type or your phone's model. We keep the newest 500 per account (see §5). Only the operator reads them, and only as medians and percentiles, to find what makes the app slow. They are never sent to anyone else and never used for anything else.
• Request times — how long our server took. When you ask the assistant, scan a shelf, add a label photo, have a photo tagged or check a photo against your library, our server keeps one small record of how long it took to answer and how the request ended: answered, refused or failed, or left before the answer arrived. It holds which of those five it was, whether the answer was sent all at once or streamed, and for the assistant which kind of question it was. It holds no request or answer content: not your photo, your question, the answer or anything in them. We keep the newest 1000 per account (see §5). Only the operator reads them, and only as medians and percentiles, to find what makes the app slow.
• Photos waiting to be tagged. We can pause tagging for a while. If a photo's first tagging is paused, the photo is kept as usual, and we keep a record that it is waiting, so it can be tagged when tagging resumes. The record names the photo and when it started waiting, and counts how many times we have tried to tag it since. It holds no image and no text, and it is never sent to anyone. How long it is kept is in §5.
• Your assistant conversations. The conversation attached to a note, and each research chat you start, are saved so you can reopen them — the newest 40 messages of each; older turns drop off the saved copy. Chats you have from the home screen or the search screen are not saved. A note's conversation is deleted with the note; research chats go only with your account, or when you discard a Compare session, which deletes its chat (see §5).
• Your reactions to the assistant. Each thumbs up or down you give a reply, together with the reply it was on, kept to measure how the assistant is doing. Deleted only with your account.
• What you told the assistant to remember. When you tell the assistant something lasting about your own taste, or an allergy, it can save it as a memory, and it shows you each one it saves, with an undo. For an allergy or an intolerance the app asks first: nothing is kept until you tap Save, and we record when you agreed. A memory keeps your words as you typed them, the assistant's one-line reading of them, a short subject name, and one of your own categories when you have one by the name it gave. Only words you typed can become a memory, never a web page or the assistant's own reply. A newer memory on the same subject replaces the older one, which is kept, unused, so that undoing the newer one brings it back. Medical information other than an allergy is not saved. How long memories are kept is in §5.
• Shoot list photos. Only if we give your account a Shoot list: a list of things to photograph for us, which you agree to before your first photo. We keep the list, the note we wrote on it, when you agreed and when you sent it. For every photo you send for it we keep the photo exactly as your camera wrote it, which may include the location your phone recorded, with the labels you typed, when it arrived, and what our server worked out about it: its size, a fingerprint of its bytes, whether it names the camera that took it, and a sharpness score. No model reads these photos, and they go to none of the services in §2. The operator reads them. favemark may use them for any purpose without limit of time, and keeps the ones it uses permanently in its private code repository, which is hosted at GitHub. How long our own copy stays is in §5.
• Reports you file about a reply. The reply you flagged, a few of the turns before it, and the reason you gave, if any. The operator reads them. Deleted only with your account.
• Help reports and their replies. When you send a report from Help, we keep what it says (its kind, its title and the details you confirmed), your conversation with Help up to that point (the newest 30 turns), the facts your phone attaches (the app version and build, the update it is running, the platform and the operating system version), the screenshot you attached, if any, and every message you and Favemark exchange on it, with when each was sent and how far you have read. The operator reads your reports and answers them; nobody else sees them. A screenshot you attach but never send is removed once it is more than a day old, the next time our cleanup runs. We also keep a per-day count of how many reports and replies you sent, which is how the daily limit is kept. Help's chat itself is not saved: what you type to it goes to Anthropic to be answered (§2), and only what you choose to send as a report is kept. The assistant can draft a report too. One sent from the assistant keeps what it says and the facts your phone attaches, and no conversation, unless the report is about something the assistant itself said or did and you tick the box to attach the last six messages of that chat, shown to you before you send.
• Your Recent list. The last 100 things you looked for — a photo find, a shelf scan, a search, a research chat — each with a trimmed snapshot of the answer, so you can get back to it. Once there are 100, each new one deletes the oldest.
• Shelf scans. A few records per shelf you read: which products it resolved to, which model read it, how many items it recognised, how many tokens it used, what it cost and how long it took — never the photo — kept to measure how the shelf reader is doing, and deleted only with your account. A per-scan budget row that limits how much research one scan can trigger is deleted after seven days. When you tap products in the live camera view, we also keep, for each photo you took there, what was read on it, so the whole session can be kept as one row in your Recent list; these records are deleted after seven days. The photo itself stays with that row and goes with it (see §5), and the row follows the Recent list's rules. Which products you took out of a session is kept with that row. If you discard a session, its row, its chat, these records and its photos are deleted at once, and a marker saying it was discarded stays for seven days so that nothing still on its way can restore it. We also keep a per-month count of your Compare reads, which is how the monthly allowance is kept; it is deleted with your account. If you photograph the back of a pack in a Compare session, the photo is read the way a label photo on a note is read, and the photo and what its label says are kept with that session's row, for you alone, and deleted with it.
• Shelf maps. When you map a whole bay, we keep the map: which of your photos it is made of, with the phone's orientation and the time of each shot and the lens it used; how the photos fitted together, the stitched picture of the bay and the zoom tiles cut from it (new images made from your photos, which never change them); which parts of it were read and what each box on the map was read as and resolved to. Stitching happens on our own server and sends your photos nowhere. A map is kept for as long as its row in your Recent list, which is at most 90 days, and you can delete that row yourself: when it goes, the map, its stitched picture, its tiles and the photos only it held are deleted within a few minutes. Photos from a sweep that never became a map go within a few days. We also keep a per-day count of the maps you made, which is how the daily limit is kept; it is deleted only with your account.
• Undo snapshots. When the assistant applies a change to a note, a copy of the note's fields from before and after, so that a thumbs-down can put them back exactly. Deleted with the note.
• A connector, if you set one up. A token (stored only as a one-way hash) that lets an AI assistant you use elsewhere save to-try notes into your library over the MCP protocol, and when it was last used. It can create to-try notes and read nothing. Regenerating or revoking it in Settings deletes it at once.
• Connections to an assistant, if you make one. When you connect an AI assistant by signing in on Favemark's consent page, we keep which assistant it is, which permissions you gave it, when it last used them, and one-way hashes of the tokens it holds, plus a short-lived record of a sign-in still in progress. With those permissions it can search the shared product catalogue and read your notes: their names, ratings, whether they are on your to-try list, categories, your labels, brands, place names, dates and saved links, and, if you leave those boxes ticked, your comments and the product details we read (barcode, label text, the identified product, descriptive tags and nutrition). It never receives your photos or your locations. Disconnecting it in Settings ends it at once.
• Your settings — the language your tags are shown in, which scripts you read, how much effort the AI spends on your requests, a display name if you set one — the only setting another person can read, and only through a link you created (§6) — and your image-processing agreement: whether you have agreed, which version of this disclosure you agreed to, and when. If you create a link (§6), we also keep the link itself, the claims guests make through it, and a per-day count of the questions guests asked across all your links.

