← Back to Firvo

Privacy policy

Version 2026-09-1 · Effective [EFFECTIVE DATE] · Last updated [EFFECTIVE DATE]

1. Who we are

Firvo is made by Lore Technologies Ltd, a company registered in England and Wales, company number 17303424, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for everything described here.

You can reach a person through the support page.

2. What we hold

• Your entries. Every answer, deeper answer, Moment answer and dump you write or dictate, stored exactly as you gave it.
• Your voice, if you spoke an answer. The recording is kept beside its transcript, until you delete the entry or your account. The transcript is what the brain reads. Dictation uses Apple's speech recognition, on your phone where it can, otherwise on Apple's servers under Apple's privacy terms.
• Your account. Either an identifier from Sign in with Apple and the email address Apple gives us (one of Apple’s private relay addresses if you chose to hide yours; we never see your Apple password), or, if you signed up with email, your address and a salted hash of your password. A sign-in code is stored only as a hash for ten minutes, and wrong attempts are counted so a code cannot be guessed.
• Your setup. First name, chosen tone, the life areas and answers you gave during onboarding, your question hour or random window, and how many Moments a day you asked for.
• Your brain. The graph described in section 4, and the written portrait built from it.
• A device token so a question can find you, if you turned notifications on.
• Subscription status from Apple: whether your subscription is active or lapsed. We never receive your card details.
• Ordinary technical logs: timestamps, error traces, request paths. Your entries are never written to a log.
• A gentler-questions date. If an answer suggests acute distress, an automated check softens the next three days' questions. What is kept is a date, never a note about you, and it alerts nobody (section 12).

We do not ask for your location, your contacts, your photos, your health data or your calendar, and there are no advertising trackers or third-party analytics in the app.

3. Verbatim storage

What you write is kept as you wrote it. We do not tidy it, shorten it, replace it with a summary, or quietly age it out. This matters because the whole point of Firvo is that in five years you can read the exact sentence you typed on a Tuesday, not a machine’s impression of it.

Indefinitely means exactly that: your entries stay until you delete them, or until you delete your account, which deletes them all. There is no retention timer working against you in the background.

4. The brain: automated profiling, stated plainly

This is the section most apps would hide. We won’t, because it is the product.

What is built

An AI model reads your entries and maintains a private graph about you: nodes for the people you mention, the themes that recur, the places that matter, the values you appear to hold and the goals and loose ends you keep circling, with connections between them, and short written beliefs about each one supported by quotes from your own entries. It also writes a running portrait of you in prose.

What it is used for

One thing: choosing and phrasing the questions you get next, in the tone you picked. That is why a question can refer to something you said in July. Your brain is also shown to you in the app (the glyph at the top right, then What it's noticed at the foot of your Book), so you can see exactly what has been inferred and which of your lines it was inferred from.

What this means legally

This is automated processing of personal data, including profiling, in the sense of UK GDPR Article 4(4). Because people write honestly in a journal, your entries may well contain special category data (health, sex life, religious or philosophical beliefs, political opinions, ethnicity), and the brain may therefore infer things in those categories.

• Our lawful basis for ordinary personal data is performance of our contract with you (UK GDPR Art. 6(1)(b)): personalised questions are the service you subscribed to.
• Our lawful basis for special category data is your explicit consent (Art. 9(2)(a)). We ask for it once, when you create your account, and nothing you have written leaves your phone before then: the first question the app asks you, and anything you tell it before signing up, is held on your device and sent to us only after you have agreed to this sentence, on a page of its own, by pressing a button that says “I agree”: “I agree Firvo may keep what I write, including anything personal about my health, beliefs or relationships, and use it to build my brain as the Privacy Policy describes.” Nothing is agreed for you in advance, and that page stands in front of both Sign in with Apple and email sign-up. Who reads your words and where (Anthropic, in the United States) is set out in sections 5 and 10 below. We record the moment you agreed and which version of the wording you agreed to (this policy is version 2026-09-1); both appear in your export. If the wording ever changes we will ask you again rather than carry the old answer forward. You can withdraw consent at any time by deleting your account in Settings, which removes everything at once, or by writing to support, in which case we stop the brain building within a working day and you choose whether your entries stay or go. Firvo cannot ask personalised questions without the brain, so withdrawing consent ends that part of the service, and we’ll say so rather than pretend otherwise.
• No decision with a legal or similarly significant effect is made about you by automated means. The brain picks a question. That is the extent of its authority.

