FactShot privacy policy
This is an earlier version of this document and is no longer in force. The current one is here.
Version 2.1. Effective date: 5 October 2026.
This document explains what FactShot does with your data. The use agreement — what you can do with the app, what costs money and what is not guaranteed — is a separate document: the Terms and conditions.
In brief
FactShot works entirely on your phone and without an account: the cards you have read, what you said about them, the question queue and your streak are stored on your device. The only things that leave your phone are the ones you choose to use: the account, if you open one, so that your progress is not lost; online play, which needs to know who you are playing with; the questions to the AI that the phone cannot answer on its own, which we do not store; and, only if you say yes, pseudonymous usage analytics (section 10). There is no advertising, there are no trackers and no data is sold to anyone.
1. Who the data controller is
- Controller: Joan Cama Ribot (Somia Digital)
- Contact email: hola@somiadigital.com
The rest of the owner's identification details are in the legal notice. There is no data protection officer: this activity is not among those for which Article 37 GDPR requires one.
2. The principle: local first
FactShot is a local-first app. All of this lives in the database on your phone and is never copied to any server of ours unless you open an account (section 3):
- which cards you have read and what you said about them;
- the facts you have saved, the question queue and your streak;
- your preferences: your display name, your topics, how many cards you want each day, the skin and your reminder times.
If you ever delete the app, all of that goes with it. If you have an account, the part that is copied to it comes back when you sign in again; the rest we do not have and cannot restore for you. To keep a full copy, the way to do it is the one Apple already gives you: an iCloud or computer backup of your iPhone.
3. The account, if you open one
The account is optional, and FactShot works just the same without one. It is opened with "Sign in with Apple", and it is there so that your progress is not lost if you change phones and so that what you buy counts in the other Somia Digital apps.
If you open one, our server (Supabase, eu-west-2 region, London, United Kingdom) holds:
- the account identifier and the email that the service you sign in with gives us; with Apple you can hide it, and then all we see is the relay address Apple gives us;
- a copy of your progress: the facts you have seen, the ones you have saved, the question queue and your streak;
- three preferences: your display name, your topics and how many cards you want each day.
Nothing you ask the AI is uploaded there, nor any text you write, apart from your display name.
The session is stored in the iOS keychain, which is where the phone keeps passwords.
The Somia account. Somia Digital makes more than one app, and the Somia account links them so that a purchase made in one counts in the others. The link is made by our server with the session you have just opened: an identifier travels, and never the content of what you do in the app. If you delete the account, it is unlinked, and a Somia account left with no app linked to it is deleted entirely.
You delete the account yourself, from inside the app, whenever you like: how it is done and what gets deleted. The legal basis is performance of the contract (Article 6(1)(b) GDPR): it is what you ask for when you open it.
4. The permissions the app asks for
FactShot only asks for each permission when it needs it, and always with the system dialog. All of them can be withdrawn whenever you like from the system Settings, and the sections below explain what the app does with each.
| Permission | What for | When it is requested | If you say no |
|---|---|---|---|
| Notifications | Reminders, FactShot announcements and the alert that it is your turn to play | When you switch on reminders or announcements | You get none of these alerts; the app works just the same |
| Photos | Saving to your photos the image of a fact you share: adding only, never reading them | The first time you save one | The image is not saved; you can still share it |
5. Online play
This is the only part of FactShot that knows who you are doing something with: to pair you with someone, keep track of whose turn it is and tell you "it's your turn", the game service has to know that you and the other person are playing a match. You need an account to play online. The service holds:
- the account identifier and your display name, which you need in order to play with anyone;
- who you play each match with, your challenges and your pending invitations, which expire after seven days;
- the score, which statement is up next and when you last played.
Never your email, your address book or your contacts, or anything you have read or saved in the app.
It runs on a service of our own hosted on Cloudflare (play.somiadigital.eu), kept separate from the account. The only thing another person sees of you is your display name, and you are answerable for what you put in it: the community guidelines say what is not allowed.
Blocking and reporting. This is the only thing one person sends us about another: who blocks whom and when and, for reports, the reason, picked from a closed list, and the display name the reported person was showing at that moment, so that changing it does not wipe out the complaint. There is no free-text field. The blocked person is not notified. We read reports ourselves, as soon as we can, and they are deleted automatically after 12 months.
When you delete your account, your player, display name, queue, invitations and blocks are deleted, and in the history of the people you have played with you show up as "deleted player", with no name and no identifier. Reports you have made are kept without saying who made them; reports made about you are kept until the same deadline, in case action needs to be taken again.
The legal basis for online play is performance of the contract (Article 6(1)(b) GDPR); for blocking and reporting, it is our legitimate interest (Article 6(1)(f)) in keeping the game safe for everyone.
