Privacy Policy

1. Your account

You sign in to Anywhere with your phone number, which opens your account or creates it: a random user ID and the number. To confirm that the number is yours, we send it to Prelude, our verification provider, which texts you a code; with it go your IP address and signals that Prelude’s software on your iPhone collects to detect fraud. We keep your phone number with your account to sign you in. In versions that offer number-based discovery, the people in your conversations and people who already have or enter your number can see it next to your name (section 9). Earlier versions do not display your number to other people.

To stop abuse, we count the codes sent and tried for each phone number and each IP address, stored under a one-way hash and deleted after two hours.

Your profile is the name and photo you choose. Your friends, the people in your conversations and anyone who opens your invite link can see them. Versions with number-based discovery also show them to people who have or enter your number. We keep the profile information needed to display you in those people’s accounts; versions with number-based discovery include your number as described above. A version that can read contacts may show the name someone saved for you instead of your profile name.

Each iPhone signed in to your account registers itself: a random installation identifier, the tokens that deliver its notifications, the app’s language and version, and the iPhone’s time zone.

2. Location and your history

Anywhere is built on your location. With your permission, it reads your iPhone’s precise location: while you use the app if you choose “While Using the App”, and in the background too if you choose “Always”, so that your map and your history stay complete. With your Motion & Fitness permission, it also reads your motion activity (walking, driving or still) and the motion history your iPhone records, to tell your trips from your stays and to know when your phone was left still, for example overnight.

From these readings, Anywhere works out where you have been:

• Only on your iPhone: the detailed log of location readings (your location journal), the route of a trip while it is under way, the areas you have explored (the fog of war on your map) and when your phone was still at night. The one exception is a diagnostic log upload (section 12), which can include the last 48 hours of your location journal.
• In your account, synced to your iPhones: the places where you spend time (their position and extent, their name and category, a label such as home, work or school, and how often, how long and how many nights you were there), each visit (when you arrived and when you left) and a summary of each trip (when, from where to where, how far, how you traveled, where you stopped and where Anywhere predicted you were going). We don’t keep the routes of your trips. This history is kept without a time limit, so that your places keep all the time you have spent there, until you delete your account.
• Your current status: while you are signed in and Anywhere may use your location, your iPhone keeps your latest status on our servers: your latest position and how precise it is, whether Anywhere can locate you, your time zone, whether you are at a place or on a trip, the place’s label or name, and for a trip its mode, speed, predicted destination and arrival time. Each update replaces the one before. It never includes your battery level or your sleep.

Who can see it: you; Fenn, when it answers you, or a conversation whose members you all share it with (section 7); the people you share your location with (section 9); and the outside agents you connect (section 8).

You can stop Anywhere from reading your location or your motion at any time in your iPhone’s Settings. What is already in your account stays there until you delete your account.

3. Places and notes

Your map holds the places you save. For each one we keep its name, position, address and category, its Apple Maps or Google identifiers, its status (favorite or want to go), your private note (up to 4,000 characters) and where it came from: you, Fenn, a chat, a screenshot, an import, a visit or an outside agent. When Fenn or an outside agent adds, changes or removes one of your places, we keep a record of the change for 30 days so that you can undo it. A removed place disappears from your map, but stays hidden in our database, with your note and everything else we kept for it, until you delete your account.

Your places and notes are private. Fenn can read them in your own conversation with it, and the outside agents you connect can read and change them. If you turn on “Share my places” for someone, they see which places you saved, their status and your ratings, never your notes or visits (section 9).

How places are found:

• Searching for places, naming the places you visit and placing your calendar events use Apple Maps from your iPhone: what you search for, and the area or address looked up, go to Apple.
• To find the places named in chats (section 7) or asked for by outside agents, our servers use Google Maps Platform. They send Google the words that describe the place, not your name or your account. Google’s use of this data is governed by the Google Privacy Policy.
• When you import from Google, the Takeout files and lists you open in Anywhere are read on your iPhone: we don’t upload them. For a shared Google Maps list link, your iPhone downloads the list from Google. The places you import are matched with Apple Maps and saved in your account.

4. Messages, photos and voice

Anywhere keeps your conversations with Fenn, with each person and in groups. We store the messages you send and receive, with their reactions and edits; when you last read each conversation, which the other members see as a read receipt; and how each conversation notifies you. That you are typing is shown to the other members for a few seconds and not kept.

• Photos and videos you send are uploaded to our storage for the members to see. Their files can keep the details your camera or another app embedded in them, such as where and when they were taken and the device used: the members receive these details with the files, and so does OpenAI with the photos it reads (section 7). We also keep where and when each one was taken, read from it as you pick it, and the members can see that too.
• Voice messages are uploaded for the members to hear. Anywhere writes them out with Apple’s speech recognition: on your iPhone when its on-device model is available, otherwise on Apple’s servers. The transcript is kept with the message.
• Links get a preview made on your iPhone. When your iPhone could not make one in time, our servers fetch the page to make it.
• Places named in messages are found (section 7) and shown under the message for the members to save. In your conversation with Fenn, they are added to your map, with an Undo.
• Sharing to Anywhere from another app sends what you share to your conversation with Fenn: photos (with where and when they were taken), a link, text and your note.