We do not use third-party analytics, advertising SDKs, crash reporting, or any tracker. There are none in the app. What we do measure is our own and listed above — how long you waited (the performance records), how the assistant is doing (your reactions), and how the shelf reader is doing (the shelf scans) — and all of it goes only to our server.

2. Who else receives your data

Four outside services are involved. Three of them receive your photographs. What each of them does with what it receives is governed by its own policy, linked below; we have no arrangement with them beyond their standard terms for developers.

Agreeing to this, and taking it back

The app asks before your first photo is processed. The screen describes the processing — what is sent, why, and that it runs both automatically and when you ask — and points here for the companies currently doing it (see §9 for why it is worded that way). It records which agreement you accepted. You can decline, and you can change your mind later in Settings → Image processing.

Your agreement covers processing, not just uploading. While it is switched off, no photo of yours is sent to any of those companies — not a new capture, and not one already stored on our servers. That includes re-tagging a photo, re-framing it, making a different photo the main one, “find similar”, reading a label shot, looking up the maker's own page for something you rated, and asking the assistant about a note that has a photo. Those last ones matter because they happen after the capture, at a moment of your choosing rather than ours, and until August 2026 several of them ran without consulting your agreement at all. They no longer do.

Two limits, stated plainly. Turning it off does not reach back into anything already sent — see §5. And it does not cover what you type: a question to the assistant from home, from search or on a note with no photo sends text, not an image, so it is not held back, and it goes to Anthropic to answer you whether this is on or off. The assistant can also send the text from your library that the answer needs, and that can include words read from your photos earlier, such as an item's name, tags and notes. A question on a note with a photo is held, as above. Other things you type are sent whether this is on or off too, such as a question to Help.

A note on web search

“Identify this” and the assistant's research answers use a web-search tool that runs inside Anthropic's service. Search terms derived from your photo or your question are sent by Anthropic to its search provider and reach the public web. We do not control or see that onward step beyond the results that come back.

Since 23 August 2026 this can also happen without you asking. If you have agreed to image processing, when you rate something and we cannot identify it from a barcode, the app sends that photo to Anthropic in the background and asks it to find the manufacturer's own page for the item. It is the same company, the same downscaled copy and the same web search as “Identify this” — what is new is that nothing you tapped named the item. The agreement the app asks for covers this: it says plainly that processing runs both automatically and when you ask, with no condition attached. §9 explains when a change would make us ask you again — and why this kind does not.