6. If you use Game Center
The leaderboards and achievements in FactShot belong to Game Center, Apple's service. If you are signed in to it on your phone, the app sends it five numbers: your best streak, how many facts you have read, how many quiz answers you have got right, how many games of "The full deck" you have won against people and whether you have won a challenge; if you are not, it sends nothing. Apple stores them with your Game Center account, and your Game Center friends can see them.
Never which facts you have read or what you said about them, and never who you have played with.
FactShot does not open Game Center on its own: only when you tap its row in Profile. To sign out, go to Settings ▸ Game Center. Apple acts there as an independent controller, under its own privacy policy; the legal basis for what we send it is performance of the contract (Article 6(1)(b) GDPR), because you ask for it by signing in.
7. Artificial intelligence
You can ask an AI questions about the card you have open.
Whenever your phone can, the answer is generated on the phone itself, with Apple's model, and nothing leaves it.
When the phone cannot, the question goes to our server (Supabase, eu-west-2 region, London, United Kingdom) and, from there, to Google's Gemini, which generates the answer on our behalf. What is sent:
- your question and the last few turns of the conversation;
- from the card: the headline, the explanation, the topic, the source and the true-or-false statement with its answer;
- the language.
Never your name, your email or anything that identifies you. We do not store any question or any answer, not even a summary or a fragment.
To count the daily question limit we store a counter: the account identifier if you have opened one, or otherwise a random installation identifier, the day and a number. It is deleted automatically after 7 days.
AI answers are generated by an automated model: they may be wrong, and they are not a verified source. The facts on the cards come with a verified source; AI answers do not. The legal basis is performance of the contract (Article 6(1)(b) GDPR): it is the feature you are using when you ask.
8. Notifications
Local reminders. If you switch them on, FactShot schedules up to five reminders a day, plus a weekly review on Sundays. Your phone generates them and they go through no server. Each one may carry the opening of a fact from the deck — public content, the same for everyone — cut off before the punchline, and never anything of yours: no streak, no name, no count. If you would rather have nothing on your lock screen, switch them off or hide their previews in your iPhone's Settings.
FactShot announcements (push notifications). If you have allowed notifications for FactShot, we store the code Apple assigns to your device so we can send it announcements (the notification "token"), together with a random installation identifier, the language and the app version. We only use it to send you general FactShot announcements (for example, what's new), never third-party advertising. If you have an account, the registration also stores the account identifier, only to tell you about things that are yours, such as when it is your turn to play. You can stop receiving them whenever you like in iOS Settings, or with the "Receive announcements" toggle in Profile, which switches them off on the server and not just on the phone, and also hides the in-app sheet; codes that Apple tells us are no longer valid are deactivated automatically. The app asks for no new permission for this: it only registers the code if you had already granted notifications.
The same announcements, inside the app. FactShot can also show them as a sheet on the main screen. The app fetches it from our server in the same way for everyone and without sending any identifier, at most once per session and only if you have not seen it yet; which ones you have seen is stored on the phone. If it carries an image, the image is downloaded from the same server, which sees your IP address, as happens with any image on the internet.
The legal basis for these announcements is your consent (Article 6(1)(a) GDPR), which you give by switching notifications on and withdraw by switching them off.
9. The subscription
FactShot Premium is charged through your Apple in-app purchase. We neither see nor receive your payment method: Apple handles all of it.
To know whether your subscription is active we use RevenueCat, an intermediary that talks to Apple. An anonymous installation identifier and the purchase status travel there. Your name and your email do not. If you open an account, the Somia account identifier is sent instead of the installation identifier, so that the subscription counts in our other apps too.
The legal basis is performance of the contract (Article 6(1)(b) GDPR): without this data we could not give you what you have paid for.
10. Analytics
Pseudonymous usage analytics is only switched on if you say yes: it is off until you switch it on yourself in Profile, with the "Analytics" toggle. If you say no, nothing is sent; changing your mind takes effect immediately and changes nothing else in the app. The legal basis is your consent (Article 6(1)(a) GDPR).
If you switch it on, what is sent are action names from a closed list of fourteen: that you started or finished a deck, read a card, answered a question, shared a fact, saw the Premium screen, started a purchase, asked the AI (and whether you hit the limit or it could not answer you), switched mode, finished a quiz game, and started or finished an online match. They come with at most nine details from a list that is also closed: whether you said you already knew it, whether the answer was right, the mode, whether the AI answered from the phone or from the cloud, the reason for an AI error, the kind of deck, a score band, who you were playing against (a friend, a random opponent or the practice opponent, never who) and how it ended.
What is never sent:
- no text: not a question, not a card's content and not your display name;
- no personal identifier: not your email, not your account, not who you play with and not any match identifier;
- no exact score, no amount and no purchase identifier;
- no automatic crash reports.
