Privacy policy

Last updated: 21 September 2026.

This page says the same thing as the privacy screen inside the app, in the same order. If the two were ever to disagree, whatever the app's code does wins, and we'll fix this page.

1. Data controller

• Owner: Joan Cama Ribot
• Trade name: Somia Digital
• NIF: 41531670H
• Address: Carrer de Sant Joan, 16, 17200 Palafrugell (Girona), Espanya
• Email: hola@somiadigital.com

2. On your phone

Most of FactShot never leaves here. Your phone stores which cards you've read and what you said about them, the facts you've saved, the question queue, the streak, and your preferences: your name, your topics, how many cards you want a day, the skin, and your reminder times.

If you sign in with Apple, the session is stored in the iOS keychain.

3. The account, if you open one

The account is optional and can only be opened with Sign in with Apple. The app works fully without one.

If you open one, a copy of your progress goes up: the facts you've seen, the ones you've saved, the question queue, the streak, and three preferences. Nothing you ask the AI, and no text you write, goes up, other than your visible name.

With Apple you can hide your email; in that case we only see the relay address Apple gives us.

4. The Somia account, across apps

The account links the apps from the same maker so that what you buy in one counts in the others. It carries an identifier, and never the content of what you read or write. Deleting the account unlinks it.

5. Online play

This is the only part of FactShot that knows who you're doing something with. To play a match, there's your account identifier, your visible name — required to play — who you're playing each match with, your challenges and pending invitations, the score, which statement is up, and the last move.

Never your email, never your contacts, and never anything you've read.

It runs on our own service, hosted on Cloudflare, kept separate from the account.

6. Blocking and reporting

This is the only thing one person sends us about another: the rival being blocked or reported, the reason picked from a closed list of four, and the moment. There's no free-text field.

Reports are reviewed within 24 hours. The details of how it works are in the community guidelines.

7. Analytics

We collect a closed list of events and nine properties, to know which parts of the app get used.

Never the text of a question, never a card's content, never the exact score, never who you're playing with, and never your name.

The provider is PostHog. It can be switched off with a toggle in Profile, and from that moment it stops sending anything.

8. When you ask the AI

Whenever possible, the answer is generated on the phone itself, with Apple's model, and nothing leaves the device.

When it can't be, the server receives the question, the card's headline and explanation, the topic, the true-or-false statement with its answer, the source, the last few turns of the conversation, and an anonymous install identifier, to count the day's questions. Conversations are not saved.

Facts come with a verified source; AI answers don't.

9. Purchases

Apple charges them. RevenueCat checks the subscription status. FactShot never sees any payment data.

10. Notifications

There are two different things:

• Local reminders, generated by the phone itself. Up to five a day, and the text never names a fact or a streak.
• Push notices we send by hand, using an anonymous install identifier. The toggle in Profile turns off the tracking token on the server, not just on the phone.

11. How to delete everything

We explain it on the delete account page.

12. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability by writing to hola@somiadigital.com. You can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, agpd.es).

13. Data processors, and where the servers are

The United Kingdom is outside the European Union, and we say so plainly. The account database is in Supabase's eu-west-2 (London, United Kingdom) region. That transfer relies on the adequacy decision the European Commission adopted for the United Kingdom, which recognises a level of protection equivalent to the one in the General Data Protection Regulation; should that decision lapse or cease to apply, the transfer would rely on the standard contractual clauses approved by the European Commission.

International transfers. Some of the companies that provide services to us are based, or keep their servers, outside the European Economic Area — mainly in the United States. When data reaches them, the transfer relies on the safeguards set out in the General Data Protection Regulation: the standard contractual clauses approved by the European Commission and, where the company is certified under it, the EU–US Data Privacy Framework. We do not transfer data to any provider without a data processing agreement in place. You can ask us for a copy of these safeguards at hola@somiadigital.com.

14. Minors

You must be at least 14 years old to use FactShot. If you live in a country where the minimum age to consent to the processing of your data is higher, you must be that age. The terms of use say the same.

FactShot's App Store rating is 4+, and that is about the content: the cards are suitable for everyone. Both things are true at once — the content is for everyone, but a contract has to be one its signer can accept — and the reason for the second is that online play carries a display name another person sees, there is blocking and reporting, there is AI, and there is a paid subscription.

15. Retention

What's on your phone stays there until you delete the app. What's on your account stays there until you delete the account. A match's data is deleted with the account. Analytics events are kept in aggregate form, without identifying anyone.

16. Security

Traffic is encrypted. Access to our systems is limited, and online-play data is kept separate from account data.

17. FactShot is not a health product

FactShot is a card game with checked facts. It's not a health product, it does not promise to improve your memory or your health, and it makes no assessment of anyone.

18. This website

This site is static HTML. No cookies, no analytics, no third-party scripts, and no request leaves this domain: the fonts, images, and stylesheet all come from factshot.app. That's also why there's no cookie notice: there's nothing to consent to.

The only code that runs in your browser is a two-kilobyte file of ours that remembers whether you want the page light or dark. That preference is kept in your browser (in local storage, under the key factshot-theme) and is never sent anywhere: it is not a cookie, it does not travel with any request, and it cannot identify anyone. Clear the site data and it is gone, and the page follows your system again.

Our hosting provider — Netlify — logs the IP address and user agent of every request, on the grounds of the legitimate interest of security, and for a short period.

The support form. There is a form on the home page and on the support page for writing to us. It is delivered by Netlify (Netlify, Inc., United States), which acts as our data processor and receives the data under the standard contractual clauses approved by the European Commission. What reaches us is what you type — your name, if you give one, your email address and your message — and nothing else: no cookie, no tracker and no third-party script. We use it to answer you, and we keep it for as long as the conversation is of any use. It goes on no mailing list, we build no profile from it and it is never matched against anything in your account. If you would rather not go through it, write straight to hola@somiadigital.com, which is the same inbox.

19. Changes

If we change anything, we'll change the date at the top. If the change matters, we'll say so inside the app.