Fetching a picture from the maker's website

When that lookup finds the manufacturer's page, our server downloads the product photograph published on it and stores it beside your own, kept with its credit. Those websites receive nothing about you. The request is made by our server rather than by your phone, so the site sees our address and the picture we asked for — never your IP address, your account, your photo, or your notes.

They are not listed above with the four named services because they are not a fixed set with a policy we could link: it is whichever page turns out to describe the thing you photographed. If you hold rights in such a picture, §10 says how to have it removed.

The maker's own photo, from our copy of Open Food Facts

Some products' records in Open Food Facts are published by the company that owns the brand, together with the front-of-pack photo that company uploaded. We copy those makers' photos in bulk, ahead of any user and unrelated to anything you do, from Open Food Facts into our own storage, each kept with its uploader's credit and the CC BY-SA 3.0 licence it is published under. When you rate such a product, your note can show that photo, with its credit in the note's details, and nothing about you or your photo is sent anywhere to get it. If a copy is disputed, we remove it for everyone at once.

3. What never goes to an AI model

These are properties of how the app is built, not statements of intention:

• Your location coordinates. When location is on, coordinates are used only by our own server, as arithmetic that re-orders candidates the model already produced — nudging results toward things you have recorded near this spot. They are never placed in a prompt and never leave our server. The consent you grant in the app does cover place features that would include where you captured something; no such feature exists yet, and this policy's version will move — and this line with it — before one does.
• Your email address, your password, and your session token. Prompts carry an opaque account identifier so the request can be scoped — never your credentials or your address.
• Anyone else's photos, notes, or tags — in anything you ask. And your own reach a model at someone else's request only through a link you created (§6). Every database read is filtered to one account before anything reaches a model: yours when you ask, and the link's owner's — never a photo — when a guest asks through a link the owner made.
• Your library, in our own testing. The evaluation and prompt-tuning tools we run against this app operate on fixed test cases, our own prompt files, and screenshots of public pages. They never read a real library.

4. Where your data is kept

• Photo files sit on the filesystem of a single rented virtual server. Your notes, tags, ratings, coordinates and account record sit in a PostgreSQL database on the same machine.
• Both are backed up nightly, and the backup set is copied to a second server, where roughly the last two weeks are retained. Photo files are also copied to that server every hour, and one that is changed or deleted is kept aside there for two weeks. A copy of the database taken before each update of the service stays on the first server until five newer ones replace it. So does a copy taken before we load a large batch of product data, until our backups can restore the moment it was taken; the most recent one is kept, but never longer than the oldest backup we still hold.
• A continuous archive of the database at AWS. The database — not the photo files — is also archived continuously to Amazon Web Services (AWS), in its S3 storage in the us-east-2 region (Ohio, United States). It is encrypted on our server before it is sent, with a key AWS does not hold, so AWS stores it but cannot read it. The archive keeps the two most recent weekly full backups and every change made since the older of them. What falls out of that is deleted, and AWS keeps a deleted version for 14 days before purging it.
• Working copies of the database. The database — not the photo files — is also copied into two working copies of the app, which we use to test changes against real data before they reach you: staging.favemark.app, refreshed every night and test.favemark.app, refreshed whenever the automated test run resets it, usually within the hour. A copy holds everything in the database that §1 describes, including your notes, ratings, comments, tags, the names of places you saved, when each photo was taken, and similarity fingerprints. Before a copy reaches either app, it is anonymised in a separate database that neither app connects to: your email address is replaced with a made-up one; your password is replaced with a value no password matches; your sign-in sessions, any password-reset or email-verification codes and any connections to assistants are deleted; a link you shared opens nothing there; the words of any saved assistant memory, and what it is about, are replaced; the words of your assistant chats, searches, reactions, reports and Help reports are removed; the coordinates of each note are rounded to about a kilometre; and the details the camera recorded with each photo are removed. These copies are on the internet, but your password does not work there, and none of your sign-ins carries over.
• Not encrypted at rest. Neither the photo files nor the database are encrypted on disk. Anyone with access to those servers — which means the operator and the hosting provider — can read them. Traffic between your device and us is encrypted in transit (HTTPS).
• No guaranteed processing region. We do not operate region-pinned infrastructure and make no claim about which country your data is processed in. Anthropic, Google, OpenAI and the email provider may process it in countries other than yours. The database archive (above) is stored by AWS in its us-east-2 region, in Ohio, United States.
• What an assistant you connect reads goes to its provider. If you connect an AI assistant (§1), what it reads from your library goes to the company that runs that assistant, at your direction, and is kept under that company's terms, not ours. Deleting a note in Favemark does not reach a copy the assistant already holds.