So that we can count without knowing who you are, each installation carries a random identifier that the app generates and stores on the phone: it cannot be linked to your name, your email or your Apple account. That is why we call it pseudonymous and not anonymous: we do not know who you are, but the actions of one installation can be counted together. A few technical details of the device also travel with each action: the model, the iOS version, the language and the time zone. When you switch it off, nothing more is sent.
On top of that list, the analytics tool counts five moments in the app's life on its own: when it is installed, when it is updated, when it is opened, when it comes back to the foreground and when it goes into the background, along with the app version. These carry nothing of yours either.
It is collected by PostHog, in its EU Cloud region in Frankfurt (Germany, European Union). Deriving your location from your IP address is switched off: we do not even derive the country.
11. The ideas and bugs inbox
From Profile ▸ "Ideas and bugs" you can write to us without leaving the app. Nothing is sent until you tap "Send".
- What is sent: the kind of message (idea, bug, improvement or other), the text you write, your email if you leave one so we can reply (it is optional), the app version, the platform and the language. No identifier travels: the inbox is not tied to any account.
- Where it goes: to a function on our Supabase server (eu-west-2 region, London, United Kingdom), which stores the message and emails it to us through Resend, our email delivery provider.
- Against spam: the server limits how many messages can be sent each day from the same connection. To do so it does not store your IP address: it stores an encrypted fingerprint that includes the date and is useless by the next day.
- What for: to read it, reply if you left your email and improve FactShot. Nothing else: we do not build mailing lists or use those addresses for anything else.
- How long: messages are kept for 12 months from when they arrive and are then deleted from the server automatically, and from our mailbox.
- Legal basis: your consent (Article 6(1)(a) GDPR), given by sending the message, to read it and reply to you; and our legitimate interest (Article 6(1)(f)) in keeping spam out, for the connection fingerprint.
If the server does not respond, the app opens your email program with the text already written and addressed to hola@somiadigital.com: in that case you send the message yourself, from your own email.
12. Over-the-air updates
FactShot can update itself from the inside without going through the App Store (only the program part, never the system). To find out whether there is a new one, the app asks our update server, hosted on Cloudflare (updates.factshot.app).
That question carries the technical fingerprint of the version you have and the channel, and nothing else: no identifier of yours, no phone data and no app content. The answer is a signed program file, which the phone verifies before installing it. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in delivering the app working and untampered with.
13. The support form on the website
There is a support form at factshot.app/en/. It only collects data if you fill it in.
- What you put in: your email and your message (both required) and, if you want, your name. We ask for nothing else, and you do not need to include health data or any sensitive data.
- What for: to read your enquiry and answer it. Nothing else: we do not build mailing lists, we do not send newsletters and we do not use those addresses for anything else.
- Who stores it: the site is hosted on Netlify (Netlify, Inc., United States), acting as a data processor. Netlify receives and stores the submission so that we can read it. The transfer outside the European Economic Area is made under the safeguards of Chapter V of the GDPR (standard contractual clauses).
- How long: 12 months at most from when the enquiry arrives. After that it is deleted from Netlify and from our mailbox.
- Legal basis: your consent (Article 6(1)(a) GDPR), given by sending the form, to reply to you; and our legitimate interest (Article 6(1)(f)) in keeping spam out.
- The form sets no cookies, loads no scripts and does no tracking. It carries a hidden trap field for robots, which nobody should fill in.
If you would rather not use the form, write straight to hola@somiadigital.com.
14. Visit statistics for the website
To know how many people visit factshot.app and which pages they read, we use Rybbit, an open-source statistics tool installed on our own server. No analytics company is involved.
- What is recorded: the page you visit, the page you came from, your browser language, the type of device, the browser and operating system, the screen size, and the approximate country, region and city.
- No cookies: it stores nothing in your browser and does not follow you from one site to another.
- Your IP address is not stored: it is used on the spot to work out the approximate location and to calculate an anonymous identifier that changes every day, so that we can count a day's visitors without knowing who they are.
- Where: on a server rented from OVHcloud (OVH Ltd), which acts as processor, in London (United Kingdom), a country with an adequacy decision from the European Commission (Article 45 GDPR). Visits reach it through Netlify, which hosts the site.
- How long: 26 months; then they are deleted.
- Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in knowing how the site is used in order to improve it.
