Privacy Policy

FactCheck Pro (the "App") is our iOS app for checking claims and images, published by Toi 'n' Moi® Ltd. This section explains exactly what the App does with your information. It is written for version 1.3.0 of the App and describes only what the App really does.

Who is responsible for your data

Toi 'n' Moi® Ltd is a company registered in England and Wales (company number 16135196) with its registered office at 20 Wenlock Road, London, England, N1 7GU. We are registered with the Information Commissioner's Office (registration reference ZB929671). We are the controller of the personal data described in this section. Contact: support@toinmoi-ai.com.

The short version

• No accounts. The App does not ask for your name, email address or phone number, and has no sign-in with email, Google or Apple. It uses an anonymous Firebase session only.
• No advertising or tracking. There is no advertising, no advertising SDK, no analytics SDK and no tracking.
• AI providers, with your permission. When you check a claim, the text is sent to our server and on to Perplexity (an AI search service in the United States). When you run an image check, the photo is sent to our server and on to Google's Gemini AI service. We ask your permission first, separately for text and for photos.
• History stays on your device. Your last 20 checks are saved on your device only. They are never uploaded.
• Pro ledger, and deletion. If you are a Pro subscriber, the claims you check are saved to a private ledger on our servers. You can delete everything we hold about you from inside the App.

What we collect and why

• Anonymous session: When you first open the App it creates an anonymous Firebase account, which gives you a random user ID. It contains no personal details. We use it to apply your usage allowance and to know which subscription you have.
• Device install ID: The App creates a random identifier for your installation and keeps it in your device's Keychain. We send it with each claim check so that the free allowance is applied fairly to one device. It is not your advertising identifier and is not shared with advertisers.
• Claims you check (text): When you type a claim, read text with TruthLens, or share text from Safari, the text is sent to our server (Google Cloud, Firebase Cloud Functions, United States region) and forwarded to Perplexity to find sources and produce the verdict, explanation and source links. We send only the claim text, not your name, user ID or device ID, to Perplexity. If you check a web link, the link itself is sent as the claim, so Perplexity can look up what is said about that page.
  • Free users: we do not save the text of your claim. Our logs record a request reference and the verdict only.
  • Pro subscribers: the claim, the verdict, the explanation, the source links and the date are saved to your private ledger (the "Truth Ledger") on our servers. This includes Deep checks. Claims in your ledger are re-checked automatically from time to time (about weekly for unsettled verdicts and monthly otherwise), and each re-check sends the claim text to Perplexity again. If a verdict changes we record a notification in your ledger. Only you, using your anonymous account, can read your ledger, and you can delete it at any time (see "How long we keep it and how to delete it" below).
• Photos (image check): When you choose a photo for an image check, or share a screenshot to the App, it is reduced in size on your device, then sent to our server and forwarded to Google's Gemini AI service, which returns an estimate of whether the image is AI-generated. We do not store the photo. The result is an AI estimate and can be wrong; it is not proof. The App uses the system photo picker, so it only receives the photo you choose and never has access to your whole photo library.
• History on your device: The App keeps your last 20 checks (the claim, verdict, explanation, source links and date) in a file on your device so you can look back at them. This file never leaves your device, is excluded from backups, and you can delete entries or clear it in the App.
• Share extension and Safari extension: When you share text, a web link or a screenshot to the App, the Share extension saves it in a storage area shared only with the App on your device, for up to 24 hours, until you open the App and confirm. The extension makes no network requests. The Safari extension only reads the page when you tap its button, and passes selected text (or the page headline if nothing is selected) and the page address to the App. Nothing is checked until you confirm in the App.
• Alerts (optional, Pro): If you turn on Truth Ledger alerts, iOS asks for permission to send notifications and gives the App a push token. We save that token with your anonymous account so our server can send alerts through Apple's push service. A notification contains the claim and its new verdict. Turning alerts off removes the token from our servers.
• Camera (TruthLens): TruthLens uses the camera to read text on your device. The camera image is processed on your device and is not uploaded or saved. Only the text you review and choose to verify is sent, as described above.
• Usage allowance: We keep counters of how many checks, image checks and Deep checks you have used in the current period (your free allowance renews every 30 days; Pro has monthly fair-use limits), the start of the period, and your subscription tier (free or Pro), so that we can apply limits. The App also keeps a copy of your remaining allowance on your device.
• Subscription: Purchases are made through the App Store and we never see your payment details. To confirm that you are a Pro subscriber, the App sends the signed App Store transaction record to our server, which checks it and stores your subscription tier, plan and expiry date against your anonymous user ID.
• Security and abuse prevention: To protect the service we use Firebase App Check, which uses Apple's App Attest (or DeviceCheck) to confirm that requests come from a genuine copy of the App. Google Cloud keeps ordinary technical logs for our servers (such as IP address, time and request size) for security and fault-finding.
• What we do not collect: We do not collect your name, email address, phone number, contacts, location, microphone recordings, health data or browsing history.