5. How long we keep it, and how to delete it

• Photos are kept until you delete them, but for the working photos in the next point. There is no automatic expiry. Deleting a photo in the app removes the note attached to it, its tag links, its similarity fingerprint, its undo snapshots and its conversation — immediately and permanently from the live system. The file itself, and its thumbnail, are removed by a follow-up step that retries until it succeeds — usually at once. Until it does, a removal record waits: the file's storage key, the account it belonged to, how many attempts have failed and when to try again, and nothing else. That record is kept even after you delete your account, because it is the only thing that can still find the bytes; the retries run every four hours on a schedule, and whenever an account is deleted.
• Shelf, Sweep, Compare and find-similar photos are kept for 90 days. They are photos taken to read a shelf rather than to rate an item, and each is kept only by its row in your Recent list. That row is deleted 90 days after you made it, or sooner if it falls off the end of the list, and the photos only it held go with it, including from any chat that asked about them. You can delete a shelf, map or match row yourself: press and hold it in Recent. A photo a note holds stays. A photo that no row ever held, such as one from a sweep you never finished, goes within a few days.
• Help reports are kept until you delete them. A report sent from the assistant is kept the same way, with the messages you chose to attach, if any. Deleting a report in Help → My reports removes it and its messages at once, and its screenshot is removed by the same follow-up step as a photo's file. Once we close a report (as fixed, won't fix or a duplicate), it goes the same way within a day of reaching 180 days with no new message on it and no change to its status; a message from either side, or reopening it, starts the 180 days again. Otherwise a report, its messages and its screenshot are kept until you delete your account, as is the per-day count of reports and replies you sent — deleting a report does not take its count back. A screenshot you never sent goes once it is more than a day old, the next time our cleanup runs; a one-line record that it existed (its storage key and when) stays until you delete your account.
• Shoot list photos stay on our server until we have taken them. Before you send a list you can delete a photo to retake it, and its file goes by the same follow-up step as a photo's. An upload that never finished goes in our daily cleanup once it is an hour old. After you send a list, nothing can be withdrawn. Once its photos are in favemark's private code repository and we accept the list, every photo of that list is deleted from our server, used or not. A list none of whose photos we use is never accepted, so its photos stay on our server until you delete your account. The list itself, and a record of each photo without the photo (its labels and what our server worked out about it), stay until you delete your account. An accepted photo's copy in the repository is permanent and survives the deletion of your account.
• Memories are kept until you delete them. A memory a newer one replaced is kept, unused, for as long as the newer one, so that undoing the newer one can bring it back. Deleting a memory erases its words and those of every earlier memory it replaced, and undoing one erases its words, at once; a record that it existed (when it was saved and when it was removed, not what it said or whether it was an allergy) stays until you delete your account, so that a late undo is refused instead of guessed at. Deleting your account deletes all of them.
• Performance records keep only the newest 500. The records of how long you waited (§1) are kept per account. Once there are 500, each new one deletes the oldest. They are deleted with your account.
• Request times keep only the newest 1000. The records of how long our server took (§1) are kept per account. Once there are 1000, each new one deletes the oldest. They are deleted with your account.
• A photo's waiting record goes once it is tagged. The record that a photo is waiting to be tagged (§1) is kept until that photo is tagged, or until the first catch-up run after the record is 30 days old, whichever comes first. The catch-up is the job that tags waiting photos, and it clears out records past 30 days every time it runs, even while tagging is paused; a record can therefore outlast 30 days until that next run. Deleting the photo, or your account, deletes it at once.
• A connection to an assistant goes when you end it. A connection (§1) is deleted at once when you disconnect it in Settings, change or reset your password, or delete your account. One that goes unused for 90 days stops working and is deleted within a day after. A sign-in that is never finished is deleted within a day of starting.
• Backups lag deletion. Something you delete leaves our backups on its own, but not at once. It can survive for about two weeks in the nightly copies on our second server, and for about four weeks in the database archive at AWS (§4): up to two weeks until the full backup holding it is replaced, then the 14 days AWS keeps a deleted version. That four weeks holds while our backups run; if they stop, it stretches by as long as they are stopped, because we keep the last good backups rather than delete them for age. A copy taken before an update stays until five newer updates replace it, normally a few days. A copy taken before we load a large batch of product data is deleted once our backups can restore the moment it was taken, normally the day after; the most recent such copy is kept, but never longer than the oldest backup we still hold. Something you delete also stays in the working copies of the database (§4) until each is next refreshed successfully — normally within a day — and longer if a refresh fails.
• You can delete your whole account, from inside the app. Settings → Account → Delete account, confirmed with your password. That removes everything at once — every photo and every version we derived from it, notes, ratings, comments, tags, saved places, assistant conversations, reactions, reports, Help reports with their messages and screenshots, the Recent list, shelf-scan records, shelf maps with their stitched pictures, Shoot lists with the photos still on our server, undo snapshots, the connector, connections to assistants, any links you shared, the claims guests made through them and the per-day counts of their questions (§6), settings and the account itself — immediately and permanently from the live system, with the one exception above: the files' removal records stay until each file is confirmed gone. It signs you out on every device. We cannot restore it afterwards. Your email address is released, so you can sign up again later; it will be a new, empty account. If you no longer have the app installed, see favemark.app/delete-account.
• Some smaller things you still cannot delete yourself. Tags, and venues you have saved, have no individual in-app delete in the current build — notes and photos do, and so does the account as a whole. Neither do research chats, your reactions to the assistant, the reports you filed, the shelf-scan records or the per-day counts of guests' questions: those go only with the account (revoking every link leaves the counts). The one exception is a Compare session: discarding it deletes its chat. Email us at privacy@favemark.app and we will delete them by hand.
• What has already been sent out is out of our hands. Deleting a photo here does not reach back into Anthropic's, Google's or OpenAI's systems, or into your email provider's. Their retention is governed by their policies.

