PRIVACY POLICY
Version v1.8 | Last updated: 25 October 2026
At Notamy we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how Notamy ("we," "us," or "our") collects, uses, and safeguards your data when you use the Notamy mobile application ("App").
By downloading, accessing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue the use of the App.
The Data Controller responsible for the processing of personal data collected through the App is: Notamy Ltd. Email for privacy inquiries: legal@notamy.app
The App is intended exclusively for users aged 18 or above. We do not knowingly allow individuals under the age of 18 to use the App or create accounts.
Our services have optional features which, if used by you, require us to collect additional information to provide such features. You will be notified of such a collection, as appropriate. If you choose not to provide the information needed to use a feature, you will be unable to use the feature.
Information We Collect: When you use the App, we may collect the following information:
Data Provided Directly by the User:
Account Information: You must provide your mobile phone number to create a Notamy account in the App. We do not require an email address or password to create or access your account. Your phone number is used solely for account creation, authentication, and security purposes and is never displayed to other users. On the Notamy website you can also sign in with a Google account: in that case we receive the name, email address and profile photo of that Google account.
Profile information: Name, age, gender, and photos.
User biography and preferences.
Posts, messages, and other content you share on the App.
Interests and lifestyle information (optional).
Some profile information you choose to provide may reveal sensitive characteristics. By choosing to provide such information, you acknowledge that it may be processed in accordance with this Privacy Policy. You may remove or modify such information at any time through your profile settings.
If you use AI Features, we process any content you submit to the AI systems, including images, videos, and text prompts.
Location Data: To enable proximity-based features, we collect your real-time location data. Location data enables important proximity-based and discovery features within the App.
We:
Primarily collect location data when the App is active for proximity-based discovery features. If you choose to share your location with another user through location-sharing or map-based features, location data may be processed in the background for the duration you select, subject to your explicit action and device permissions. Background location sharing stops automatically once the selected duration ends or when you disable the feature.
Allow you to control location sharing in settings.
Use location for discovery. Your precise location is never displayed to other users. Other users may only see approximate distance or proximity indicators (such as relative distance ranges), not your exact location. When you are at a venue, people in the same venue can see that you are «here», never your distance or your position. You choose who sees you in Settings › Privacy › Now Showing › Who sees you: «People here» shows you only to people in the same venue, «Nobody» hides you from everyone.
When you chat with Wilson, we use your location for answers about places, weather and people near you, only while Location is on in Settings › Privacy.
Do not keep a location history. For discovery we store your last known position, rounded to about 100 metres and replaced at every update. Discovery relies mainly on positions updated recently, but your last known position can still be used while it is stored, for example to show you to a person you sent a crush to, or to place a moment you post. It is replaced when you move, and deleted when you turn off location in the App or delete your account. To prevent misuse of discovery, we also keep a recent position your device sent us, rounded to about 1 kilometre, in a temporary store. It is replaced when you move a meaningful distance, it can also be written when you use location-based features such as nearby stories, Now Showing or search, even if location is turned off in the App, and it is deleted when you delete your account, or automatically 30 days after it was last updated. A location you choose to send in a chat is a message, and is kept like your other messages; in the App, its preview map is loaded from Google Maps, which receives its coordinates.
We do not share or disclose your location — precise or approximate — with advertising partners. Your coordinates are sent to other companies only as described under Sharing of Information: to OpenStreetMap Nominatim and Open-Meteo, from our servers and without your name or account, to the map provider of your device when you view a shared live location, and to Google Maps when the App shows the preview of a location sent in a chat.
Device Information: IP address, device type, operating system, and usage data.
Phone Contacts (optional): The App can help you find which of your phone contacts are already on Notamy. This is optional: we read your address book only after you grant the contacts permission on your device, and you can revoke it at any time in your device settings.
When you enable it:
We read the phone numbers and names stored in your address book on your device.
Each phone number is converted on your device into a coded form (a shortened, salted SHA-256 digest) that does not carry the number itself. Only these codes are sent to our servers, which compare them with the codes of registered users to tell you which contacts are on Notamy. The code is not anonymous data: it is derived with a fixed salt that our servers also hold, so we treat these codes as personal data and protect them accordingly.
As part of this check we do not send or store the names in your address book, nor the phone numbers themselves in readable form: they remain on your device. The only exception is the one described in the next point.
To prevent abuse of the check (someone testing phone numbers at random), our servers remember which codes your account has already checked, for up to 180 days after your last check. If you look someone up by typing their phone number, that number is sent to us to find the account, and a matching result is kept in a temporary cache for up to one hour.