Who receives your information

These providers process data for us:

• Google (Firebase and Google Cloud): anonymous sign-in, our database, our server functions, App Check and server logs. Based in the United States.
• Perplexity AI, Inc.: receives the claim text, to find sources and produce a verdict. Based in the United States.
• Google (Gemini API): receives photos you submit for an image check. Based in the United States.
• Apple: processes purchases and provides App Attest and the App Store. Apple's own privacy policy applies to its services.

We do not sell your personal data. We do not use it for advertising or share it with advertisers or data brokers. These providers handle data under their own terms and privacy policies as well as our agreements with them.

Our lawful bases (UK GDPR)

• Contract: to provide the App and your subscription (anonymous session, usage allowance, subscription status, your Pro history).
• Consent: to send your text and photos to third-party AI services. You can withdraw this in the App at any time (Settings), without affecting what happened before.
• Legitimate interests: to keep the service secure, prevent abuse and apply usage limits fairly.
• Legal obligation: to keep records the law requires, such as accounting records.

International transfers

Our providers are based in the United States, so your information is transferred outside the UK. We rely on approved safeguards for those transfers, such as the UK data bridge or the UK International Data Transfer Addendum, as applicable to each provider.

How long we keep it and how to delete it

• Free claim text: not saved by us.
• Photos: not saved by us.
• Anonymous session and subscription status: kept while your anonymous account exists.
• Usage counters: a count under a random device identifier, with no content. We keep them after you delete your data, so that deleting data cannot be used to reset the free allowance. They are not linked to your other data once you delete it.
• Pro Truth Ledger, alerts and push tokens: kept until you delete them.
• History on your device: kept on your device until you delete it.
• Server logs: kept for a limited period by Google Cloud for security.

Delete my data: open the App, tap the gear icon (Settings), then Delete my data. This asks our server to delete your user record, your Pro ledger, alerts and push tokens, and records tied to your anonymous account, then clears the App's history, consent choices and settings on your device and starts a new anonymous session. We keep only the usage counters described above.

You can also email support@toinmoi-ai.com and we will delete it for you. Deleting your data does not cancel your App Store subscription; manage that in Settings, then your Apple ID, then Subscriptions.

If a provider such as Perplexity or Google holds a copy under its own retention rules, contact that provider about it, or ask us to help.

Your rights

Under UK data protection law you have the right to:

• be told what we hold about you and get a copy (access);
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our use of it;
• receive it in a portable form;
• withdraw consent at any time; and
• not be subject to decisions made solely by automated means that have legal or similarly significant effects. We make none.

Because the App uses an anonymous ID, we may need you to show us your device identifier to find your records. Email support@toinmoi-ai.com to use any of these rights. We aim to reply within one month.

Complaints

If you are unhappy with how we handle your data, please contact us first at support@toinmoi-ai.com. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.

Children, AI results and changes

• Children: The App is not directed at children under 13 and we do not knowingly collect data from them.
• AI results: Verdicts, trust scores and deepfake estimates are produced by AI, can be wrong, and are not professional advice.
• Changes: If we change how the App uses your data we will update this policy and, where the change affects what is shared with AI providers, ask for your permission again.

Team AI Plus is an optional subscription for Team AI on iPhone, iPad, Mac and Android. It needs a Team AI account. Everything else in Team AI works without one. This section describes what the account and each Plus feature send to us and what we keep. For what Team AI does without an account, see Section 8.