6. Who can see your library

Only you, and the operator of the service — unless you choose otherwise, in the one way described just below. Every request is checked against your account before anything is read, and another account's photo is indistinguishable from a photo that does not exist.

There are no public profiles and no shared libraries. Nothing of yours is visible to another person by default, and nothing becomes visible as a side effect of anything else. The exceptions are links you create yourself and circles you choose to join, described next; the thing after them is shared with everyone and holds nothing of yours.

A link you can share: an assistant that answers about one category

You can give someone a link to an assistant that answers questions about your rated notes in one category — the wines you have tried, say — without them signing in or installing anything. You create it, it covers one category you pick, and it works for anyone who has the URL until you revoke it; revoking deletes the link and everything stored under it. You create one in the app, under Settings → Shared assistants, where you can also change its note to guests and its date, or revoke it.

What a link discloses

• The display name you set, the name of the category, how many rated notes it holds, and the note to guests you wrote when you created the link, if any — shown on the page to anyone who opens it.
• Through the assistant's answers: your rated notes in that category — at most the hundred you rated highest — as the item's title and brand, its category and kind, your score, your comment, the place name you attached, and the date you captured it.
• That is what a guest can ask about. The assistant answers only from those notes, the note to guests and, if you turn either on, the memories below; it has no web search and no other tools on this path.
• Your saved memories, only if you turn them on for that link, and each switch on its own: your taste preferences, and your allergies. Both are off unless you turn them on. A preference is shared only when it is filed under the link's category, a category inside it, or a category it sits in, and never one with no category; an allergy is shared whatever its category. What the assistant receives is the one-line reading the app saved — "Prefers fuller-bodied reds", the line you see when it is saved and in Settings → Assistant memory. That line can repeat what you said; the words of yours saved beside it, from the conversation where you asked, are never shared. While memory is switched off in your settings, no link shares any, whatever its switches say.

What it never includes

• Any photo, or any pointer to one — not yours, and not a manufacturer's.
• Where you were: no coordinates, and only the date of a capture, never the time of day.
• Any other category, and nothing you have not rated — your to-try list stays yours.
• Your tags, your email address, your account identifier, or anything else in your library.
• The words of yours saved beside a memory (what you said when you asked it to be remembered), a memory you have deleted, undone or replaced, or any memory from a link whose switches are off.
• One caveat, stated plainly: what you typed travels as you typed it. Your comment on a note and your note to guests are shown verbatim, so an address, a link or a name written into one reaches every guest.

What is kept, and what is not

A guest's questions and the assistant's answers are not stored. The conversation exists only in the guest's browser tab, and each question resends it to be answered. What you see is counts and a last-opened time only: how many times the link was opened and when it was last opened, how many questions were asked, and how many “I'll bring this” claims currently stand (claims, not people — one guest may claim several items). You never see what was asked, what was answered, or which items were claimed.

A guest's question — with the notes the link discloses, your note to guests and any memories the link shares — goes to Anthropic to be answered, under your account: it counts against your daily allowance and is logged in your record of AI calls. It is the same company and the same kind of processing your library already goes through, at a stranger's request; no photo is involved, and the request carries the link's identifier rather than your account's. Creating the link is what allows it — see §9 for why this is disclosed here rather than asked again in the app.

If you give the link an occasion, a guest can say “I'll bring this” about an item the assistant mentioned. That is stored as one row naming you, the link and the note — no text from the guest, no name, no address, no device fingerprint. Other guests are told only that someone may already be bringing that item, never who. The rows are deleted when you change the occasion, revoke the link, or delete your account.

