Fiume Privacy Policy

Last Updated: October 25, 2026
Effective Date: October 25, 2026

Fiume is provided by Hecara and operated by Zhang Yuxi.

This Fiume Privacy Policy (“Policy”) explains how Fiume collects, uses, stores, shares, and protects personal information when you use the app (including the Apple Watch app) and related services, and how you can exercise your rights regarding personal information.

Where applicable data protection law requires a controller or similarly responsible party, Zhang Yuxi (operating Fiume under the name Hecara) determines the purposes and means of the Fiume processing activities described in this Policy, except where a third party independently determines its own purposes and means as permitted by law.

For privacy questions or rights requests, contact: [email protected]

1. Information We Process

We process only the information needed to provide Fiume’s features, keep the service secure, manage subscriptions, and meet legal obligations.

1.1 Account and Profile Information

Fiume currently supports only Sign in with Apple.

When you sign in and use your account, we may process:

• the account identifier Apple provides to Fiume;
• the email address you choose to share through Apple;
• the display name and profile photo you set in Fiume;
• the phone number, occupation, and “About You” details you choose to provide;
• the region you choose (see Section 3.3);
• account-level settings such as Journal Access (“Allow Fio and sages to read my Journal”).

We use this information to identify your account, keep you signed in, sync your content, and provide account features. Your phone number is used only in your profile and is never sent to AI providers.

1.2 Content You Store in Fiume

After you sign in, the following content syncs with your Fiume account and a copy is kept on your device for offline use:

• Memos and Journal entries, including responses from Fio or a sage inside a Journal entry;
• folders and their organization;
• states such as favorites, pinned items, and Trash;
• conversations with Fio and with sages, including the short records Fio leaves after taking an action (for example, a title such as “Created an event”);
• Fio’s long-term memory;
• Journal mood and topic tags, Journal insights, and Weekly Insights;
• report files created by Fio;
• attachments such as images and audio recordings, and their metadata;
• records needed to make sync work.

1.3 Original Images and EXIF Metadata

If you add an image from your photo library or take one with the camera and insert it into a Memo, a Journal entry, or a conversation, Fiume uploads and stores that image. We do not currently remove embedded metadata such as EXIF data before upload.

This means an uploaded image may include information such as when it was taken and device or lens details. If the original image contains GPS or other location metadata, that information may also be uploaded and stored with it. You can remove metadata you do not want to share before uploading, using your device or other tools.

Images you send to Fio or a sage are compressed on your device, then stored and sent to an AI provider for processing.

1.4 Voice Recordings and Transcripts

When you use voice input, Fiume records audio with the microphone and uploads the recording for speech-to-text. Section 5 explains the flow and retention periods.

1.5 Data Read by Fio and Device Connectors

When you use Fio, it may read your Memos, your Journal entries if you allow it, and data from Calendar, Reminders, Contacts, Health, Photos, and Location if you connect them. Section 4 explains the scope, your controls, and where this data goes.

1.6 Device and Diagnostic Information

To maintain compatibility, diagnose problems, improve stability, and keep the service secure, we may process:

• device model, operating system version, app version, and system language;
• operational logs our servers produce while handling your requests, such as request time, endpoint, error code, and duration.

Fiume does not include third-party crash reporting, behavioral analytics, or advertising tracking SDKs. If you choose in iOS Settings to share analytics with app developers, Apple may provide crash reports to us under Apple’s terms.

Server operational logs are kept only as long as needed for diagnostics and security and are then deleted or overwritten, except limited records that must be kept for a specific security incident, dispute, or legal obligation.

1.7 Subscription, Credit, and Usage Information

Fiume subscriptions are offered through the Apple App Store.

To confirm subscription benefits, calculate allowances, and manage account status, we may store or process:

• your subscription plan, status, trial status, and billing period;
• transaction records or identifiers that Apple provides for subscription processing;
• redemption code records;
• Fiume credit balances and records of credits granted and used;
• usage records such as transcription minutes, Journal insight and Weekly Insights counts, and web search counts;
• metering information for AI requests, such as the model tier used, token counts, and duration (without request or response content).

Apple handles payments and refunds for App Store purchases. Fiume does not process your full bank card or payment card details.

1.8 Push Notifications and Live Activities

If you allow notifications, Fiume obtains a push token from the Apple Push Notification service (APNs) and uses it to send these notifications:

• Fio has finished a task;
• a sage has replied to you;
• a transcription has finished;
• an Apple Watch recording has synced to your iPhone (created on your device);
• in-app announcements from Fiume.