If you then choose to add one of those matches as a contact, the name you have saved for that person is sent to us and stored on our servers, so that we can display it to you as your custom name for that contact.
The results of the check are stored in a local cache on your device. That cache is treated as up to date for 24 hours, after which the check is repeated; the stored copy is not deleted on a schedule, and may still be shown to you if a later check fails. It remains on your device until it is replaced by a newer result, or until you uninstall the App or clear its data. The cache belongs to your account and is not reused if a different account signs in on the same device.
AI Features: The App includes artificial intelligence features (“AI Features”) that generate, modify, or enhance images, videos, text, or other content based on the information you provide. Most AI Features consume credits, which can be purchased in the App; a limited allowance is included in the free tier. AI Features are optional: they are provided through the third-party AI Providers named below, and they run only after you have given your explicit consent in the App.
Data Processed by AI Features: When you use AI Features, we may process the following personal data:
Photos, videos, and other media you upload
Voice audio, when you choose to use a feature that processes it
Text prompts or descriptions you provide
Metadata embedded in your content (including approximate location)
Profile information (such as age and gender)
Device information and usage logs
Safety and moderation signals related to your use of AI Features
If you do not wish to provide this information, you will not be able to use AI Features.
Use of AI Features: By using AI Features, you acknowledge and agree that content you submit, including images, videos, prompts, and related information, may be processed by third-party AI Providers as described in this Privacy Policy. If you choose not to provide the information necessary for AI processing, you will not be able to use AI Features. You may stop using AI Features at any time through the App settings or by discontinuing use of the relevant features. Discontinuation of AI Features will not affect the lawfulness of processing carried out prior to such discontinuation and will not entitle you to refunds for purchases already completed, except where required by applicable law.
Third-Party AI Providers: To provide AI Features, we transmit user inputs — images, videos, voice audio, text prompts and related metadata — to the following named third-party providers:
Alibaba Cloud Model Studio, operated by Alibaba Cloud (Singapore) Private Limited, processing in the Singapore region. It receives the prompts you write and the photos, videos and audio you choose to use with AI Features, in order to generate the content you request. This includes the text you use with the AI tools in chat (Translate, Tone, Write with AI or Rewrite with AI, Fix typos (✨)) and messages you ask the App to translate — in both cases only when your phone can't do it on its own (on Android, always) — as well as messages you ask the Notamy website to translate, voice messages you ask the Notamy website to transcribe (in the App, transcription runs on your phone), the recent messages you ask the Notamy website to summarize, and your conversations with Wilson, together with your interests, the post you ask Wilson about and the place name, weather and local time for your location (when location is on). Wilson may search the web through Alibaba Cloud, with a query based on your conversation. If you chatted with Wilson before this update, we keep the relationship level worked out from those conversations and how many messages you had exchanged; they stay on our servers and aren't sent to our AI provider. When Wilson suggests people to you, it also sends your profile (bio, interests, profession, languages and profile note), your recent public posts, your answers to the daily questions and the tastes and the way you write (tone, humour, how you reason) that Wilson has learned from your chats with Wilson, together with the name, bio, interests, profession, recent public posts (not for private accounts), the tastes and way of writing Wilson has learned, and shared daily answers of the people it compares you with. In the same way, your name, bio, interests, profession, recent public posts, the tastes and the way you write (tone, humour, how you reason) that Wilson has learned and the daily answers you share with someone may be sent to our AI provider when Wilson suggests people to other users. Likewise, your name and the text of a post of yours may be sent when another user asks Wilson about it, and a message you send may be sent when the person who receives it asks to translate, summarize or transcribe it. When a provider must read a reference video or the face photo of an animated avatar, we place a temporary copy on Alibaba Cloud Object Storage in Frankfurt, Germany, and delete it within 24 hours. On the Notamy website, the Live feature also connects your browser directly to Alibaba Cloud's real-time video service.
Google Gemini API, operated by Google. When you create a song, it receives the lyrics and the musical style of that song in order to generate the music you request. The idea you write for the song is processed by Alibaba Cloud Model Studio, which writes the lyrics. Google Gemini does not receive your photos, videos or voice.
Google Cloud Vision, operated by Google. It receives the images you upload to your profile, to your moments and stories, as AI drafts and references sent through the App, and as party selfies, in order to detect illegal or unsafe content; for videos in moments and stories it receives still frames. This is a safety check required to keep the App usable by everyone and is not an optional AI Feature. It does not receive chat media, and it does not check reference photos and video clips uploaded from the Notamy website to the AI Studio.