If you are the guest, this is what Favemark holds about you: nothing that names you. Your network address is counted in our server's memory to limit abuse — an hourly count, held in memory until the server restarts or the entry is evicted, and never written to the database, to disk or to a log. If you say you will bring something, the secret that lets you take that back is kept in your own browser, not on our server.

A link to one note

You can share one note by link: open it in the app and tap Share link. Anyone who has the URL sees that note on a web page, without signing in, until you revoke the link; revoking deletes it, and the next visit finds nothing. You can make several links to one note, and revoking one leaves the others working.

What a note link shows

• The note's name, brand, category and kind, your score (or that it is not rated yet), your comment, the place name you attached, and the date you captured it.
• One photo: the picture the note shows, as the app renders it, never the original file you uploaded. If it is a product photo rather than one you took, its credit is in the page's details.
• Your display name, only if you have set one.

What it never includes

• Where you were: no coordinates, and only the date of a capture, never the time of day.
• Any other photo of the note, your tags, the text read from the label, the app's guesses about what the item is, or the product it is linked to.
• Any other note, your email address or your account identifier.

When a link is pasted into a chat, the messaging app may fetch a preview: the note's name and its photo. That fetch is the app reading the page on your recipient's behalf, and a preview it has already fetched stays with that app after you revoke the link.

What you see is a count and a time: how many times each link was opened and when it was last opened. Nothing is recorded about who opened it. A visitor's network address is counted in our server's memory to limit abuse, never written down.

Circles: a group of people you choose

You can make a circle: a small named group of people you choose, who can read each other's rated notes but never change them. Create one in the app under Settings, Sharing, Circles, and invite people with a link that works once and for 7 days. A circle holds at most 12 people, and you can be in at most 5 circles. You need a display name to create or join one, and while you are in a circle you can change it but not remove it.

What members see of each other

• Every note each other member has rated, whenever they rated it: the name, brand, category and kind, the score, the comment, the place name attached, the date captured, and one photo as the app renders it, never the original file.
• Each member's display name beside their notes, and an account identifier the app uses to tell members apart. It is a random code, not an email address or a name.
• Who else is in the circle, with their display names and the date each joined.

What they never see

• Notes that are not rated, including your to-try list.
• Where you were: no coordinates, and only the date of a capture, never the time of day.
• Any other photo of a note, your tags, the text read from a label, the app's guesses about what an item is, or the product a note is linked to.
• Your email address, except to the circle's owner.

The person who created a circle also sees each member's email address and the invites still waiting to be used, and is the only one who can invite, remove a member, rename the circle or delete it.

An invite link opens a page on favemark.app that shows the invite and how to open it in the app. The page reads nothing from our records, so it names no circle and no person, and it looks the same whether the invite still works or not.

Any member can leave, and the owner can remove anyone or delete the circle. From then on, people who no longer share a circle cannot read each other's notes; two people who are still in another circle together keep reading each other's notes through that one. Deleting the circle, or deleting your account, removes the circle's records.

One thing that is shared: a product index — and nothing of yours

When the packaging in one of your photos is read clearly enough to be sure what the product is, Favemark records that product's identity — as printed on the pack — in a shared index, and links your note to the entry. It is how the app comes to know a product exists at all: entries are grown by use rather than bought or hand-built, so the next person who photographs the same thing meets it already there.

What it holds

• The product's identity as read off the packaging: brand, product name, variant, and the pack sizes it has been seen in — kept in a canonical form (lowercased, accents folded) so that two readings of the same product meet each other, alongside the spelling that founded the entry.
• Public facts about the product — ingredients, nutrition, specifications, certifications, awards, third-party ratings — each stored as a value with a link to the page it was taken from, the kind of source it was (the maker's own site, a retailer, a review, an aggregator), and when it was fetched. At most one attributed sentence of quoted text is kept beside a value; no article text, no prose and no images are copied. A fact with no source link is discarded rather than stored.

What it never holds

• Any photo, or any pointer to one: no photo id, no crop, no thumbnail, no similarity fingerprint.
• Your account, or any pointer to it: no account id, no email address, no session.
• Anything you recorded: your notes, your ratings, your comments, your tags, your assistant conversations, or anything else you typed.
• Any count of how many people have photographed a product, or when the first of them did.

Any signed-in user, through the same authenticated routes as the rest of the app. The entries are about products, not about people: nobody reading one can tell who photographed the thing, or that you did. What an entry does reveal is that someone, at some point, photographed that product — and that is all it can reveal, because nothing in it points back at a person. Your own library is untouched by this; the first paragraph of this section still holds in full.

