Privacy Policy
Effective 10 August 2026 · version 2026-08-10
FaveMark is a photo notebook. You take a photo, an AI reads it and suggests tags, you give it a rating, and later you find it again by tag, date, place, a similar photo, or by asking. Making that work means sending your photos to companies other than us. This page says exactly which ones, exactly what they get, and what we keep.
It describes the app as it is actually built today, not as it is planned. Where something is designed but not built, it says so.
1. What we collect
- Your account. Your email address and a one-way hash of your password — we never store the password itself. Signing up creates a short-lived email-verification token; signing in creates a random session token.
- Your photos. We keep the original file exactly as you sent it, byte for byte, and generate a small thumbnail from it. Note that some cameras write metadata — including GPS coordinates — inside the image file itself. FaveMark does not strip that metadata out of the stored original.
- What you record about a photo. Your rating, anything you type, the tags and categories the AI suggested or you corrected, the brand and any text the AI read off the item, a venue if you attach one, and a source URL if you saved something from the web.
- Location — only if you switch it on. FaveMark never asks for location by itself. The system permission dialog appears only after you tap to enable it. While it is enabled and granted, a capture records the coordinates where it happened. See §3 for what is done with them — the short version is that they never leave our server.
- A similarity fingerprint of each photo — a list of numbers produced by an embedding model, which is what makes “find similar” work across your own library.
- A record of each AI call: your account id, which feature ran, which model, how many tokens, and an estimated cost. The contents of the call are not stored in this record.
- Your settings — currently the language your tags are shown in.
We do not use analytics, advertising SDKs, crash reporting, or any third-party tracker. There are none in the app.
2. Who else receives your data
Three outside services are involved. Two of them receive your photographs. What each of them does with what it receives is governed by its own policy, linked below; we have no arrangement with them beyond their standard terms for developers.
Anthropic (Claude)
Reads your photos and your text to suggest tags, identify items, search your library, and answer in the assistant.
What we send them
- A downscaled JPEG copy of a photo (longest side 1024 px), re-encoded by our server from the image rather than forwarded as the file you uploaded.
- Text you or the app produced: tag and category labels, note text, brand and label text already read from an item, typed search queries, manually added item names, venue names, and your assistant conversation.
- An identifier for your account, so the model is told whose request it is answering.
When
- Tagging a capture, and re-tagging it
- “Find similar” — matching a new snap against your library
- “Identify this” — researching an item in a photo
- A label or price-tag shot attached to an existing note
- The assistant, including any photo you attach to a message
- Search — expanding and parsing what you typed
- Filling in tag labels in your chosen language, reconciling a suspected duplicate, categorising a manually added item or a venue, and the periodic tidy-up of your tag vocabulary
Their policy: https://www.anthropic.com/legal/privacy
Voyage AI
Turns a photo — and some tag labels — into a numeric fingerprint so “find similar” can work.
What we send them
- The same downscaled JPEG copy of a photo that Anthropic receives.
- Tag and category label text during the periodic tidy-up of your tag vocabulary.
- An identifier for your account.
When
- Tagging a capture — the fingerprint is computed in the background
- “Find similar” — the query snap is fingerprinted to compare against your library
- The periodic tidy-up of your tag vocabulary
Their policy: https://www.voyageai.com/privacy-policy
Microsoft (Exchange Online) or Resend
Delivers the handful of transactional emails the app sends — currently the address-verification message.
What we send them
- Your email address and the contents of the message we send you.
- No photos, no notes, no tags.
When
- Signing up — the verification email
- Asking us to resend that verification email
Their policy: https://privacy.microsoft.com/privacystatement
A note on web search
“Identify this” and the assistant's research answers use a web-search tool that runs inside Anthropic's service. Search terms derived from your photo or your question are sent by Anthropic to its search provider and reach the public web. We do not control or see that onward step beyond the results that come back.
3. What never goes to an AI model
These are properties of how the app is built, not statements of intention:
- Your location coordinates. When location is on, coordinates are used only by our own server, as arithmetic that re-orders candidates the model already produced — nudging results toward things you have recorded near this spot. They are never placed in a prompt and never leave our server.
- Your email address, your password, and your session token. Prompts carry an opaque account identifier so the request can be scoped — never your credentials or your address.
- Anyone else's photos, notes, or tags. Every database read is filtered to your account before anything reaches a model.
- Your library, in our own testing. The evaluation and prompt-tuning tools we run against this app operate on fixed test cases, our own prompt files, and screenshots of public pages. They never read a real library.
4. Where your data is kept
- Photo files sit on the filesystem of a single rented virtual server. Your notes, tags, ratings, coordinates and account record sit in a PostgreSQL database on the same machine.
- Both are backed up nightly, and the backup set is copied to a second server, where roughly the last two weeks are retained.
- Not encrypted at rest. Neither the photo files nor the database are encrypted on disk. Anyone with access to those servers — which means the operator and the hosting provider — can read them. Traffic between your device and us is encrypted in transit (HTTPS).
- No guaranteed processing region. We do not operate region-pinned infrastructure and make no claim about which country your data is processed in. Anthropic, Voyage AI and the email provider may process it in countries other than yours.
5. How long we keep it, and how to delete it
- Photos are kept until you delete them. There is no automatic expiry. Deleting a photo in the app removes the original file, the thumbnail, the note attached to it, its tag links and its similarity fingerprint — immediately and permanently from the live system.
- Backups lag deletion. Something you delete can survive in nightly backup copies for roughly two weeks before those copies age out.
- Some things you cannot yet delete yourself. Notes added without a photo, venues, tags, and your account as a whole have no in-app delete in the current build. Email us at privacy@favemark.app and we will delete them by hand.
- What has already been sent out is out of our hands. Deleting a photo here does not reach back into Anthropic's or Voyage AI's systems, or into your email provider's. Their retention is governed by their policies.
6. Who can see your library
Only you, and the operator of the service. Every request is checked against your account before anything is read, and another account's photo is indistinguishable from a photo that does not exist.
FaveMark has no sharing. There are no public profiles, no shared libraries, no groups or circles, and no way for another user to see anything of yours. Sharing has been designed but not built. If it ever ships, this page changes before it does.
7. Cookies and device storage
The website sets one cookie, favemark_session, which identifies your signed-in session. It is strictly necessary — without it you cannot stay signed in. There are no analytics or advertising cookies.
The mobile app uses no cookies. Its session token is held in the device's own secure keystore (the iOS Keychain, the Android Keystore), not in ordinary app storage.
8. Children
FaveMark is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.
9. Changes to this policy
This page carries a version stamp (2026-08-10). When what we disclose here changes materially — a new company receiving your data, a new category of data leaving our servers — the version moves and the app asks you again rather than assuming your earlier agreement covers it.
10. Contact
Questions, corrections, or a deletion request: privacy@favemark.app.