Privacy Policy — SayPin
Version 1.0 · effective October 8, 2026
SayPin is a notes app for text, voice, photo and video notes with reminders. This policy explains what data the app processes, why, where it is stored, and what rights you have.
1. Who is responsible
The data controller is Janko Blagojević, Prote Milana Đurića 4, 31000 Užice, Serbia. Privacy questions: janko.tbbt@gmail.com.
2. What we process
| Data | Source | Purpose |
|---|---|---|
| Note content — text, voice recordings, photos, videos, reminders | entered by you | to provide the service: storage, display, reminders, sync to your other devices |
| Speech transcript | derived from your recording | to turn a voice note into readable, searchable text |
| Email address (optional) | entered by you | to save your account, restore notes on another phone, and send sign-in codes |
| Account identifier | generated by the app on first launch | to keep your notes separate from other users' |
| Usage — transcription minutes and AI calls per month | generated by use | to apply free-plan limits and bill the Pro plan |
We do not process location, contacts, installed apps or advertising identifiers. The app has no ads and does not sell data.
3. Account without registration
On first launch the app creates an anonymous account — no email, password or personal data. Notes are stored on your phone and backed up to the server under that account. You may add an email later in Settings; without it the account is tied to that phone only.
4. Where data is stored and who processes it for us
- Your phone — all notes, recordings and reminders are always stored locally; the app works offline.
- Supabase (database and file storage), servers in the European Union (Ireland) — a copy of your notes and files, your account and usage. Access rules ensure each user can only see their own data.
- OpenAI (USA) — when you request transcription, the voice recording is sent to OpenAI to be converted to text; when AI suggestions are enabled, the note text is sent to generate a title, summary and reminder suggestion. Under OpenAI's API terms this data is not used to train their models and is deleted within 30 days. Transfers rely on Standard Contractual Clauses. You can disable transcription and AI suggestions in Settings — nothing is then sent to OpenAI.
- Resend (email delivery) — only your email address and sign-in code, at the moment you request a code.
These companies act as processors on our instructions only.
5. Legal basis
Processing is necessary to perform the contract (provide the service you requested); transcription and AI suggestions additionally rely on your choice in Settings, which you can withdraw at any time. We comply with the Serbian Personal Data Protection Act and, for EU users, the GDPR.
6. Retention
- Notes, recordings, reminders — until you delete them or delete your account.
- Deleted notes are permanently removed from the server within 30 days (the window for deletion to propagate to all your devices).
- Recordings sent for transcription — deleted by OpenAI within 30 days; we keep them as part of your note until you delete it.
- Sign-in and account-deletion codes — 15 minutes.
- Server technical logs (request time, error messages, no note content) — a few days, then deleted automatically.
- Usage data — 24 months, for billing.
- After account deletion — all data deleted immediately; server backups within 30 days.
7. Your rights
You have the right to access your data and receive a copy, rectify it (all notes are editable in the app), delete individual notes or your entire account with all data (in the app: Settings → Delete account and all data; without the app: on the account deletion page enter your account email and the code we send you; or by email to janko.tbbt@gmail.com), withdraw consent for transcription and AI suggestions (Settings), and lodge a complaint with the Serbian Commissioner for Personal Data Protection (poverenik.rs) or your local supervisory authority. We respond within 30 days.
8. Children
The app is not intended for children under 15. If we learn we have collected a child's data without parental consent, we will delete it.
9. Security
Data is encrypted in transit (TLS). On the server, row-level rules restrict every user to their own data. Keys for third-party services are never shipped in the app, only on the server. Media on your phone lives in the app's private storage, inaccessible to other apps.
10. Permissions
Microphone (voice notes), Camera (photos and video), Photo picker (attach existing media — on Android the system picker shares only the items you select, not your whole library), Notifications (reminders), Exact alarms on Android (on-time reminders). Each can be declined; the app keeps working without that feature.
11. Changes
We will notify you in the app before changes take effect. Previous versions available on request.
Contact: janko.tbbt@gmail.com