Privacy Notice

Fish Memory! · Effective October 7, 2026

Operator and data controller: 王明刚 (Minggang Wang). Contact: fish@sztaxs.com. This notice covers the Fish Memory app and its dedicated AI service.

Records on your iPhone

Text you enter, selected images, locally recognized text, memories, favorites, drafts, tasks and reminders are stored in the app's local storage. The app does not automatically scan your library, monitor screenshots or read the clipboard in the background. You may actively paste, select a photo or run a screenshot shortcut.

In-app voice input uses on-device transcription where supported. Review the text before adding it to a draft. Unused voice text stays in a separate local draft; reopening the app does not start the microphone. The app does not save recordings. Recording and transcription actions within Apple Shortcuts are managed by the corresponding system actions.

There is no user account, memory cloud sync or system backup. Before each save, the app keeps the previous version and its referenced images for local recovery. That copy can temporarily contain recently deleted content until subsequent saves rotate it. Unreadable originals are retained locally before recovery or import. Backup & Restore exports an unencrypted archive including original images; you control where to keep it and may import or delete the exported file. If you select a third-party cloud drive, that provider handles the exported file. Uninstalling removes app storage and its local backup, but does not remove files you exported elsewhere. You may delete individual memories, tasks, drafts or original images; multiple records may reference the same image.

When you choose AI

The capture page displays the source text, capture time, time zone and output language. Tapping Save & Organize sends these fields over HTTPS through our server to DeepSeek's API for organization or task suggestions. Original images, audio and the full memory library are not uploaded with the request. Actively running the automatic screenshot shortcut also sends locally recognized text and the context listed above, then saves the result automatically. When automatic summaries are enabled for longer content, extraction and summary share one backend request and one app allowance. The original and plans are saved first; the summary is saved afterward. Tapping Reorganize sends a separate request and uses another allowance. Merely opening an existing memory does not upload it. More > Save on Device Without AI lets you keep a capture local.

Sending a capture or actively running the automatic shortcut saves the original as a memory and adds identified plans automatically, without a second confirmation. Plans with a clear time receive a reminder time according to your defaults; scheduling notifications requires system permission. You can edit, complete or delete saved results. Unclear times remain flagged rather than being guessed. AI may make errors. Check dates, times and original text. The app does not make decisions with legal or similarly significant effects on your behalf.

Our server is hosted on Alibaba Cloud infrastructure in Shanghai, China. It processes the submitted text and results without storing a separate copy of the source text or writing user text or results to application logs. Recoverable processing temporarily retains encrypted results under the limits below; those results may contain source excerpts. We do not use your content to train our own models, sell memories, show advertising or track you across apps.

DeepSeek receives the text and context you send to provide inference. Its API enables disk context caching by default. Its documentation says unused cache is normally removed within hours to days. This is not a promise that all provider data is deleted on that schedule, nor a claim of third-party zero retention or no other processing. Provider security and legally required retention are governed by its applicable terms. See the DeepSeek Open Platform Terms and Context Caching documentation. Contact us for related data questions or rights requests; we will seek provider assistance where needed.

If you use AI outside China, the submitted content is transferred to servers in China for processing. You can instead use local-only capture. Send only content you have authority to provide and avoid unnecessary sensitive information.

Recoverable processing and free result checks

When you explicitly start recoverable processing, the app first saves the request ID, authorized text, capture time, time zone and output language on your device. The service temporarily stores the extraction and optional summary result encrypted with AES-256-GCM, retrievable for up to 24 hours from first acceptance. Results may contain excerpts of the text you sent. Receipts retain a device-associated verification identifier, request ID, content binding hash, state and expiry to prevent duplicate work and charges. They do not store a separate copy of the source text or upload your entire library, images or audio.

If a sent request loses its response or the app is reopened, a fresh challenge and signature can query the same request ID. The query sends only that ID and verification data, without resending source text, calling the model or using AI allowance. Expired, missing or interrupted results do not automatically start new paid processing. A new request starts only when you explicitly choose to regenerate. Received extraction is saved first and an optional summary follows; old results do not replace new input.

Expired results are cleared periodically and during requests, without guaranteed physical erasure at the exact expiry time. Receipt metadata is retained for up to a further 90 days after result expiry; once logically cleared, an old ID does not carry a permanent deduplication guarantee. Database backups, WAL files and exported copies have separate retention boundaries; secure erasure is not promised. Deleting a local memory does not also delete a server receipt. You can contact us below for data-rights requests. Temporary receipts are not memory cloud sync and cannot restore your whole library.

System shares, note bodies and local search

When you actively use system sharing, the text, links and up to six ordered photos actually received are saved to a separate local App Group inbox. The main app recognizes photos locally when opened. Interrupted shares and input remain available to continue, separately from an existing editing draft. Local-only saving does not send AI requests; choosing to organize sends only the disclosed text for that input. Note bodies, checklist states and search indexes stay on your device. Search queries are not uploaded and do not use AI allowance; the index can be rebuilt from original records.

