Forgettable
Privacy Policy
Effective 14 October 2026 (updated 3 November 2026) · applies to the Forgettable apps for iPhone and Android and to this website
The short version
Your list, places, times and photos stay on your phone. Nothing is sent to us unless you create or join a household (shared list). We don’t sell your data, show ads, use analytics or track you across apps or websites.
- Who we are
- What stays on your phone
- Permissions
- Households (optional)
- Services we use
- Links to other websites
- Sharing items
- This website
- Legal bases
- How long we keep data
- Deleting your data
- Your rights
- Children
- Changes and contact
1. Who we are
Forgettable is made by Petr Sevcovic, an independent developer based in the Czech Republic, who is the data controller for the data described here. Contact: sevcovicp@gmail.com.
2. What stays on your phone
Without a household, Forgettable works entirely on your device. Stored only on your phone:
- Your items and their reminders — place names, addresses and coordinates, Wi-Fi network names, times and alarms.
- When you checked each item.
- Proof photos you take in the app. They are saved in the app’s private storage and never added to your photo library.
- A copy of your list shared only with Forgettable’s own widgets and Siri shortcuts on the same device, so they can show and update it.
Reminders, alarms and location triggers are scheduled and evaluated by your phone’s operating system. Deleting the app deletes this data.
3. Permissions
Each permission is asked when you first use the feature, and you can change it any time in your phone’s settings.
- Location (“Always”) — so your phone can remind you when you leave or arrive at a place you saved, even when the app is closed. Forgettable uses the geofencing built into iOS and Android: the phone wakes the app only when you cross the boundary of a saved place. We never record your route. On Android, geofencing is provided by Google Play services.
- Notifications — to show reminders. Scheduled on your phone; we don’t run a notification server.
- Alarms — iPhone (iOS 26+) uses Apple’s AlarmKit for items you mark as “Alarm”; Android asks for “Alarms & reminders” access so reminders arrive on time.
- Camera — only when you tap “Check with photo”.
- Wi-Fi information — on Android, to recognise the Wi-Fi network you chose. On iPhone, Wi-Fi reminders run through a Shortcuts automation you set up yourself.
- Siri & Shortcuts — if you ask Siri about an item, your voice is processed by Apple under Apple’s privacy policy; Forgettable only receives the request (e.g. which item) and answers from the list on your phone.
4. Households (optional)
If you create or join a household, your phone gets an anonymous account — no email, phone number or password — and the household’s list is synced through our database provider, Supabase (servers in Frankfurt, Germany, EU).
| Data | Why | Who can see it |
|---|---|---|
| Anonymous account ID | To know which household you belong to | Only our systems |
| The name you enter (e.g. “Anna”) and the household name | So members see who is in the household and who checked what | Household members |
| Items and their reminders, including saved place names, addresses and coordinates, and Wi-Fi network names | So everyone has the same list | Household members |
| Whether and when an item was checked, and by whom | “Anna locked the door at 08:12” | Household members |
| Proof photos taken while in a household | So members can see the proof | Household members (private storage, time-limited links) |
| Invite code | To let people join | Anyone you give it to |
| Technical logs (e.g. IP address, time of request) | Security, preventing abuse, fixing errors | Only our systems / Supabase |
Access is protected so that only members of a household can read or change its data. Data is encrypted in transit (HTTPS).
5. Services we use
- Supabase (Supabase Inc.) — database, anonymous accounts and file storage for households only. Data is stored in the EU (Frankfurt). Supabase acts as our processor under its data processing agreement; any transfer outside the EU is covered by the EU Standard Contractual Clauses. Supabase privacy policy.
- OpenStreetMap Nominatim (OpenStreetMap Foundation, UK) — to look up addresses. When you search, the text you type is sent; when you tap “Current location”, your current coordinates are sent once to find the street address. Your IP address is visible to them as with any web request. OSMF privacy policy.
- Apple and Google — the App Store and Google Play distribute the app and may collect data under their own policies (for example, download statistics, or crash reports if you choose to share them with developers). Geofencing on Android uses Google Play services.
- Cloudflare — hosts this website (see section 8). Cloudflare privacy policy.
We use no analytics, advertising, tracking or crash-reporting SDKs.
6. Links to other websites
Forgettable links to a few external websites. Nothing is sent to them unless you tap the link; once you do, their own privacy policies apply:
- Feedback board (feature-requests.com) — to suggest improvements.
- Spotify — the “Why we built Forgettable” podcast, which opens on Spotify.
- Buy Me a Coffee (buymeacoffee.com) — an optional way to support the developer. Any payment happens on their website, not in the app; we receive no payment details. Supporting is entirely voluntary and doesn’t unlock anything.
7. Sharing items
When you share items, they are packed into the link itself (after the “#” in the address). That part of a link is never sent to our website’s server, so we don’t receive the items you share. The person you send it to sees them in their app or browser.
8. This website
This website is hosted by Cloudflare, which processes standard request data (such as IP address, browser type and time of visit) to deliver and protect the site. The site uses no cookies, no analytics and no third-party fonts or scripts — everything is served from the site itself.
iPhone launch list
If you leave your email in the “On iPhone? Get notified at launch” form, we store that email address, the date you signed up and which page you used. We use it for one thing only: a single email when Forgettable is available on the App Store. It is stored in a Cloudflare D1 database in the EU (Western Europe), is never shared or sold, and is deleted once the launch email has been sent. You can ask us to remove it at any time by emailing sevcovicp@gmail.com.
9. Legal bases (GDPR)
- Providing the features you use (households, address search) — performance of a contract with you, Art. 6(1)(b) GDPR.
- iPhone launch list — your consent, Art. 6(1)(a) GDPR, given by ticking the box. You can withdraw it at any time.
- Security and abuse prevention (technical logs) — our legitimate interest in keeping the service safe, Art. 6(1)(f) GDPR.
- Permissions (location, camera, notifications) — you choose to grant them on your phone; data from them stays on your phone unless you use a household.
10. How long we keep data
- On your phone: until you delete it or the app.
- Household data: while you are a member. When you leave, your anonymous account is deleted. When the last member leaves, the household, its items and photos are deleted.
- iPhone launch list: until the launch email is sent, then deleted.
- Technical logs and backups at our providers are deleted on their regular schedule, normally within 30 days.
11. Deleting your data
- Household account and data: in the app, go to Settings → Household → Leave & delete account.
- Everything on your phone: delete items in the app, or delete the app.
- iPhone launch list: email sevcovicp@gmail.com from the address you signed up with, and we’ll remove it.
- Without the app: email sevcovicp@gmail.com with your household’s name and invite code (and your name in it), and we’ll delete your account and data within 30 days.
12. Your rights
You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive it in a portable format. Because household accounts are anonymous, we may ask for your household name and invite code to find your data. You can also complain to a data protection authority — in the Czech Republic, the Office for Personal Data Protection (ÚOOÚ), or the authority where you live.
13. Children
Forgettable is not directed at children under 13 (16 in some EU countries), and we don’t knowingly collect their data. If you believe a child has created a household, contact us and we’ll delete it.
14. Changes and contact
If we change how Forgettable handles data, we’ll update this page and the date at the top; significant changes will also be announced in the app. Questions or requests: sevcovicp@gmail.com.
We don’t sell or rent your personal data, and we never will.