7. Cookies and device storage

The website sets one cookie, favemark_session, which identifies your signed-in session. It is strictly necessary — without it you cannot stay signed in. There are no analytics or advertising cookies.

The mobile app uses no cookies. Its session token is held in the device's own secure keystore (the iOS Keychain, the Android Keystore), not in ordinary app storage.

A shared assistant page (§6) sets no cookie. The only thing it keeps in a guest's browser is the secret behind an “I'll bring this” they made, so they can take it back; nothing else is stored on their device.

8. Children

Favemark is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it. A photo can show a child who has no account at all: see §11.

9. Changes to this policy

This page carries a version stamp (2026-11-17). When what we disclose here changes materially — a new company receiving your data, a new category of data leaving our servers — the version moves, so you can always tell which text you were shown.

What you agree to in the app is a category of processing, not a list of companies. The in-app agreement says what leaves (a downscaled copy of what you capture, text you add to it or read from it, an opaque account identifier — and, if you allow location, where you captured something, for place features), why (to tag, identify, organize and answer questions about it, including looking things up on the web), and that it runs both automatically and when you ask. It does not cover what you type to the assistant, which is sent to answer you whether it is on or off (§2). The companies doing that processing are named on THIS page, which is versioned — so we can change an AI provider or model, for the same processing, by updating this page rather than by switching your photo features off until you re-agree. Your agreement covers the processing, not the vendor.

When would we ask you again? When the category itself widens: a kind of data leaving our servers that the agreement does not name, or a genuinely new purpose. Using your photos to train a model, for advertising, selling data, or showing your content to other users are all outside every agreement this app has ever asked for — any of those would be a fresh, explicit question, never an update to this page. And a new feature that needs more than you agreed to (place features are the example above) asks its own question at that feature's door — it does not switch off what you already use.

Not every change is that kind of change, and we would rather say so than imply a promise we do not keep. On 20 August 2026 we added Open Food Facts to the list above. It receives the barcode digits read from a photo's packaging and sends back the manufacturer's own picture of that product — it never receives a photo of yours. Nothing about where your photos can go became broader, so this page's version moved and you were not asked again.

On 2 November 2026 we removed Open Food Facts from that list. The official details shown after you rate a packaged item now come from our own copy of the product catalogues, which we keep up to date in bulk and not because of anything you do, so no barcode read from your photos is sent to Open Food Facts any more.

On 3 September 2026 we added the shared product index described in §6. Nothing new leaves our servers and no photo is involved; what is new is that the identity of a product, read off its packaging, is kept in a table that is not yours alone. That is a change to what we keep and where, not to where your photos can go — so this page's version moved and you were not asked again.

On 18 September 2026 we added Google to the list above, and unlike the two changes before it, this one does change where your photos can go. Google now reads the same downscaled copy of a photo that Anthropic does, for the same jobs — suggesting tags, checking whether you have tried something, straightening a tilted shot — and was asked first, with Anthropic answering when it could not (until 22 September; see below). What leaves our servers and why it leaves are both unchanged, which is the rule above, so this page's version moved and you were not asked again. We use Google's paid service, whose terms do not let Google use what we send to improve its products.

On 20 September 2026 this page stopped saying that there is no sharing in Favemark, because that had stopped being true the morning before: the shared assistant link described in §6 went live on 19 September, and until this revision this page said nobody could see anything of yours while a link could show a guest your rated notes in one category. That is the kind of gap this page exists to close, and we would rather record it than tidy it away. The rule above holds: a guest's question goes to a company already named here, with text of yours that already goes there, for the same purpose — what is new is that a stranger can ask, and only through a link you chose to create. Creating the link is the question, asked at the moment you do it; so this page's version moved and you were not asked again.

On 21 September 2026 we checked every kind of record the service keeps against this page, and found eleven that §1 had never named: your saved assistant conversations, your reactions and reports, the Recent list, shelf-scan records, undo snapshots, the removal record that follows a deleted file, the connector token, video you attach, the Latin-script spellings of your labels, and the per-day count of guests' questions. None of them was new — the app had kept each since the feature it belongs to shipped — and none leaves our servers. What was wrong was this page, and it is now checked against the database schema by a test, so the next kind of record cannot ship unnamed. Nothing about where your photos can go changed, so this page's version moved and you were not asked again.

On 23 September 2026 this page stopped saying that Anthropic answers when Google cannot, because since 22 September it does not. Suggesting tags, checking whether you have tried something and straightening a tilted shot now go to one company at a time — Google, unless we switch those jobs to Anthropic — and if Google cannot answer, your photo is not passed on to Anthropic instead. For about a day this page described a hand-over that no longer happened, so for these jobs it named more places your photos could go than there were, never fewer. The change narrows where your photos can go rather than widening it, so this page's version moved and you were not asked again.