What you can do about it

• Open What it's noticed and look at any thread to see the exact dated lines it was built from.
• Tap Let it rest on a thread to have the brain leave it alone for a fortnight.
• Delete any single answer yourself: press and hold it in your Book and choose Delete. It goes with anything you wrote going deeper beneath it and its voice note. A thread built from nothing else goes too; a thread with other evidence stays, but what the brain had written about it is wiped and written again from what is left on the next nightly run. Your portrait is cleared and begun again, and any saved weekly page that repeated the deleted words is deleted.
• Delete your account and the brain goes with it, immediately.

Firvo’s questions are generated by a language model working from your brain within templates we control. Models are imperfect; a question may occasionally be clumsy, wrong about you, or land badly. It is a question, not a diagnosis, and you never owe it an answer.

5. Who else processes your data

We keep this list short on purpose, and we will update this page before adding to it.

• Anthropic PBC, the model provider Entries are sent to Anthropic’s API to build your brain and write your questions. Under Anthropic’s commercial terms, API inputs and outputs are not used to train their models, and they are retained only briefly for operational and abuse-monitoring purposes. Processing takes place in the United States.
• Railway, hosting and database Runs the Firvo API and stores your entries and brain. Deployed in Railway’s EU region.
• Apple, for sign-in, payments and push Sign in with Apple identifies you without us handling a password; if you sign up with email instead, Apple is not involved in sign-in. Apple takes the payment and tells us only whether your subscription is live. Apple’s push service delivers the notification that carries your question; the question text passes through it.
• Resend, the email sender Sends the six-digit code that proves an email address is yours, and a password-reset code if you ask for one. It sees your address and the code, and nothing else.

We do not sell your data. We do not share it for advertising. We do not hand it to anyone for their own purposes. If we were ever legally compelled to disclose something, we would tell you unless the law forbade it.

6. No training on your words

Your entries are never used to train, fine-tune, evaluate or improve any AI model: ours, Anthropic’s or anyone else’s. They are used to serve you and for nothing else. If that ever changed it would need your fresh, explicit, opt-in consent, and it would be a different product.

7. Your rights

Under UK GDPR you have the rights below. Two of them we’ve built into the app because asking permission to have your own words back is absurd.

• Export everything: Settings → Export. Immediate, no queue, no email. You get every entry verbatim with its date, plus your settings and your brain, in a machine-readable file.
• Delete everything: Settings → Delete account. Immediate and irreversible. Entries, voice notes, brain, portrait, account, device token: gone, and the sign-in grant on your Apple ID is revoked with them. We keep only what we must for tax and fraud records (the fact that a subscription existed and what was paid) and nothing you ever wrote.
• Correct anything wrong: tap your words on the day you wrote them and the record is replaced. To remove a single entry from any day, press and hold it in your Book and choose Delete. To correct an earlier day, write to support with the date; we do it within a month, usually the same day.
• Object to the profiling, or withdraw consent: delete your account in Settings, or write to support and we stop the brain while you decide about the entries.
• Restrict processing, or ask for your data in a portable form; the export already does this.
• Complain to the Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority. We’d rather you told us first, via support, but it is your right either way.

8. How long we keep things

Entries and your brain: until you delete them. Account records: until you delete your account. Technical logs: [LOG RETENTION]. Backups: deleted content disappears from rolling backups within 30 days. Payment records: kept for six years because HMRC requires it, and they contain no journal content.

9. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to the people who need it to keep the service running, and every such access is a deliberate act rather than a routine one. Entries are never printed to logs or error traces. We will tell you and the ICO if there is ever a breach that puts you at risk, within the timeframes the law sets.

10. Where your data goes

Storage is in the EU (Railway). Model processing takes place in the United States (Anthropic). Transfers out of the UK/EEA rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with a transfer risk assessment we keep on file.

11. Age

Firvo is for people aged 16 and over. We do not knowingly hold data about anyone younger. If you believe a child is using Firvo, tell us via support and we will delete the account and its contents.

12. Firvo is not therapy

Firvo asks questions. It is not counselling, therapy, diagnosis or medical treatment, and it is not staffed by clinicians. No person reads your entries. The model that writes your questions is asked to notice signs of acute crisis for one reason only: so that the next few days’ questions are gentler and never dig at it. That is the whole of what happens. Firvo will not contact you or anyone else, and it is not a way of reaching help.

If you are struggling, Samaritans will listen at any hour of any day on 116 123, free from any phone. If someone’s life is in danger, call 999.

13. Changes to this policy

If we change anything material, such as a new sub-processor or a new use of your entries, we will tell you in the app before it takes effect, not by silently updating a date at the top of this page.

14. Contact

Questions, requests, or a rights request you’d like us to action: the support page has the route. We answer people, not tickets.