While Fio works in the background, Fiume can show a Live Activity on the Lock Screen and in the Dynamic Island. To update or end a Live Activity when the app is not in the foreground, Fiume sends the Live Activity push token to our servers.

Notifications and Live Activity updates contain only fixed wording and status (such as “In progress” or “Done”). They do not contain your Memos, Journal entries, conversations, or connector data. You can turn off notifications or Live Activities in iOS Settings at any time.

1.9 System Permissions

Fiume asks for the following iOS permissions only when you use the related feature:

iOS manages these permissions, and you can turn them off in Settings at any time. Fiume does not use the iOS Speech Recognition permission and never gets your location in the background.

2. Why We Process Information

Where we rely on legitimate interests, we consider whether the processing is necessary, your reasonable expectations, and your rights and freedoms, especially where the user is a minor.

Where processing relies on your consent, you may withdraw that consent to the extent permitted by applicable law. Withdrawal does not affect the lawfulness of processing before withdrawal.

If a country or region uses different legal concepts, we will determine the corresponding basis under applicable local law.

3. AI Features

3.1 AI Data Consent

Before you use any AI feature for the first time, Fiume asks whether you agree to have your content processed by third-party AI providers. If you do not agree, Fiume does not send your content to AI providers, and features such as Fio, sage conversations, Journal insights, and transcription are unavailable. You can turn this consent off at any time in Profile.

3.2 What Is Sent to AI

After you agree, content is sent in these cases:

• When you use an AI feature: for example, talking with Fio or a sage, sending an image, transcription, Clean Up with AI, polishing or tidying a Memo, generating a Journal insight or Weekly Insights, or sage matching during onboarding. What is sent is the content needed for that request, such as the text you enter, Memos you bring into the conversation, and the context of the current conversation.
• Content Fio reads to complete your request: Fio may search and read your Memos, your Journal entries if you allow it, its long-term memory, and data from the connectors you have connected, and send what it reads to an AI provider. See Section 4.
• Two automatic tasks:
  • When you finish editing a Memo that has no title, Fiume sends the beginning of its text (up to 4,000 characters) to AI to generate a title. Journal entries and Memos in Locked Folders are never titled automatically.
  • When you finish a Journal entry, Fiume sends that entry to AI to generate mood and topic tags.

Fiume does not send your whole library of Memos, Journal entries, or attachments to AI providers just because you store content in the app.

3.3 AI Providers and Regions

Text AI requests first go to an AI gateway that Fiume operates, which then forwards them to model providers. We currently use:

• Google: Gemini models on Google Cloud Vertex AI;
• OpenAI;
• xAI;
• DeepSeek;
• Volcano Engine (Volcengine Ark).

The region you choose on the sign-in screen or in Settings determines which group of providers handles text AI:

• If your region is mainland China, requests are mainly processed by DeepSeek and Volcano Engine, whose servers are in mainland China. Some requests may also be processed by Google Gemini.
• For all other regions (including Hong Kong, Macao, and Taiwan), requests are processed by Google, OpenAI, and xAI.

Which provider in a group handles a request depends on the feature and on service availability. We will update this Policy when we add or replace a provider.

Fiume does not infer your region from your IP address, language, or time zone, and your region is not included in the prompt sent to the model. You can change your region in Settings.

Section 5 and Section 4.2 describe the providers used for transcription and web search.

3.4 How Providers Handle This Content

AI providers process your content under their API terms with us, to generate the result of your request. Some providers may keep request records for a limited period for security, abuse prevention, and legal compliance. We do not sell your content and do not authorize providers to use it for advertising.

3.5 AI Data Fiume Stores

• Conversations: Your conversations with Fio and with sages are stored in your account so you can continue them, see your history, and sync across devices. They are kept and deleted under the general rules for user content in this Policy.
• Requests in progress: AI requests processed asynchronously are held on our servers only in encrypted form until processing starts. Generated replies are kept on our servers for 24 hours so your device can retrieve them after a dropped connection, then deleted. Records of Fio runs (without conversation content) are kept for 30 days.
• AI results: Journal tags, Journal insights, Weekly Insights, Fio’s report files, and long-term memory are stored in your account, where you can view and delete them.
• Metering records: For each AI request we keep metering information such as the model tier, token counts, and duration for billing, allowances, and reconciliation. These records do not contain request or response content.