The short version

• No password, no analytics. You sign in with Apple (on Apple devices), Google, or a link emailed to you. Team AI has no analytics, advertising or tracking SDK.
• Sync is end-to-end encrypted. If you turn it on, your chats, agents, memories and a few settings are encrypted on your device with a key our server never has. The server stores ciphertext plus labels such as sizes and times. Provider API keys are never synced.
• Share links are encrypted in the link. The key is in the part of the link after the # sign, which Team AI's server never receives. Anyone who has the whole link can read the content.
• Team AI Included sends the text of a chat to our server and on to Google (the Gemini API) to write the reply, only for chats where you chose it and after you agree to a notice. We do not store the messages or the replies; we keep usage counts for 90 days.
• Always-on agents (optional) are the one place your text is not end-to-end encrypted: the prompt you write is readable by our server because the server has to run it while your devices sleep. While a job runs, the prompt and what it gathers go to Google (the Gemini API) and, for searches, to Brave Search.
• You can delete your account from inside the app. Copies in our server backups expire within about four weeks.

Who is responsible for your data

Toi 'n' Moi® Ltd (company number 16135196, registration reference ZB929671 with the Information Commissioner's Office, registered office 20 Wenlock Road, London, England, N1 7GU) is the controller of the personal data we hold to run your account, your subscription, the sync and share storage and Team AI Included. Contact: support@toinmoi-ai.com. Google (Firebase Authentication, and the Gemini API for Team AI Included and always-on agents) and Brave Software (Brave Search, for the web searches of always-on agents) process data for us. Apple, Google Play and Stripe are independent controllers of your payment details and purchase records; we never see your card. Providers you connect yourself with your own API key are not our processors.

Your account and subscription

• Sign-in. The token from Apple or Google, or the email address you type for a link, goes to Google Firebase Authentication, which logs you in and sends the link. Firebase keeps your account id, email address, sign-in method and session tokens. On each Plus request the app sends a Firebase token to our server. The server keeps an account row keyed by your Firebase account id and your email address only as a one-way keyed hash, and only when the sign-in provider says it is verified. Our application logs carry an internal pseudonymous id, never your email address or token.
• iPhone and iPad. You buy through the App Store. We receive Apple's signed purchase record, with your Team AI account id, and App Store server notifications (renewals, expiry, refunds).
• Android. You buy through Google Play. We receive the purchase token and your account id, and Google Play notifications.
• Mac. You buy through Stripe in your browser. Our subscription server receives your Firebase token, the plan you chose and, if your token has none, your email address, and passes your subscription state to our Plus server.
• Refunds. If a purchase is refunded or revoked, a minimal record (the store's transaction id and the revoked time, with no account, email or token) is kept for 400 days so the same purchase cannot be used again.

Sync (optional)

• Each record is encrypted on your device with XChaCha20-Poly1305. The key is protected by a 24-word recovery phrase that is generated on your device, shown once and never stored or sent by Team AI. The server holds a wrapped copy of the key that it cannot unwrap.
• The server can see a record id, its kind (for example chat, message or memory), a key generation number, a format version, the time it changed, a per-install pseudonym and its size, and your network address and the time of each request. From these it can count your conversations and messages and estimate their length. It cannot see titles, message text, agent names and prompts, or memories.
• Not synced: provider API keys and anything in the Keychain, MCP servers and tokens, custom providers, attachments, images, documents, knowledge-base files, meetings, and the app lock, consent and approval settings.
• If you lose the recovery phrase and every signed-in device, nobody, including Team AI, can open your synced data. There is a limit of 500 MB of encrypted data per account.
• Sync is separate from the free iCloud mirror on Apple devices; both can be on.

