Privacy Policy

Privacy Policy

Effective date: 18 July 2026

This Privacy Policy explains how BasedApp (“BasedApp”, “we”, “us”, or “our”) handles information when you use the BasedApp mobile application, the BasedApp AI service, and the pages available on this website (collectively, the “Service”). It is written to describe the Service as it operates today. If a future feature changes how information is handled, we will update this policy before or when that feature becomes available.

1. Scope and controller

BasedApp is the controller of information processed through the Service where applicable law uses that term. This policy covers the BasedApp app and the BasedApp service at basedapptodo.xyz. It does not cover the privacy practices of third-party services, websites, operating systems, app stores, or AI providers that may process information under their own policies.

2. Information you create in the app

BasedApp lets you write decision questions, options, goals, concerns, values, reflections, commitment notes, and related content. It may also generate an insight in response to content you choose to submit. This material can contain personal information depending on what you write.

By default, this content is stored locally in the app’s private storage on your device. BasedApp does not require an account, does not provide cloud synchronization for your decisions, and does not operate a user-profile database for your decision content.

3. Optional AI requests

AI assistance is optional. The app sends content to the BasedApp AI service only after you actively select a feature such as “Generate insight” or “Generate insights”. The app does not continuously monitor text fields and does not send your drafts merely because you opened, viewed, or saved a decision.

For an AI request, the Service receives the text necessary to form the requested response. Depending on the feature, this may include your question, success vision, values, concerns, assumptions, listed options, selected risk and confidence values, and coach reflections. The Service forwards that request to its configured AI provider over an encrypted connection and returns the generated response to the app.

Please do not submit information that you do not want processed by an AI provider. In particular, avoid entering passwords, payment-card data, government identifiers, health records, or highly sensitive personal information.

4. AI providers and third parties

BasedApp uses a configured third-party AI provider to generate optional AI responses. That provider processes the request under its own terms, security practices, and privacy policy. The provider may be located in a different country from you. BasedApp does not sell your decision content and does not use it for advertising or cross-context behavioural advertising.

We may also use hosting, network, security, and infrastructure providers to operate the Service. These providers may process limited technical information solely to provide, secure, or maintain their services.

5. Technical information and abuse prevention

When an AI endpoint is called, the service receives the network address used to make the request and an app installation identifier supplied by the app. To prevent abuse, the service combines the IP address with a one-way SHA-256 hash of that identifier and keeps a short-lived, in-memory request counter. The counter is used only to apply rate limits. It is not written to the BasedApp application database, is not used to build a user profile, and is removed when its rate-limit window or service process ends.

Our web server or hosting provider may create standard operational logs, such as request time, IP address, status code, and error information. These logs are used for reliability and security, not advertising.

6. How we use information

We use information only to provide and improve the Service, deliver an AI response you explicitly request, protect against abuse and fraud, diagnose failures, comply with legal obligations, and communicate with you when you contact support. We do not use your in-app decision content to market products to you.

7. Legal bases

Where a legal basis is required, we process information to provide the Service you request, with your consent when you choose optional AI assistance, to comply with legal obligations, and for legitimate interests in security, fraud prevention, service reliability, and support. You may stop using optional AI assistance at any time by not selecting the generate actions.

8. Retention and deletion

Your decisions and reflections remain on your device until you remove them in the app, clear all local data in Settings, delete the app, or your device removes the app’s data. Backups are controlled by your device and backup settings. BasedApp’s AI service is designed not to store prompts or generated responses in a persistent application database. Short-lived rate-limit data is kept only as described above.

If you contact support, we retain your message and correspondence only for as long as reasonably necessary to answer the request, maintain support records, resolve disputes, or meet legal obligations.

9. Security

We use HTTPS for communication between the app, the BasedApp service, and the configured AI provider. No Internet transmission or storage system is completely secure; please avoid submitting sensitive information through optional AI requests. You are responsible for securing your device and keeping its operating system up to date.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information we process about you, and to withdraw consent where processing is based on consent. Because the app is local-first, you can directly delete most app content from your device. To make a request about information held by the BasedApp service or to ask a question about your rights, email us at [email protected]. We may need to verify a request before responding.

11. Children

BasedApp is not directed to children. Do not use the Service to submit personal information about a child. If you believe a child has provided personal information through the Service, contact us so we can review the request.

12. International transfers

The Service and its providers may process information in countries other than the country in which you live. Those countries may have different data-protection laws. Where required, we use appropriate safeguards for international transfers or rely on another lawful transfer mechanism.

13. Changes to this policy

We may update this policy to reflect changes in the Service, technology, law, or our data practices. We will post the updated version at this address and change the effective date. Continued use of the Service after an update is subject to the updated policy to the extent permitted by law.

14. Contact

For support, privacy questions, or requests concerning this policy, email [email protected].