Your data in Fil

1. Who is responsible?

Fil is published by Gabriel Angotti, the controller for the processing described here. Questions and rights requests: contact@heyfil.com.

This policy covers heyfil.com and its redirect domains, Fil Preview and the Fil app. It describes the service as examined on 2 November 2026. Some features are still being prepared or are available only in private testing. Preview and production use separate databases.

2. Website and beta signup

The form collects your first name, email, selected platform when provided, signup date and consent version. This manages the waiting list and contact about the Fil beta and launch, based on an unchecked consent box. Signup does not create an app account or grant AI permission.

The active waiting list keeps signups from the previous twelve months. Cleanup runs when the service opens and during addition or export operations. The private link issued after a new signup removes that signup. Contact contact@heyfil.com if you have lost it.

The website currently has no advertising, third-party audience analytics or transmission of forms to AI. Fonts and visual assets are served by the site. IP addresses are used temporarily for abuse prevention; the application counter expires after ten minutes. Your browser may retain the withdrawal link and necessary display preferences.

3. App data

An account uses an email, optional display name, time zone, hashed password and login sessions. The service holds content you provide: conversations, tasks, events, notes, collections, documents, images, voice messages and transcripts, depending on the features you use.

Selected calendars can supply titles, descriptions, times, places and participant information. Habits, progress and reminders are linked to your account. Memories and preferences may be derived from exchanges to personalise replies. Completing or archiving an item does not delete it.

The app also keeps data on your device for synchronisation and offline operation. Preferences and caches use app storage; mobile sessions use secure system storage. Anticiper place observations have an encrypted local database. This does not mean all Fil storage is end-to-end encrypted.

4. Data that may reach AI

AI helps understand requests, read shared content, propose tasks or plans, answer discussions, organise collections and prepare memory and some suggestions. A call may include your message, relevant conversation excerpts, agenda entries, memories, preferences, dates, time zone and useful place context. Selected images and text extracted from documents may also be sent. Audio goes to the configured transcription service; its text can then be used by other AI features.

AI settings offer OpenRouter, OpenAI, Google Gemini, Mistral, Groq, DeepSeek, Ollama and compatible APIs. With OpenRouter, requests pass through OpenRouter and the services executing the models, including Jev/TypeSafe decisions when configured. A model publisher and its hosting provider may differ. Your connection and models determine the actual recipients.

Requests go through the Fil server. A personal API key or Ollama server does not imply processing on the phone. Permission to keep a memory or confirmation of a task is separate from permission to send the content to AI for analysis.

The implementation reviewed does not train a Fil general-purpose model on your content. We cannot promise no retention or training by every provider: offerings, models, routing and account settings differ. Fil does not currently enforce a universal zero-retention or Europe-only execution policy.

5. Device resources, places and notifications

Camera, files and microphone support the content you choose to capture or share. Recording starts when you initiate it. Calendars are imported after selection or provider connection. You can revoke device permissions and disconnect integrations.

If enabled, place features may observe location, including in the background with permission, to recognise places and prepare departures. Local history is not uploaded as a continuous GPS track. However, selected coordinates, addresses, origins, destinations, arrival times, visit summaries or place hypotheses may pass through Fil to geocoding, routing or AI services. Confirmed place information may also enter account memory.

Diagnostic maps can load OpenStreetMap tiles, exposing tile requests and the device IP to that service. Remote mobile notifications pass through Expo and Apple or Google, with necessary titles, text and technical identifiers. Web notifications use your browser’s push service. Widgets, activities and notifications can expose information on a locked screen.

6. Purposes and legal bases

Account creation, synchronisation and requested organisation features provide the service you ask for, based on performance of that service. Security and abuse prevention rely on the legitimate interest in protecting the service and accounts. Waiting-list contacts rely on your withdrawable consent.

Third-party AI transmissions and optional uses requiring consent need dedicated information and a choice before activation. Device permission does not replace this choice. The AI permission page describes the intended wording and operation; publication does not mean the dedicated in-app collection mechanism is already integrated.

Fil is not designed to make decisions with legal or similarly significant effects about people. Its outputs may be wrong and need review. Avoid secrets, medical data and other particularly sensitive information during private testing. Share information about other people only with appropriate permission.

7. Recipients and hosting

Gabriel Angotti currently operates the website and backend on personal infrastructure. Authorised operators may access data as necessary for support and security. Data is synchronised to your devices and passed to services used by the requested feature; the Services and data page describes recipient categories.

Preview may record AI requests, responses, processing steps and metrics in a private diagnostic tool. Such traces may include your content and are not merely anonymous statistics. The production instance reviewed is not connected to that tool. AI and mapping providers remain separate third-party processing.

8. Processing outside Europe

Providers and their subprocessors may process data outside the European Economic Area. Execution location depends on provider, offering and model routing. Fil does not currently guarantee France-only or Europe-only processing.

AI permission alone does not provide legal safeguards for transfers. Applicable safeguards, contracts and regional restrictions must be checked for the chosen services before public access to the relevant features. Contact contact@heyfil.com for information about a recipient or transfer.

9. Retention and deletion

Account content stays in the service as needed for your use and until you delete it. Conversation history, files and memories have separate lifecycles: deleting an event does not automatically delete its mentions elsewhere. You can manage memories in the profile and delete the account in settings.

Account deletion removes the user and related cascading records from the primary database. It does not guarantee immediate removal of every copy: caches on other devices, Preview diagnostics, memory indexes and backups may require further operations. Contact contact@heyfil.com for complete erasure or a persistent copy. Calendar access can also be revoked at the provider.

Server sessions last ninety days. Local place learning applies bounds and cleanup when its state updates, with different periods by observation type. Logging out retains some offline caches. Use available controls and device storage settings to remove local copies; secure keychain behaviour depends on the operating system.

Backups support service recovery. A general maximum backup period, time-based purge of all Preview traces and coordinated deletion from every index are not yet standardised in the test version reviewed. We do not claim an unverified automatic deadline. These limitations must be resolved before public distribution. External providers apply their own retention conditions.

10. Security and necessary storage

Public connections use HTTPS. Passwords are hashed, AI keys and connection secrets are encrypted server-side, and business data access is account-scoped. The server can still read data for processing; this is not end-to-end encryption.

The Web client uses a secure session cookie and storage for login, preferences and offline operation. The mobile client uses system storage. No advertising or third-party audience analytics were identified in the reviewed scope. External links you open follow their destination’s rules.

11. Rights and choices

Depending on your situation, you have rights of access, correction, erasure, restriction, portability and objection to legitimate-interest processing. Consent can be withdrawn without affecting previous lawful processing. French law also allows instructions concerning data after death.

Write to contact@heyfil.com with the account address and your request, without passwords or API keys. Proportionate identity verification may be needed. Responses normally come within a month; any legally permitted extension must be explained. You may lodge a complaint with the CNIL.

Deleting the current AI connection in settings stops new calls through that connection. It does not recall requests already sent or erase stored content. Other permissions remain separate: also revoke location, calendar or notification access if you want to stop those uses.

12. Changes

We will update this policy when processing, hosting or recipients change. Significant changes to consent-based processing require information and, where needed, a fresh choice. Reading this page or joining the waiting list does not grant AI permission.