4. Fio and Device Connectors

4.1 What Fio Can Read

• Memos: Fio can search and read your Memos to answer questions. Memos in a Locked Folder can be read only after you have unlocked that folder with Face ID in the current session. Semantic search over Memos runs on your device.
• Journal: Fio needs your permission to read Journal entries. If you turn on Journal Access, Fio reads Journal entries without asking each time. If it is off, Fio asks you every time it needs to read a Journal entry.
• Personalization: If you turn on Personalization, the occupation and “About You” details you provide are sent with requests to help Fio and sages understand you.
• Long-term memory: Fio keeps information it considers worth remembering as long-term memory and sends it with each conversation. You can view, edit, and delete all of it in Settings → Memory, or turn Memory off. When it is off, Fio no longer reads or writes memory.
• Earlier conversations: Fio searches your earlier conversations only when you explicitly ask it to.

4.2 What Fio Can Do

At your request, Fio can:

• create or edit Memos, move Memos to Trash, and create, rename, or delete folders;
• view or change data in the corresponding apps after you connect a device connector (see Section 4.3);
• search the web: Fio sends the search query to a third-party search service, Bocha for mainland China and Exa or Tavily for other regions;
• create report files and save them in your account;
• update your display name when you ask it to in a conversation.

4.3 Device Connectors

All device connectors are off by default. Fio can access a connector’s data only after you connect it in Settings → Connectors or in a conversation and authorize it in the iOS system prompt.

You can set each capability to Allow, Ask, or Don’t Allow. Viewing capabilities default to Allow, and changing capabilities default to Ask: Fio asks for your permission before creating an item, and once you allow it in a conversation, it does not ask again in that conversation; before every edit or deletion, Fio shows you the exact change for you to confirm. If you set a capability to Allow, Fio carries out those actions without asking.

Connector data is read only while Fio is handling your request and only when needed. There is no background or scheduled reading. The data Fio reads:

• is included in the request sent to the AI provider to generate an answer;
• is kept in a run record on your device and deleted 7 days after the run ends;
• may appear in Fio’s answer, which syncs to your account as part of the conversation.

You can disconnect a connector in Fiume or revoke the permission in iOS Settings at any time.

4.4 Health Data

After you connect Health, Fio reads only the types you authorize in iOS. These may include activity (steps, active energy, walking and running distance, flights climbed, exercise and stand minutes), sleep, workouts, heart rate (including resting heart rate, walking heart rate average, and heart rate variability), respiratory rate, blood oxygen, body measurements (weight, BMI, body fat percentage, height), nutrition (water, energy, protein, carbohydrates, fat), mindful minutes, and environmental and headphone audio levels.

For Health data, Fiume commits to the following:

• it is read only when you ask Fio for something that needs it, and used only to complete that request;
• Fiume never writes or changes any data in the Health app;
• it is not used for advertising, marketing, or profiling, not sold, and not provided to data brokers;
• it is not stored in iCloud;
• it is shared only with the AI providers needed to complete your request (see Section 3.3). If Fio refers to Health data in an answer, that answer syncs to your Fiume account as part of the conversation, and you can delete the conversation.

Fio’s analysis of Health data is not a medical diagnosis or treatment advice.

4.5 Location

After you connect Location, Fio gets your current location once, only while you are using the app and handling a request that needs it. It does not track you continuously or in the background. Address lookup and nearby place search use Apple Maps services. Fiume does not keep a separate location history; location information goes into AI requests and conversations as described in Section 4.3.

4.6 Background Runs, Completion Notifications, and Live Activities

When you leave the app, Fio can keep working on a task in progress, within the limits iOS allows. When it finishes, Fiume may send a notification and end the Live Activity, as described in Section 1.8.

5. Voice Input and Transcription

5.1 Where Recordings Are Kept

• Recordings are first saved on your device. Recordings that have not been transcribed stay in Untranscribed Recordings until you delete them. They do not sync.
• Audio recorded in the Memo or Journal editor is saved as an audio attachment to that Memo or Journal entry and syncs to your account like other attachments.
• Audio recorded on the standalone recording screen is deleted when you leave the screen. Only the text you choose to save is kept.
• Audio recorded on Apple Watch is saved on the watch, then transferred to your iPhone after recording, where it appears in Untranscribed Recordings. It is uploaded only when you choose to transcribe it on your iPhone.

