Effective date: October 27, 2026
Hippomo ("the app," "we," "us") is a personal note-taking and memory app for iOS. This policy explains what information Hippomo collects, how it is used, and who it is shared with. It applies to the Hippomo iOS app and its backend services.
The data controller is Yevhenii Veretennikov, a sole trader (jednoosobowa działalność gospodarcza) registered in CEIDG in Poland — full registration details are in the Terms of Use.
If you have questions about this policy or want to exercise any of the rights described below, contact us at veret.evg@gmail.com.
Hippomo can be used anonymously, or signed in with Apple or with Google.
What happens to your content depends on which feature you use:
Notes/memos synced to our backend are end-to-end encrypted. Your device encrypts the content before it leaves — the text you wrote and everything Hippomo derived from it, such as the category, tags, amounts, vendors and titles — using a key created on your device that is never sent to us. Alongside the encrypted content our backend stores only what it needs to file it: which account it belongs to, an identifier for the note, when it was created, and whether it came from the one-time "Let's meet" introduction. We cannot read your notes. Neither can our infrastructure providers, and a legal demand for them would return only encrypted data that we have no way to decrypt.
The key is kept in your device's Keychain. If you have iCloud Keychain switched on, Apple carries it to your other devices; it never passes through Hippomo. This has a consequence worth understanding: if you lose every device that holds the key, along with the iCloud Keychain copy, we cannot recover your backup — there is no copy of the key on our side to restore it with.
Asking a question is different. The encryption protects your backup, not the AI feature. When you ask Hippomo something, your question and the note content needed to answer it are decrypted on your device and sent to our AI provider (see "Third-Party Services" below), so that content leaves your device readable.
Notes backed up by earlier app versions, before encryption was added, were stored as plain text. When you update to a version that supports encryption, your device re-uploads them encrypted and the readable copies are replaced.
Files are backed up on the same terms, on Hippomo Pro only. A voice memo's audio and a bill document you imported are encrypted on your device before they are uploaded, with the same key that protects your notes. The file's name, its type and its size are inside the encrypted part — our backend stores only which account it belongs to, an identifier for the file, which note or bill it belongs to, and when it was created. We cannot open your files. On the free plan nothing is backed up at all: your files stay on your device, and a device that loses them cannot get them back from us. Transcription is separate from backup — a voice memo's audio is sent to be transcribed whatever your plan.
If your subscription ends, the files already backed up stay readable to you for 90 days, so you can restore or export them. After that they are deleted from our backend. Your own copies on your device are never touched by this. Your notes are not affected — they are kept as long as your account is.
Hippomo does not receive or store your payment card details. Purchases are handled entirely by the Apple App Store; subscription status is confirmed to us through our payments partner, RevenueCat (see below).
Your notes are never used for advertising. No note, question, answer, or bill detail is ever sent to an advertising network, used to choose which ad you see, or used to build a profile about you. We do not sell your personal information.
If you are on the free plan, Hippomo shows ads supplied by Google AdMob. They appear as occasional sponsored rows in your list of all memos and in search results, clearly labelled "Sponsored". No ad is ever shown inside a chat.
Hippomo Pro removes all ads. If you subscribe, the advertising SDK is not started at all, and you are not asked for the consent or tracking permissions described below.
To show ads, Google receives information from your device — including your device's advertising identifier, approximate location derived from your IP address, and technical details about your device and the ad shown. This is collected by Google, not passed on by us: we send Google nothing about you and nothing from your vault.
Google's handling of this data is governed by its own privacy policy — see How Google uses information from sites or apps that use our services.
Hippomo records how the app is used, and reports when the app crashes, so that problems can be found and fixed. This is the only part of Hippomo that exists to tell us something about you rather than to do something for you, so it is worth being exact about what it does and does not include.