15. For what, on what basis and for how long
What stays on your phone does not reach us, and we do not process it: you are the one responsible for keeping it there. Of what does reach us, this is the complete list:
| What | Legal basis | How long |
|---|---|---|
| The account | Performance of a contract (Art. 6(1)(b) GDPR) | As long as the account exists; if you delete it, it is deleted |
| Online play | Performance of a contract (Art. 6(1)(b) GDPR) | As long as the account exists; if you delete it, it is deleted |
| Blocking and reporting | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months |
| Artificial intelligence: the daily limit counter | Performance of a contract (Art. 6(1)(b) GDPR) | 7 days |
| Announcements (push notifications) | Consent (Art. 6(1)(a) GDPR) | Until Apple tells us the code is no longer valid |
| The subscription | Performance of a contract (Art. 6(1)(b) GDPR) | For as long as needed to manage the subscription |
| Analytics, if you say yes | Consent (Art. 6(1)(a) GDPR) | As long as needed for statistics; if you withdraw consent, nothing more is sent |
| The ideas and bugs inbox | Consent (Art. 6(1)(a) GDPR); legitimate interest, against spam (Art. 6(1)(f)) | 12 months |
| Over-the-air updates | Legitimate interest (Art. 6(1)(f) GDPR) | Technical logs kept by the provider, for short periods |
| The website support form | Consent (Art. 6(1)(a) GDPR); legitimate interest, against spam (Art. 6(1)(f)) | 12 months |
When the basis is your consent, you can withdraw it whenever you like; withdrawing it does not make unlawful what was done before.
16. Who receives the data
The providers that help us run FactShot process the data on our behalf (they are processors) and only for what we entrust to them. Apple is a case apart: payment, the App Store and the delivery of announcements are handled by Apple as an independent controller, under its own privacy policy.
| Who | What for | Where | Safeguard |
|---|---|---|---|
| Supabase, Inc. | Processor: the account, artificial intelligence, announcements (push notifications) and the ideas and bugs inbox | eu-west-2 region, London, United Kingdom | UK adequacy decision and, failing that, standard contractual clauses |
| Cloudflare, Inc. | Processor: online play, the account and over-the-air updates | global network, with servers worldwide | Standard contractual clauses or adequacy decision |
| Processor: artificial intelligence | global network, with servers worldwide | Standard contractual clauses or adequacy decision | |
| PostHog, Inc. | Processor: analytics, if you consent | EU Cloud, Frankfurt (Germany), European Union | The data stays in the EU; because the company is based in the United States, standard contractual clauses also apply |
| Resend, Inc. | Processor: the ideas and bugs inbox | eu-west-1 region, Ireland, European Union | The data stays in the EU; because the company is based in the United States, standard contractual clauses also apply |
| RevenueCat, Inc. | Processor: subscription status | United States | Standard contractual clauses or adequacy decision |
| Netlify, Inc. | Processor: hosting the website and the support form | United States | Standard contractual clauses or adequacy decision |
| Apple | Independent controller: the account, payment through the App Store, announcements (push notifications) and Game Center | According to its own policy | Its own privacy policy |
When a provider processes data outside the European Economic Area, it does so under the safeguards that Chapter V GDPR requires: standard contractual clauses or an adequacy decision. We do not sell or pass on any data to anyone.
17. Your rights
You have the right to access your data, rectify it, erase it, restrict or object to its processing, to data portability and to withdraw consent at any time, and to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority. We answer within one month at most; if the request is complex, the deadline may be extended by two further months, and we will tell you.
In practice, and because it is faster than writing to us:
- Delete the account and what is on the server: Profile ▸ Your account ▸ "Delete the account" (what gets deleted). The progress on your phone is left alone.
- Delete what is on the phone: delete the app.
- Switch off analytics or announcements: in Profile, with a toggle for each.
- Take your data with you: Profile ▸ "Export my data" builds a file with your progress on your phone and lets you save or share it. It never goes through any server of ours.
For anything else, write to hola@somiadigital.com.
18. Automated decisions
We do not make automated decisions that have legal effects on you or similarly affect you, and we do not profile you (Article 22 GDPR).
19. Minors
The app is rated 4+ on the App Store. You must be 14 or older to use FactShot. If you live in a country where the minimum age to consent to the processing of your data is higher, you must be that age. The subscription is always taken out by the Apple account holder.
That rating is about the content: the cards are suitable for everyone. The minimum age is something else: it is the age needed to accept the contract and to make decisions about your own data, and it is higher because online play shows a display name to other people, there is blocking and reporting, there is AI and there is a paid subscription.
20. Security
We do what is reasonable to protect the little that leaves the phone: all traffic is encrypted, access to our systems is restricted, online-play data is kept separate from account data and update files are signed. No system is infallible: if there were ever a security breach putting your data at risk, we would notify the supervisory authority and, if it affected you, we would tell you.
21. Changes to this policy
If what the app does changes, this document changes first, not afterwards, and the date at the top moves. Significant changes are announced inside the app, and earlier versions stay published and dated at the bottom of this page.
22. Contact
Write to us at hola@somiadigital.com. The governing version of this document is the Catalan one; the others are translations.