Privacy

Your library.
Your choices.

Draft for the pre-release app · Updated 4 October 2026

Who operates Fyllos

Fyllos is a brand of ZERIE INSIGHT, Norwegian organisation number 933272427. ZERIE INSIGHT is responsible for the personal data processed to provide Fyllos.

Your account

Clerk provides authentication and session management. When you sign in with Google or Apple, Clerk receives the identifiers and profile information supplied by that provider, such as your email address and name. Fyllos uses your account identifier to separate libraries, authenticate hosted requests and manage access. Google sign-in requests identity, email and profile—not Gmail or Google Drive access.

Your library and writing

Imported files, reading positions, saved passages, conversations and personal observations are stored in your account’s library on the device. They are not automatically uploaded to an AI provider simply because they are in your library.

If you enable iCloud features, selected library data, originals and synchronization records may be stored in your Apple iCloud account through CloudKit. Files exports go to the location you choose; that location may itself be a cloud service. Signing out is not the same as deleting retained library data.

When you use hosted AI

• Conversation: your request and a bounded recent conversation context are sent to our Cloudflare service for the requested AI operation.
• Source-grounded questions and discovery: permitted selected excerpts and the relevant question or interest may be processed by Cloudflare and its AI service. The source-sharing setting controls these requests. Entire original files and unrelated passages are not sent by this path.
• Web search: the web request, relevant recent web conversation and search queries may be forwarded through Cloudflare to OpenRouter, the selected model provider and the configured search provider. Private observations and imported excerpts are not automatically forwarded through this web route.
• Personal notes: only an excerpt you review and explicitly choose for Find reading may be sent for that operation. Ordinary private replies are not automatically sent to hosted AI.

AI services process the information you submit. Do not include sensitive information you do not want those services to process. Provider privacy and retention practices apply to their processing; we do not promise zero retention or no model training without an applicable provider commitment.

Hosted microphone transcription is not enabled in the current service configuration. Enabling it for release requires a named provider and updated disclosure before recordings are transmitted.

External sources and the website

Retrieving articles, RSS feeds, catalogs and media connects to their publishers or hosting services. Those services can receive network information such as your IP address and requested resource. Opening an external link or embedded player is also subject to that service’s practices.

This website uses no analytics scripts, advertising trackers, forms or non-essential cookies. Cloudflare hosts the site and processes network information needed to deliver and protect it. Authentication pages operated by Clerk are separate from these static pages.

Service records and retention

The hosted service keeps request identifiers, timestamps, route information, request-body hashes and usage records for retry safety, security and usage limits. Generated results may be cached for one hour; original source excerpts are not stored in that result cache. Expiration makes a cache entry ineligible for replay and is not a guarantee of immediate physical erasure. Provider-side retention is separate.

Device content remains until you remove it or delete the relevant account data. Account deletion is designed to remove account-linked service data while retaining pseudonymous anti-replay and usage-reservation records, without original source content. Deletion and synchronization are still undergoing release verification. Apple, Clerk and other processors may retain information required by their own policies or law. Backups you exported remain under your control.

Purposes and your rights

We process data to provide requested features, secure accounts, prevent abuse and manage service access. Depending on the processing, the applicable basis is performance of the service, your consent where required, legitimate security interests or legal obligations. You may have rights to access, correction, deletion, restriction, portability and objection, and to withdraw consent without affecting prior lawful processing. You may complain to Norway’s Data Protection Authority, Datatilsynet, or your local supervisory authority.

Our service providers may process data outside Norway or the EEA. Applicable contractual and legal safeguards must be confirmed for the production arrangements; this draft is not a completed international-transfer assessment.

Changes and contact

We will update this policy when data practices change and make material changes available before they apply. The public support/privacy contact is awaiting operator confirmation; this draft must not be used as the final App Store privacy policy until that contact and production arrangements are complete.