What is recorded. A short, fixed list of events, each one a count of something happening: a memo was saved, a question was asked, a voice memo was recorded, a bill was imported, the upgrade screen was shown, a purchase completed, sign-in succeeded, the introduction was finished or skipped. Alongside an event we record only values drawn from a fixed list — which category a memo was filed under, whether it came from typing or from voice, roughly how long a recording was, and which screen raised the upgrade prompt.
What is never recorded. The text of your memos, and their titles, tags, amounts, vendors and dates. The questions you ask and the answers you receive. The names or the contents of your files. None of this is sent to the analytics or crash-reporting services under any circumstances. The list of events is fixed in the app's source code and cannot be extended while the app is running, so no change on our side can start collecting your content without a new release.
Hippomo does not record your screen. Session replay — the feature some analytics tools offer that reconstructs what a user saw and tapped — is switched off deliberately, because Hippomo puts your memos on screen almost everywhere.
What identifies you. Events carry the same account identifier that our backend files your notes under. It is not your name and it is not your email address, because we hold neither. Before you sign in it is the random device identifier described under "Account information" above. The analytics service also receives your device model, your operating system version, your app version, and the IP address your device connects from, from which it derives an approximate location (country or city level).
Crash reports contain the technical state of the app at the moment it stopped: which code was running, your device model and operating system version, and the recent events listed above as a trail leading up to the crash. They do not contain your content.
You can switch all of this off at any time in Profile → Data & storage → Share diagnostics. Turning it off stops both the usage events and the crash reports from that device. Nothing else about how Hippomo works changes.
You can send us feedback from Profile → Feedback → Send feedback. After you take a screenshot in Hippomo, the app also offers to send it to us as feedback. Nothing is sent unless you tap Send.
Screenshots. iOS does not give Hippomo the screenshots you take; it only tells Hippomo that one was taken. When you open the feedback form from that offer, Hippomo attaches its own picture of the Hippomo screen at that moment. You can see it in the form and remove it before sending, or attach a picture from your photo library instead. A screenshot can show your notes, and it is sent readable — it is not covered by the end-to-end encryption that protects your notes.
What is sent. Your message; the screenshot, if you keep one; your device model, operating system version and app version; the app's language, your device's language and region, and your time zone; how much free storage your device has; and, if analytics is switched on, the identifiers that link your feedback to your analytics events (see "Analytics and Crash Reporting" above). Our backend adds your Hippomo account number, your plan (free or Hippomo Pro), and whether you signed in with Apple, with Google, or not at all. The random device identifier used before you sign in is never included.
Where it goes. Feedback is stored on our backend (Convex). From there, our backend posts it to a private Telegram chat that only the developer of Hippomo reads, using a Telegram bot. The connection to Telegram is made by our backend, never by the app.
Turning off the offer. You can stop Hippomo from offering to send feedback after a screenshot in Profile → Feedback → Offer after screenshots. Sending feedback from Profile still works.
If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
| What we do | Legal basis |
|---|---|
| Storing and syncing your notes; answering your questions; processing bills you import; operating your account | Performance of a contract (Art. 6(1)(b) GDPR) — these are the features you asked for by using the app |
| Operating the actions allowance and subscriptions | Performance of a contract (Art. 6(1)(b) GDPR) |
| Keeping the service reliable and secure — debugging, error logs, preventing abuse and fraud | Our legitimate interests (Art. 6(1)(f) GDPR) in running a working, non-abused service |
| Keeping records required by Polish accounting and tax law | Legal obligation (Art. 6(1)(c) GDPR) |
| Recording how the app is used, and receiving crash reports, in order to find and fix problems | Our legitimate interests (Art. 6(1)(f) GDPR) in knowing which parts of the app work and keeping it reliable. You can object at any time by switching it off — see "Analytics and Crash Reporting" above |
| Reading and answering feedback you send, and fixing the problems it reports | Our legitimate interests (Art. 6(1)(f) GDPR) in supporting users and fixing problems. Feedback is only sent when you choose to send it |
| Showing personalised ads on the free plan | Your consent (Art. 6(1)(a) GDPR), collected through Google's consent form and Apple's tracking prompt. You can withdraw it at any time — see "Advertising" above |
| Showing non-personalised ads on the free plan | Our legitimate interests (Art. 6(1)(f) GDPR) in funding a free tier |
Providing this data is not a statutory requirement, but without it the app cannot function — notes cannot be synced or questions answered if there is nothing to process.