Share links (optional; creating links needs Plus)

• You can create an expiring link to a conversation, a decision record or a pack of agents. Before upload you see exactly what will be shared, can leave out or redact messages, and are warned about patterns such as email addresses, phone numbers, keys and card numbers. Names and unusual details are not detected: read the content.
• The content is encrypted on your device with a new random key for each link (AES-256-GCM). The key is in the link after the # sign and is not sent to us when you create, open or report a link. Opening a link in a browser loads a viewer page from share.toinmoi-ai.com; the server sees the link's id and your network address, and the key stays in your browser.
• We store the encrypted blob, its size, the creation and expiry time, a view counter, report counters and the account that made it. We cannot read the content, the title or the kind.
• Anyone who has the whole link can read the content, copy it and forward it. Revoking or expiry stops new views; it does not take back copies. Links expire after 1, 7 or 30 days.
• Anyone can report a link anonymously; three independent reports hide it pending review. To ask for a link to be removed, email support@toinmoi-ai.com with the link up to, but not including, the # sign.

Team AI Included (optional)

• It is off until you choose it for a chat and agree to a notice that names who handles your text.
• What is sent: the text of that chat (the system prompt and earlier messages; no images, files, tools, contacts, location or other chats) to our server, which passes it to Google (the Gemini API) to write the reply, with your Firebase token and a random request id.
• What we keep: nothing of the conversation. Messages and replies exist in the server's memory while one request runs and are not stored or logged. For each request we keep the time, the model, the token counts, the cost and the outcome for 90 days, and monthly usage totals, to apply your allowance and stop abuse.
• Google can see the text while the request runs, and Google's own terms apply to what it receives. Team AI Included has an allowance of a number of messages each month, shown in the app and on the store listing, with fair-use limits on request size, request rate and simultaneous replies; always-on agent runs use a share of it. Deleting your account and creating a new one does not start a new allowance in the same month: what you had used is remembered, as a total linked only to a one-way hash, until the month ends. The service can be temporarily unavailable, for example for maintenance, because of an outage or because it has reached a daily or monthly capacity limit.
• Your agreement is stored on your device per provider; if the company that handles your text changes, you are asked again. You can withdraw it in Settings at any time.

Always-on agents (optional)

• A job is a name, a prompt (up to 4,000 characters), a daily or weekly time in a time zone you choose (the zone name is sent, and tells roughly where you are) and the tools it may use: search the web, fetch a web page, or neither. You can have up to 5 jobs and each runs at most once a day. Nothing runs until you read and accept a screen in the app that explains what the server can see.
• Not end-to-end encrypted. The prompt and job name are sent to our server in readable form, because the server runs the job while your devices sleep, and are kept until you delete the job or your account. Server backups can contain them for as long as backups are kept.
• While a job runs, the server sends the prompt, the web pages it fetches and the search results to Google (the Gemini API) and, when you allow the job to search, the search words the model writes (up to 300 characters, with no account details) to Brave Search. The server fetches only ordinary public web pages: it refuses addresses on private or internal networks, checks every redirect, reads at most 512 KB and identifies itself as TeamAI-Agent. These tools only read; nothing the agent does changes anything.
• We keep none of the answer in readable form: it is sealed to the public keys of your registered devices (up to 8), so only your devices can read it. The run history keeps the time, status, token counts, cost and number of tool calls for 90 days, never the content. A run can be skipped, for example if Plus is not active or the agents' share of your Team AI Included allowance is used up, and is then recorded as skipped.
• Nothing acts for you: anything an agent proposes (up to 5 per run) waits sealed in your approvals for up to 30 days and is carried out only if you approve it on your device, where approving opens a draft chat you must still send. The server records only that an item was approved or denied. Notifications are made by the app on your device and contain no content; there are no push notifications, and the app checks for results about hourly when the system allows and when you open the agents screen.
• Agents are not for children and must not be used to attack or overload other sites, to collect material you have no right to, or to harass anyone. We can switch agents off, and suspend an account that abuses them, for security, cost or abuse reasons. Report misuse to support@toinmoi-ai.com.

Our lawful bases (UK GDPR)

• Contract: your account, subscription, sync and share storage, and Team AI Included.
• Consent: sending the text of a chat to Google through Team AI Included, and the screen you accept before your first always-on agent job. You can withdraw it in the app at any time (for agents, by deleting your jobs).
• Legitimate interests: preventing fraud and reuse of refunded purchases, rate limiting, security logs, and handling abuse reports and takedown.
• Legal obligation: accounting records.