5.2 How Transcription Works

To transcribe, Fiume uploads the recording to temporary storage used only for voice (a private Cloudflare R2 storage space, separate from attachment storage), where the speech recognition provider reads it. We currently use:

• Alibaba Cloud Model Studio, through its Singapore endpoint;
• if the main provider is unavailable, a speech recognition model provided through OpenRouter as a backup.

When the transcription job ends, the recording is deleted from temporary storage right away. The temporary storage also has a one-day automatic deletion rule as a backstop. Transcripts are kept on our servers for 30 days so your device can retrieve them, then deleted. Text you save into a Memo or Journal entry is kept like other user content.

When you use Clean Up with AI, the transcript is sent to a text AI provider as described in Section 3.

6. How We Share Information

We do not sell your personal information, and we do not use third-party advertising SDKs or behavioral analytics SDKs to track you across apps or websites.

We disclose information to the following categories of service providers or recipients only as necessary to provide the relevant feature, meet legal obligations, or protect legitimate rights.

6.1 Apple

We use these Apple services: Sign in with Apple, App Store subscription and transaction processing, the Apple Push Notification service (APNs), and Apple Maps services. Apple’s own terms and privacy policy apply to information Apple processes for purposes and by means it determines itself.

6.2 Cloud Infrastructure Providers

• Tencent Cloud: application servers in Virginia, United States;
• Google Cloud: database and backup processing in Virginia, United States (us-east4);
• PowerSync: account data sync service (United States instance);
• Cloudflare: network delivery, and R2 object storage for attachments, profile photos, report files, temporary voice files, and database backups.

These service providers should process data only as needed to provide their infrastructure services and are bound by their contracts and applicable law.

6.3 AI, Speech Recognition, and Search Providers

• Text AI: Google (Gemini on Vertex AI), OpenAI, xAI, DeepSeek, and Volcano Engine; see Section 3.3;
• Speech recognition: Alibaba Cloud Model Studio and OpenRouter; see Section 5.2;
• Web search: Exa, Tavily, and Bocha; see Section 4.2.

6.4 Legal, Security, and Rights Protection

We may disclose limited information related to a specific matter if required by law, a court, a regulator, or another competent authority, or where reasonably necessary to investigate fraud, security incidents, or abuse, or to protect users or Hecara’s legitimate rights.

We do not disclose your private Memos or Journal entries merely because a third party makes a general request.

6.5 Business Changes

If Fiume is involved in a merger, acquisition, reorganization, or asset transfer, service-related data may be transferred with that business where permitted by applicable law and subject to appropriate protections. If the change materially affects how your personal information is processed, we will notify you as required by applicable law.

7. Data Storage, International Transfers, and Security

7.1 Storage Location and International Transfers

Fiume’s application servers and its account and sync databases are located in the United States. Files such as attachments are stored in Cloudflare R2 object storage.

If you use Fiume outside the United States, your data is transferred to, processed in, and stored in the United States. In addition, depending on the features you use and the region you choose, some content is processed by providers in other countries or regions:

• transcription: Singapore (Alibaba Cloud Model Studio), and the United States and elsewhere (backup providers);
• text AI: Google, OpenAI, and xAI process requests on their global infrastructure, mainly in the United States; for accounts whose region is mainland China, requests are mainly processed in mainland China (DeepSeek and Volcano Engine);
• web search: the United States (Exa, Tavily) or mainland China (Bocha).

Data protection laws differ between countries and regions. Where applicable law requires an additional international transfer mechanism, Hecara will put in place a mechanism or safeguard recognized by that law before the restricted transfer occurs. You may contact [email protected] for information about transfers of your data.

7.2 Encryption in Transit and Account Separation

Data between your device and our servers is encrypted in transit with HTTPS/TLS. Cloud data is logically separated by account.

No network or cloud service can guarantee absolute security, but we use reasonable technical and organizational measures appropriate to the scale of the service and the nature of the data to reduce the risk of unauthorized access, disclosure, alteration, or loss.

7.3 Locked Folders and App Lock

Locked Folders and App Lock are Face ID checks on your device: you must pass the check before opening a Locked Folder or the app, and you are asked again after the app goes to the background or restarts.

A folder’s locked state is stored only on the current device and does not sync to your other devices. Content in a Locked Folder has no additional encryption. It syncs to your account like other content and is stored on our servers in a form the service can process.

7.4 EU / UK Representative

As of the update date of this Policy, Hecara has not appointed a local data protection representative in the European Economic Area or the United Kingdom.