Your notes/memos are synced to our backend (built on Convex) so they're available if you reinstall the app or sign in on a new device — this is the durable copy of your data, and it is encrypted (see "Content you create" above). A working copy is also kept on your device using Apple's on-device storage (SwiftData), in readable form, so that search and offline access work.
Your "Ask" conversation history (your questions and Hippomo's answers) is kept only on your device and is not synced to our backend. For a document you import, the details Hippomo confirms sync inside its note, as described above; the full text read from the file stays on your device.
These features show your notes outside the Hippomo app itself. Each is run by Apple's system on your device:
Deleting a note, or signing out, removes it from Spotlight and from the widgets. You can stop Siri and Search from using Hippomo at any time in your device's Settings, in Hippomo's Siri options.
Hippomo relies on the following third-party services to operate. Each only receives the information needed to perform its function:
| Service | Purpose | What it receives |
|---|---|---|
| Sign in with Apple | Account authentication | Apple handles the sign-in itself and knows that you signed in to Hippomo. It returns an identity token to us; we use and store only the anonymous account identifier from it. No name or email is requested |
| Google Sign-In | Account authentication | Google handles the sign-in itself and knows that you signed in to Hippomo. It returns an identity token to us; we use and store only the account identifier from it |
| OpenAI and, in some configurations, Anthropic (Claude API) | Generating answers to your questions, reading documents and pictures, and transcribing voice memos | The text of your question/request and relevant note content needed to answer it, and the documents and pictures you import or attach, as text or as pictures (see "Content you create" above) — sent through our backend. Also the audio of a voice memo, which goes to OpenAI whichever provider is in use. OpenAI is the provider Hippomo uses; we may route requests to Anthropic instead. Neither provider is permitted to train models on your content |
| Convex | Backend database and sync | Your note content in encrypted form, which Convex cannot decrypt, plus — on Hippomo Pro — your files in encrypted form, and account identifiers and credit/subscription state. Also feedback you send, including any screenshot, in readable form (see "Feedback You Send" above) |
| Telegram | Delivering feedback you send to the developer of Hippomo | Only feedback you choose to send: your message, any screenshot, and the details listed under "Feedback You Send" above. It is posted by our backend through a Telegram bot into a private chat. Telegram handles it under its own privacy policy |
| RevenueCat | Subscription management | An anonymous purchase identifier and subscription/receipt status (no payment card details) |
| Apple (App Store / StoreKit) | Processing subscription payments | Handled entirely by Apple under Apple's own privacy policy |
| Apple (Siri, Spotlight and widgets) | Saving and asking through Siri, finding notes in Spotlight, showing notes in widgets | What you say to Siri and Hippomo's reply; the titles and text of your notes in the on-device Spotlight index; the notes shown in the widgets you add. Handled by Apple under Apple's own privacy policy |
| PostHog | Product analytics — counting how the app's features are used | The fixed list of usage events described under "Analytics and Crash Reporting" above, your account identifier, your device model, operating system version and app version, and your IP address. No note, question, answer, bill or file content is ever sent. Hippomo uses PostHog's European Union region, so this data is held in the EU |
| Google Firebase Crashlytics | Crash reporting | The technical state of the app when it stopped, your device model and operating system version, a Firebase installation identifier, your account identifier, and the recent usage events as a trail leading up to the crash. No note, question, answer, bill or file content is ever sent. Only the crash-reporting part of Firebase is built into Hippomo — Firebase Analytics is not included in the app, and crash reports are never used for advertising |
| Google AdMob (free plan only) | Showing ads | Your device's advertising identifier (only if you allow tracking), IP address and the approximate location derived from it, and technical details about your device and the ads shown. No note, question, answer, or bill content is ever sent. |
| Google User Messaging Platform (free plan only) | Collecting and recording your advertising consent choice in the EEA and UK | Your consent choice, stored on your device |
Beyond the analytics and crash reporting described above, and the advertising described above, Hippomo uses no other tracking SDK. On Hippomo Pro, no advertising SDK runs at all. Hippomo has never included, and does not include, any SDK that reads your notes.