Who receives your data

• Google (Firebase Authentication): sign-in tokens, email address, account id, sessions.
• Google (the Gemini API): chat text for Team AI Included, and the prompt, fetched pages, search results and answer of an always-on agent run.
• Backblaze (B2): encrypted off-site backups of our server, encrypted by us before upload.
• Apple, Google Play and Stripe: purchases, as independent controllers.
• Brave Software (Brave Search): the search words written by an always-on agent that you allowed to search.

We do not sell your personal data or share it for advertising. Some of these recipients, notably Google and Stripe, process data outside the UK; we rely on the safeguards UK GDPR provides for each transfer, such as the UK–US data bridge or the UK International Data Transfer Addendum, as applicable. Sync and share content leaves your device already encrypted with keys we do not hold.

How long we keep it

• Account row, entitlement state and monthly usage totals: until you delete your account. If you delete your account part-way through a month, that month's usage total is kept until the end of that month, linked to nothing but a one-way keyed hash of your sign-in account id (no name, email or account id), and then deleted.
• After you delete your account we also keep a one-way keyed hash of your sign-in account id, with the date, for 90 days. It cannot be reversed to your id or email. It is used only so that, if we ever have to restore a server backup, we can delete your account again instead of bringing it back.
• Synced records and the wrapped key: until you delete them or your account. Sync deletion markers (id, kind, clock): 180 days.
• Share blob: removed at expiry or immediately when revoked; the share's record is kept 7 days after expiry, or 30 days after a revoke. Share reports: with the share.
• Team AI Included: no message content; the usage ledger (time, model, token counts, cost, outcome) 90 days. If a request carries a de-duplication key (the current apps send none), a one-way hash of that key and the length of the request (nothing derived from the text) is kept for 24 hours so that a retry is not charged twice.
• Always-on agents: the job (name, prompt, schedule, tools) until you delete the job or account; run history 90 days; approval items 30 days; device public keys until you remove the device or your account; sealed results until you delete your synced data or your account (they have no automatic expiry yet), and your devices remove their copies after 90 days.
• Apple and Google notification de-duplication log: 90 days. Refund memory: 400 days (above).
• Server backups: our server is backed up daily. Local copies are kept 14 days and encrypted off-site copies for about four weeks. Data you delete can therefore remain in backups for up to about four weeks; backups are used only to recover from a disaster, and if one is restored, accounts deleted since it was taken are deleted again straight away.

Deleting your data and your account

• In the app: Settings > Team AI Plus > Delete my Team AI account. This deletes the data our server holds for your account (sync records and the wrapped key, shares, usage records, and any agent jobs and device keys), removes Sign in with Apple from your account if you used it, and deletes your login. What we keep afterwards is described in the retention list above (a one-way hash of your account id for 90 days and, if you used Team AI Included that month, that month's usage total under the same kind of hash until the month ends). It does not cancel or refund a subscription: cancel that first in your Apple Account, Google Play, or (on the Mac) with Manage subscription.
• Only the synced data: Settings > Team AI Plus > Sync > Delete my synced data. One share link: Settings > Share links.
• Without the app: email support@toinmoi-ai.com from the address on the account with the subject "Delete my Team AI account". We will confirm and complete it within one month.
• Chats stored only on your devices stay there until you delete them.

Security, your rights and children

• Security, specifically: connections to our servers use TLS 1.2 or later; sync and share content is encrypted on your device before upload; sign-in has no password; API keys and session tokens stay in the device Keychain or encrypted storage and are not synced; our application logs carry no message content, tokens or email addresses; requests are rate limited. No system is perfectly secure. Because sync and share content is stored encrypted under keys we do not hold, a breach of our storage would expose ciphertext and the labels described above, not the content.
• Your rights are in Section 14. We cannot read synced or shared content to give you a copy of it: your copy is on your devices.
• Children: A Team AI account is for people aged 18 or over. Team AI is not directed at children and we do not knowingly collect their personal data. Team AI Included and always-on agents are not designed for children.
• Changes: if we change what Plus sends to our servers or to a processor, we will update this policy and, where it changes what is sent to a processor, ask for your agreement again in the app.