We require these providers, through contractual data-processing terms, to protect your personal data to a standard equivalent to the one described in this Policy, to process it only on our documented instructions, and to apply appropriate safeguards for transfers outside the EEA. We do not intentionally submit personal data to third-party AI providers for the purpose of training public AI models. However, certain providers may process submitted data for service improvement, safety, abuse prevention, or model development purposes in accordance with their own policies.
How AI-Related Data Is Used: We use data processed by AI Features to:
Generate content based on your inputs
Maintain the safety and integrity of AI systems
Detect and prevent misuse, fraud, or harmful conduct
Improve the performance and reliability of the App
Fulfil purchases and provide Paid AI Features
Create security logs for audit and compliance
Suggest people you may click with, using the tastes and writing style Wilson learns from your chats
AI Data Retention: AI-related data is retained according to the following rules:
Inputs (photos, videos, prompts): reference photos you upload (for example faces, logos or products) are kept in your account so you can reuse them, until you delete your account. A video clip you upload to the Studio on our website is deleted once it has been imported into your library; a clip that cannot be imported is deleted automatically about one day after it was uploaded. Prompts are kept with the item they produced (see the next point). Temporary copies placed on Alibaba Cloud Object Storage are deleted within 24 hours. Streaming copies of videos may remain in our storage for some time after the video or your account is deleted.
AI-generated content: films and songs stay in your account until you delete them. Other generated images and videos are removed from your library automatically 30 days after they are completed, or earlier if you delete them; their files may remain in our storage, no longer visible to you, until you delete your account. Clips generated or uploaded in your Studio library on our website that are not used in a film are deleted, with their files, 30 days after they were created or last used; recordings from the Live feature stay in your library until you delete them or your account.
Logs and safety-related metadata: moderation logs are deleted automatically after 90 days and critical security events after 12 months. Other security logs (your account identifier, IP address and device type, recorded when you sign in or create encryption keys) and the request records we use to prevent duplicate charges have no fixed deletion date. Reports of content (including the reported prompt) and enforcement decisions are kept as long as needed to keep the App safe (see Data Retention).
Wilson: your recent conversation with Wilson (up to the last 100 messages) is kept for 30 days after your last message, or until you clear the chat or reset Wilson. The tastes and writing style Wilson learns from your chats are kept until you withdraw your AI consent, reset Wilson or delete your account. Your answers to the daily questions and their day-by-day log are kept until you delete your account. The relationship level is kept until you reset Wilson or delete your account. Records of how you use Wilson's features (usage events) are kept until you delete your account.
Data used for billing/payment: retained as required by law.
We do not store your underlying media solely for AI model training. We process only the minimum amount of personal data necessary to provide AI Features.
Automated Decision-Making: AI Features do not make decisions that produce legal or similarly significant effects about you. AI processing does not include automated profiling that produces significant effects as defined under applicable data protection laws. AI outputs are generated solely based on your inputs and remain under your control. AI Features are not intended to perform facial recognition, identity detection, or any biometric identification. Wilson's people suggestions use profiling as described in section 4; they are suggestions only and have no legal or similarly significant effect.
Restrictions on Uploading Third-Party Personal Data: You must not upload or submit photos, videos, or other content containing personal data of any third party without their lawful consent. This includes facial images, identification documents, or other sensitive personal information.
International Transfers: Data processed by AI Providers or other service providers may be transferred to and processed in countries outside your jurisdiction, including countries that may have different data protection laws than your country of residence. Where required by applicable law, we implement appropriate safeguards designed to protect personal data in connection with such transfers.
How We Use Your Information: We use your information to:
Discovery: Connect with nearby users based on location and preferences
Communication: Enable messaging and social interactions
AI Processing: To generate content you request through AI Features and ensure the safe and lawful operation of such features.
Safety: Verify accounts and prevent abuse.
Improvement: Enhance app features and user experience
Support: Provide customer service and technical support. Provide information about updates, features and services.
Advertising: The App does not display advertisements. We do not track you across other companies’ apps or websites: the App does not use Apple’s App Tracking Transparency framework and declares no tracking domains in its privacy manifest. On iOS, Apple’s AdServices tells us whether you installed the App from an Apple Search Ads ad and, if so, which campaign, ad group, keyword and ad, the country or region, the type of conversion, whether you tapped or only viewed the ad, Apple’s identifier of our advertising account and the date; we store it with your account to measure our campaigns; it is not used to show you ads and is not shared. Our website uses the Google Ads tag to measure our own advertising campaigns; in the EEA, the United Kingdom and Switzerland it runs without advertising or analytics cookies.