We are based in Poland, but some of the providers above (OpenAI, Anthropic, Convex, RevenueCat, Google and Apple) are established in the United States, so your data may be processed outside the European Economic Area. Telegram, which delivers feedback you send, is established outside the European Economic Area too. Analytics data is an exception: Hippomo uses PostHog's European Union region, so it stays in the EU. Crash reports go to Google Firebase Crashlytics and may be processed in the United States. Where that happens, the transfer is covered by an appropriate safeguard under Chapter V of the GDPR — normally the European Commission's Standard Contractual Clauses included in our agreements with those providers, or the EU–US Data Privacy Framework where the provider is certified. You can request more detail about the safeguards in place by emailing us.
If you are in the EEA or the UK, you also have the right to:
To exercise any of these, email veret.evg@gmail.com. We respond within one month, as required by the GDPR. We may need to confirm you control the account before acting on a request.
You also have the right to lodge a complaint with a data protection supervisory authority. Our lead authority is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl. You may also complain to the authority in your own country of residence.
We do not use your data for automated decision-making that produces legal or similarly significant effects about you.
We do not sell your personal information for money, and we never share the contents of your notes with anyone for advertising.
However, if you are on the free plan and you allow tracking when iOS asks, the advertising identifier made available to Google AdMob may be used for personalised advertising. Under the CCPA/CPRA this counts as "sharing" for cross-context behavioural advertising. To opt out, decline the App Tracking Transparency prompt, or turn Hippomo off under iOS Settings → Privacy & Security → Tracking at any time. Subscribing to Hippomo Pro also stops it entirely, because no advertising SDK runs. We do not knowingly share the personal information of anyone under 16 for these purposes.
California residents may request access to or deletion of their personal information using the same email address above, and will not be discriminated against for exercising those rights.
We retain your account and note content for as long as your account is active, so that your notes remain available to you. Files backed up on Hippomo Pro are kept while the subscription is active, and for 90 days after it ends, after which they are deleted. If you request account deletion, we will delete your stored content and account identifiers, except where we are required to retain limited records (e.g. for fraud prevention or legal compliance). Accounting records relating to a purchase are kept for the period required by Polish tax law (currently five years from the end of the tax year). Diagnostic and error logs are kept only as long as needed to investigate problems, and are routinely discarded. Feedback you send is kept until it is no longer needed to answer you or to fix the problem it reports. Deleting your account in the app deletes your feedback, and its screenshots, from our backend; the copies already posted to our Telegram chat are not removed automatically, so email us and we will delete them. Usage events are retained by PostHog for as long as the project is active; crash reports are retained by Firebase Crashlytics for 90 days. If you switch diagnostics off, no further events or reports are sent, and you can ask us to delete what was already collected using the email address below.
Hippomo is not directed at children. To use Hippomo you must be at least 13 years old, and at least the minimum age of digital consent in your country if that age is higher — in parts of the European Union and elsewhere it is 14, 15 or 16. See the Terms of Use for the full requirement.
We do not knowingly collect personal information from anyone below the age that applies to them. If we learn that we have, we will delete the account and its data. If you are a parent or guardian and believe your child has provided us with personal information, contact us at veret.evg@gmail.com and we will delete it.
We may update this policy from time to time. If we make material changes, we will update the effective date above. Continued use of Hippomo after changes take effect constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy or your data, contact us at veret.evg@gmail.com.