If applicable law requires Hecara to appoint a representative in the EEA or UK, we will do so before that requirement applies to Fiume’s services, and will publish the representative’s contact information in this Policy and/or at hecara.com.

8. Retention and Deletion

We keep personal information only as long as needed for the purposes described in this Policy. Generally:

• account information is kept while your Fiume account exists;
• Memos, Journal entries, attachments, conversations, long-term memory, Journal tags and insights, Weekly Insights, and report files that you save and sync are kept while you keep that content or your account;
• temporary voice files are deleted as soon as transcription ends, and within one day at most; transcripts on our servers are kept for 30 days;
• cached AI replies on our servers are kept for 24 hours; Fio run records on our servers are kept for 30 days; Fio run records on your device are deleted 7 days after the run ends;
• in-app announcements are kept for 90 days;
• database backups are kept for 30 days;
• subscription, billing, security, abuse prevention, and legal records are kept as long as needed for those purposes and to meet applicable legal obligations.

8.1 Deleting Content

You can delete Memos, Journal entries, attachments, conversations, long-term memory, and other content you have permission to delete in Fiume. Some deletions first move content to Trash, where it is deleted according to your Trash settings. Deleted content may remain in database backups for up to 30 more days and is then deleted as the backups expire.

8.2 Deleting Your Account

You can request account deletion in Fiume.

When you do, your Fiume account is deactivated immediately and the user content controlled by Hecara enters the permanent deletion process: we delete your account content and stored files from our servers and revoke Fiume’s Sign in with Apple authorization with Apple.

Limited records may be kept as needed for security, abuse prevention, billing, refunds or disputes, and tax or other legal obligations. We do not use these records to keep providing content services for a deleted account.

Please note: Deleting your Fiume account does not automatically cancel your Apple App Store subscription. To stop renewal, cancel the subscription separately through Apple’s subscription management.

9. Your Rights and Choices

Depending on the laws that apply where you live, you may have some or all of the following rights:

• to access personal information we hold about you;
• to correct inaccurate information;
• to delete personal information or your account;
• to receive a copy or portable version of your data where applicable law requires;
• to restrict certain processing;
• to object to certain processing based on legitimate interests;
• to withdraw consent where processing relies on consent;
• to complain to a competent data protection or privacy authority;
• other privacy rights under applicable law.

In the app, you can:

• change your profile, region, and personalization settings;
• turn off AI data consent, Memory, or Journal Access;
• view, edit, and delete long-term memory;
• disconnect device connectors, or set each capability to Allow, Ask, or Don’t Allow;
• manage and delete content, or delete your account.

For requests you cannot complete in the app, email [email protected]. To prevent others from impersonating you, we may take reasonable steps to verify your identity before handling some requests. If local law allows an authorized agent or guardian to make a request on your behalf, we will handle it under applicable law and may ask for reasonable proof of authorization.

Fiume will not treat you in a discriminatory way prohibited by law because you exercise your privacy rights.

10. Children

Fiume is intended only for users who are 13 years of age or older.

We do not allow children under 13 to create or use a Fiume account. If we confirm that an account belongs to a child under 13, we will take reasonable steps to stop providing account services and delete the related personal information controlled by Hecara, except limited records required by law.

Users who are 13 or older but have not reached the age required by local law to consent independently or enter into a contract must obtain authorization from a parent or legal guardian where local law requires it. Where local law requires a higher age or parental consent, the local requirement applies.

11. No Advertising Tracking or Sale of Personal Information

Fiume currently:

• does not include third-party advertising SDKs or third-party behavioral analytics SDKs;
• does not sell personal information;
• does not share user content for cross-app or cross-website behavioral advertising;
• does not use your Memos, Journal entries, conversations, connector data, or Health data to build advertising profiles.

If these practices materially change, we will update this Policy before the change takes effect and provide notice, opt-out, or consent mechanisms where required by applicable law.

12. Changes to This Policy

We may update this Policy because of changes to product features, data processing, service providers, security needs, or applicable law.

If a change materially affects your privacy rights or how your personal information is processed, we will notify you through an in-app notice, our website, or another reasonable method, and update the date at the top of this Policy.

If applicable law requires consent before a new processing activity begins, we will not rely only on your continued use in place of that consent.

13. Contact Us

Fiume is provided by Hecara, operated by Zhang Yuxi.

Website: hecara.com
Privacy and support email: [email protected]

If you have questions about this Policy, Fiume’s processing of personal information, or your privacy rights, contact us at the email address above.