Sharing of Information: We do not sell your personal information. We may share your data with:
Service providers who help us operate the App: Google Cloud and Firebase (our servers, database, file storage, sign-in and push notifications; our servers run in Belgium), Apple Push Notification service, Cloudflare (network protection in front of our servers, and the anti-bot check when you sign in on our website), Redis Cloud (temporary cache), Twilio (sends your sign-in code by SMS, WhatsApp or voice call, and receives your phone number), Agora (carries the audio and video of voice and video calls; calls are not recorded), RevenueCat (in-app purchases), Stripe (payments on our website), GIPHY and KLIPY (GIF search: the App sends your search text to them directly from your device; on our website the search goes through our servers, which send them your search text), ipapi.co (the App sends a request from your device to guess your country when you enter a phone number), OpenStreetMap Nominatim (turns the location of a moment you post, or your location when you talk to Wilson, into a place name) and Open-Meteo (the weather in Wilson), which receive those coordinates, Apple Maps or Google Maps (the map of a shared live location), Google Maps (in the App, the preview image of a location sent in a chat, loaded on the phones of both the sender and the recipient: Google receives the coordinates of that location), Alibaba Cloud Object Storage in Frankfurt, Germany, and its content delivery network (they store the videos of moments, stories and AI Features in a streaming format and deliver them from cdn.notamy.app), the push service of your web browser, such as Google for Chrome, Mozilla for Firefox or Apple for Safari (notifications on our website, if you allow them), Apple AdServices (on iOS, which Apple Search Ads campaign, if any, led to your download) and Resend (emails about advertising orders placed on our website).
AI Providers who process your inputs to provide AI Features. These providers process data primarily to provide the requested AI output and to ensure safety and abuse prevention.
Legal authorities if required by law.
Other users, in accordance with the features of the App (e.g., proximity data, posts, messages).
We implement encryption and other industry-standard security measures designed to protect communications transmitted through the App. In the App, the text of chat messages and their captions, photos, videos and voice messages from your phone, the contents of the files you send, the preview of a link you send (if the recipient uses an older version of Notamy, the link reaches our servers unencrypted for its preview) and a location you share once are encrypted on your phone before they are sent. Everything else isn't encrypted the way your messages are and reaches our servers so the features can work — for example, who you message and when, group names and photos, reactions, the names of files you send, a blurred preview of photos, videos and the first page of PDFs, games you play in chat, the address of a GIF, links while you type, your live location, photos and videos you create with AI, posts and moments you share in chat, and your key backup. This also applies to what you create on the Notamy website: shared documents and lists, songs, video projects and locations you share. Voice and video calls go through Agora and aren't encrypted by the App the way your messages are. So that you can restore your chats on a new phone, a backup of your encryption keys is kept with your account on our servers. That backup is protected by your account, not by a password only you know, so Notamy could technically open it and, with it, read your encrypted messages and media. On iPhone, if iCloud Keychain is on, your keys also sync through it. Notamy does not access, monitor, or review the content of your chats in the ordinary course of providing the Services, except the text you send to an AI feature or include in a report.
Notamy may process limited communications metadata and related information necessary to operate, secure, and improve the Services, including message delivery information, timestamps, account identifiers, device information, security logs, and abuse reports voluntarily submitted by users.
Data Retention: We retain your information for as long as necessary to provide the service and comply with legal obligations. You may request deletion of your account and data.
Active accounts: Data retained while account is active.
Deleted accounts: When you delete your account, your profile, photos, moments, contacts, location, AI content and uploaded files are deleted straight away; if a step fails, it is retried automatically. Streaming copies of videos may remain in our storage for some time after the video or your account is deleted. The text of messages you sent stays with the people you sent it to, no longer linked to your account; photos, videos, voice messages and documents you sent are deleted and are no longer available to them. We keep, no longer linked to your profile, the records we need for safety, fraud prevention and legal reasons: account bans, consent records, payment and credit records, security logs (with the IP address and device type removed) and reports of abuse. Some of these records keep an internal account identifier. We also keep a coded form of your phone number to enforce a ban or a block against it and to give the welcome bonus only once per phone number. The request records we use to prevent duplicate charges are not removed when you delete your account.