Recently Deleted and widget display

Deleted memories and plans stay in Recently Deleted for 30 times 24 hours by default, with individual restore or confirmed permanent deletion. Original photos, favorites, pickup states and source links remain with retained records. Deleting a source memory does not delete independent plans. Deleting a plan cancels its reminder; restoring only reschedules original reminders that are incomplete and still in the future, without sending AI requests. The main app clears expired records when it can. Previous-version backups and exported files are independent copies. Active search, widgets and new reports exclude deleted records.

Daily Recollection is off by default. Only display text and optional thumbnails you explicitly approve enter the local widget display copy; pickup codes, addresses, phone numbers and source text are not automatically exposed through this feature. Current memories, calendars and pickup activities use local display projections, not cloud sync. Home Screen, Lock Screen or Dynamic Island content may be visible to others; you can disable or remove it from display. System masking and refresh behavior depend on device settings and when execution is available.

Verification and retention

AI requests use Apple App Attest to verify the app instance; verification may contact Apple. Our backend retains public verification keys and identifiers, last-use time, request counters and daily usage for replay prevention, abuse protection and limits, not advertising.

One-time challenges expire after 60 seconds. Daily usage retains the current UTC day and the previous six days. Verification records are removed after 90 days of inactivity through hourly and request-time cleanup while the service operates normally. Connection addresses are hashed in memory for short-term rate limiting and cleared as minute windows change, without being written to the business database.

To check AI service costs, the backend separately aggregates calls and provider-reported token usage by UTC day, model and processing stage for the latest 90 UTC days. These totals contain no source text, answers, device identifiers or request IDs and are not linked to individuals. Missing usage is not treated as zero cost. These statistics do not change your allowance.

The reverse proxy does not record access logs. The backend logs a fixed route category, HTTP status and request duration to diagnose faults and maintain service. These diagnostics do not include request text, images, audio, IP addresses, device identifiers, headers or credentials and are not linked to users. Container logs rotate at 5 MB per file with up to three files. Infrastructure security maintenance may also generate necessary technical logs. We do not collect extra information beyond these purposes, support you request and legal obligations.

Permissions and choices

Camera, microphone, speech recognition and notifications are requested for their relevant functions. Manage permissions in iPhone Settings. You choose which library images to use. Declining these permissions still allows manual text entry. To withdraw consent to AI processing, stop sending AI requests and use local-only capture. Withdrawal does not undo completed processing.

Deleting local content cannot withdraw requests already sent to third parties. We do not hold a copy of your full memory library and cannot restore data lost through deletion or uninstalling.

Contact and your rights

Email fish@sztaxs.com to ask about processing or request access, correction, deletion, copies and other rights available under applicable law. Describe your request and relevant timing. We will verify your connection to the relevant records only as necessary; do not send passwords, verification codes or API keys. We respond within applicable legal time limits and coordinate with Apple or DeepSeek where required. We will explain legal retention requirements or an inability to locate records. You may also complain to the relevant supervisory authority.

If you email support, your address and supplied information are used to respond, troubleshoot and handle rights requests, and retained only as needed to resolve the request, necessary follow-up or legal requirements. Redact private information from screenshots first.

Children and changes

This is a general note-taking and planning app, not a service specifically directed at children. Minors should use it with a guardian's guidance and obtain guardian consent where required for personal-data processing. Guardians can contact us about related information.

We update this page and its effective date when functions or processing rules change. Where a change requires renewed consent, we will provide a notice before the relevant processing.

In-app feedback

When you submit feedback, we store the category, your message, optional contact email, app and system versions, feedback ID, submission time and app verification identifier to investigate issues, follow up and improve functionality. Feedback is linked to the verification identifier to prevent duplicates and abuse. It is not used for advertising or sent to DeepSeek. Memories, images and audio are not automatically attached. Feedback and contact details are available only to authorized maintainers, not displayed publicly.

Feedback is retained for up to 180 days, with hourly expiry cleanup. Email fish@sztaxs.com with the feedback ID to request deletion. Unsent or failed submissions remain as drafts on your device; successful submission clears the local feedback draft. An email address is optional. Feedback has a separate submission limit and does not consume AI usage allowance.

Optional automatic weekly reviews

Automatic weekly reviews are off by default. After you enable them, the app automatically sends last Monday through Sunday’s plan titles, dates, completion status and excerpts from memories to DeepSeek for a summary. Each entry is limited to 500 characters and total input is bounded; omitted entry counts are shown. Images and audio are not uploaded. A reminder is scheduled for Monday at 08:00 in your phone’s local time. Generation runs when background time is available or when you open the app to complete the latest due review. Reviews remain on your device without memory cloud sync. You can disable automatic reviews anytime without deleting existing reviews. Opening a historical memory alone still does not trigger an upload.

Monthly reviews

Opening a month card for the first time sends that calendar month’s plans, completion status and memory text excerpts to DeepSeek to create a summary, using one AI allowance. Each entry is capped at 500 characters and the total input is bounded; omitted entries are disclosed. Images and audio are not uploaded. Summaries stay on this device and are included in manually exported backups. They do not create memories or plans. Later visits read the saved summary. When source records change, you can update it using one AI allowance; a failed update preserves the previous summary. Opening an ordinary memory detail does not trigger a monthly review.