On 24 September 2026 we removed Voyage AI from the list above, because it no longer receives anything. It used to turn your photos, and some tag labels, into the numeric fingerprint that makes “find similar” work. Google now does that job, from the same downscaled copy of a photo it already reads for suggesting tags, and unlike those jobs it stays with Google even if we switch them to Anthropic. Google was already named here for “find similar” and already received your category labels, so no company gained a new kind of data or a new purpose, and one company stopped receiving anything. That is the rule above, so this page's version moved and you were not asked again.

On 10 October 2026 we added OpenAI to the list above, for one job: the Level button. When you tap Level, the same downscaled copy of the photo that Google reads for tags now goes to OpenAI, whose model straightened photos most accurately when we measured it, and to nobody else. Straightening a tilted shot was already a purpose this page named, and what leaves our servers for it is unchanged, so this page's version moved and you were not asked again. If we switch it off, the Level button goes back to Google.

On 12 October 2026 OpenAI took on one more job: turning a sideways photo the right way up. When a new capture is tagged, four downscaled copies of it — as taken, and turned a quarter, a half and three quarters — go to OpenAI once, and the turn it reads is applied for you, with no tap. A photo you have already turned or edited, or one fetched from the web, is never sent, and you can still turn any photo yourself from the note. Straightening photos was already what this page named OpenAI for, so this page's version moved and you were not asked again.

On 17 October 2026 OpenAI became the backup for reading a photo to identify the item and suggest its tags. When Google's reader is unavailable — it could not be reached, ran out of time or failed on its side — that one read is asked of OpenAI once, in Google's place, with what Google would have received: the same downscaled copy of the photo, your category labels, the name of an item you picked and where on the photo you pointed. It is never asked because of what Google answered, and if OpenAI cannot answer either, the photo goes nowhere else. Reading your photos to identify items was already a purpose this page named, and OpenAI was already named here for reading photos, so this page's version moved and you were not asked again.

On 21 October 2026 we corrected three statements on this page that had stopped being true. §4 now names the continuous, encrypted archive of the database that we have kept at AWS since 28 September 2026, and where AWS keeps it. §5 said something you delete could survive in our backups for roughly two weeks; in that archive it can survive for about four. And §4 said your password worked on our working copies of the database: since 5 October 2026 those copies have been anonymised before they arrive, so it does not. Nothing about which companies process your data, or why, changed, so this page's version moved and you were not asked again.

One correction, for the record. The 23 August 2026 revision of this page said we had asked everyone to agree again, after the automatic lookup in §2 outgrew wording that had been tied to you asking. That re-ask was queued but never reached anyone's device, and on 26 August 2026 we replaced it with the category-based agreement described above — which covers the automatic lookup outright instead of re-asking you about a condition we should never have promised. Nobody's photo features were switched off, and nothing about where your photos can go widened between those two texts.

10. Contact

Questions, corrections, or a deletion request from someone who no longer has the app installed (in the app it is Settings → Account → Delete account): privacy@favemark.app.

Reporting a picture we fetched. Some notes carry a manufacturer's product photo — pulled either from Open Food Facts, where contributors publish them under a licence that asks for credit, or, since 23 August 2026, from the maker's own website, where we hold no licence at all. Since 3 November 2026 it can also be our own copy of the front photo a brand's owner published on Open Food Facts, copied in bulk ahead of any user, with its uploader's credit and its CC BY-SA 3.0 licence. Each is shown only to the person whose note it is, is stored with the page it came from and whatever credit that page carries, and is labelled in the app as not your own photo.

If you hold rights in such a picture and want it removed, write to the address above with the product or the page it came from. These images are derived and disposable, so removing one is a delete on our side and nothing else is lost. A disputed copy of a brand owner's photo is removed for everyone at once: every note that shows it falls back to its own photo. We can also switch the maker's-website step off outright, for everyone, without a release — so a request about a whole catalogue does not have to be answered one picture at a time.

11. People in your photos

• A photo can show people you did not mean to include, and the reading models receive it as you sent it, with those people in it.
• Favemark never identifies anyone. We do no face recognition, and we keep no record of who or how many people are in a photo.
• Shelf, Sweep, Compare and find-similar photos are kept for 90 days, then deleted, including from any chat that asked about them. A photo saved to a note stays until you delete it.
• No photo of yours is used to train a model, or kept as a test image, by us.
• If you appear in someone's photo: we cannot search by person. If you hold a note link that shows you, send it to privacy@favemark.app, and we revoke the link and tell its owner. The photo stays in the owner's library. Anything else, write to the same address.
• Please keep other people out of a shelf shot, children above all, and do not photograph anyone where it is not allowed.