Legal requirements: Records that we must keep to enforce bans, prove consent, handle reports of abuse, or meet tax and accounting obligations are kept for as long as that purpose or the law requires, which may be longer than 12 months. Records of individual purchase and payment events received from the App Store, Google Play, RevenueCat and Stripe are kept as long as needed for billing, refunds and fraud prevention.
Messages: Messages are kept until they are deleted from the chat; we do not delete them after a period of inactivity. Disappearing messages (24 hours, 7 days or 90 days) are deleted when their timer ends. View-once media is deleted once it has been opened (in a group, once every member has opened it), or 24 hours after it was sent if it is not opened. Stories disappear 24 hours after they are posted (a nearby story that many people view can stay visible longer), and their media are then deleted; streaming copies of their videos may remain in our storage for some time. Notifications are deleted automatically after 90 days.
Purposes and legal basis for processing:
We rely on the following legal bases for processing personal data:
o Contract: to provide and operate the core features of the App, including account creation, messaging, proximity-based discovery, content sharing, purchases, and AI Features requested by users.
o Consent: for optional profile information that may reveal sensitive characteristics, AI Features, certain optional permissions, and other processing activities where consent is required by applicable law.
o Legitimate Interests: to maintain the safety, security, integrity, and performance of the App, prevent fraud and abuse, improve our services and AI Features, enforce our Terms, and support the operation of the Services; comparing your public profile and posts when another user asks Wilson for suggestions; you can object at legal@notamy.app.
o Legal Obligations: where processing is necessary to comply with applicable laws, regulations, legal processes, or lawful requests from public authorities.
Data Security:
We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, or disclosure. These include:
Encryption and other industry-standard safeguards designed to protect communications and user data
Secure data transmission (HTTPS/TLS)
Regular security audits and updates
Restricted employee access to personal data
AI processing may occur on servers operated by our AI Providers. We take reasonable steps to use AI Providers that maintain appropriate technical and organizational security measures, but their processing is also governed by their own terms, privacy policies, and security practices.
While we take reasonable steps to safeguard your information, we cannot guarantee that the App will be completely secure or free from bugs, errors, or vulnerabilities. Transmission of data over the internet carries inherent risks, and you acknowledge that you provide information at your own risk.
We apply data minimization principles and only collect the data that is necessary to provide our services.
Your Rights: Depending on your jurisdiction, you may have rights to:
Access personal data we hold about you.
Request correction or deletion of your data.
Object to data processing.
Withdraw consent.
Export your data to another service.
Right to lodge a complaint with your local data protection authority.
Withdraw your consent to AI Features at any time in the App’s privacy settings or, on the website, from your account menu. AI Features stop working; the rest of the App continues to work normally.
To exercise these rights, you may contact legal@notamy.app . We may need to verify your identity before responding.
International Users: Notamy operates globally. By using Notamy, you acknowledge that your data may be transferred to and processed in countries other than your own.
Governing Law: This Privacy Policy is governed by the laws of Malta.
Dispute Resolution and Arbitration: To the fullest extent permitted by applicable law, any dispute, controversy, or claim arising out of or relating to this Privacy Policy or your use of the App shall be resolved through binding arbitration. The arbitration will be conducted by a single arbitrator in accordance with the UNCITRAL Arbitration Rules in effect at the time of the dispute. The arbitration shall take place remotely or in a mutually agreed location and shall be conducted in the English language, unless otherwise agreed. By using the App, you waive the right to a trial by jury or to participate in a class action lawsuit. Notwithstanding the foregoing, if you are a consumer residing in the European Union or in any jurisdiction where mandatory consumer protection laws grant you the right to bring disputes before local courts or prohibit mandatory arbitration, this arbitration clause shall not apply to the extent required by such laws, and you may exercise your rights before the competent courts of your place of residence.
User Responsibilities: You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. We encourage you to use strong passwords and to log out after using the App on shared devices.
Third-Party Services: Notamy may contain links to or integrations with third-party services, websites, or applications. We are not responsible for the privacy practices or content of these third parties. Please note that our Privacy Policy applies only to the use of our services. When you use third-party products or services, their terms and privacy policies will govern your use of those products or services. We encourage you to read their privacy policies before providing any information.
Changes to This Privacy Policy: We may update this Privacy Policy from time to time. We will notify you of significant changes. Continued use of the App constitutes acceptance of the revised policy.
Contact Us: For questions or concerns about this Privacy Policy, please contact us at: legal@notamy.app