The members of a conversation can read its messages, and so can Fenn when someone asks it (section 7). Messages are kept as long as their conversation exists. A message you delete for everyone disappears from the conversation, but stays hidden in our database while the conversation exists. If you delete your account, your conversation with Fenn is deleted; the messages you sent to conversations with other people stay there, as part of their history.

Calls you start from a conversation are placed by FaceTime or your iPhone’s Phone app: we don’t see them.

5. Photos on your iPhone

With your permission, Anywhere reads where and when the photos in your library were taken, to show them on your map at the places you took them, and makes their thumbnails on your iPhone. These photos never leave your iPhone unless you send one in a chat or choose it as your profile photo. In your iPhone’s Settings, you can give Anywhere access to some of your photos only, or to none.

6. Calendars

Apple Calendar. With your permission, Anywhere copies into your account the events of the calendars on your iPhone from 30 days ago to 90 days ahead, except the events that were cancelled or that you declined. For each event it copies the title, location, notes, start and end, whether it lasts all day, whether it shows you as busy, its link, its calendar’s name and color, and the identifiers that keep the copies in step. It doesn’t copy who else is invited. The copy puts your upcoming events on your map, can help name the places you visit, and lets Fenn know your plans: each time it answers you in your own conversation with it, your next 10 events go to OpenAI with your message, and Fenn can look up others; in versions that offer calendar sharing, and only in a conversation whose members you all grant access to, Fenn can look them up too, only when you are busy or free if you share your availability only (section 7). An event leaves your account when it leaves that window or when it is deleted from your iPhone. With the same permission, Anywhere also adds to the calendar you choose on your iPhone (Calendar › Default Calendar, which can also be Only in Anywhere) the events planned in your conversations that are for you, and keeps each one in step with its plan: its title, location, notes, times, whether it repeats, whether you have confirmed it, and the names of the people it is for with their answers. It removes the event when you decline, when the plan is deleted, when you choose another calendar or when you sign out. These events are written on your iPhone, like those of any app; the copy of your calendars in your account leaves them out.

Google Calendar. If you connect Google Calendar (open to some testers for now), you allow Anywhere to read the events of your Google calendars and the list of your calendars. Anywhere uses this access to copy the events of your Google calendars into your account every 15 minutes, with the same window and details as for Apple Calendar. It doesn’t add, change or delete anything in your Google Calendar. If you connected an earlier version that requested editing access, you can remove that grant from your Google Account and reconnect with read-only access. Our servers keep your Google account’s email address, the list of your calendars, what they need to stay in step, and the tokens Google issues to Anywhere, encrypted with a key of their own (AES-256-GCM). You can disconnect in the app at any time, which revokes our access and deletes those tokens and the copied events, or remove our access from your Google Account.

Anywhere’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Calendar data only to provide the features described in this policy. We don’t use it for advertising and we don’t sell it. Nobody at Fenn AI LLC reads it, unless you ask us to, for security or to investigate abuse, to comply with the law, or once it is aggregated and anonymized for our internal operations. We transfer it only to provide these features, to comply with the law, or as part of a merger or acquisition, after telling you. To provide Fenn, we send OpenAI your next 10 events each time Fenn answers you in your own conversation with it, and the events Fenn looks up, for you or, as far as you share your calendar with them, for the people in a conversation with you (section 7). We don’t use Google Calendar data, or any data from Google Workspace APIs, to develop, improve or train generalized AI or machine learning models, and our providers don’t either.

7. Fenn and OpenAI

Fenn is an AI assistant, not a person. Its answers are written by models from OpenAI, which also help find the places named in chats. OpenAI processes this data for us, as our service provider.

What goes to OpenAI:

• Each time Fenn answers, or comes back with a follow-up: the message it answers; the recent messages of the conversation, with their photos, and the names of its members; and what Fenn looks up to answer.
  • In your own conversation with Fenn, whatever you ask, also your current status, your next 10 calendar events (their title, times, location, calendar, whether they show you as busy and up to 500 characters of their notes), and the names and sharing status of people you are connected to. What Fenn can look up there: your places and notes, your visits and trips, your other calendar events, the location of the people who share it with you, and the messages of your other conversations.
  • In a conversation with others, whatever was asked, also the location of every member who shares it with everyone in it, and what each member shares with everyone in it. Fenn uses only what everyone there may see: it never reads anyone’s private places or notes there. In versions that offer history or calendar sharing, Fenn reads a member’s visits and trips, or calendar, only if they grant access to every other member; availability-only sharing exposes busy or free times, and calendar notes are never shared. Earlier versions do not offer this history or calendar sharing.
• To find the places named in your messages, in any of your conversations: the message’s words or photos, and the words of the few messages before it, which tell which place a name means.
• Web searches that Fenn makes to answer you go through OpenAI’s web search.

Fenn can read messages only when everyone reading its answer can read them. A person’s name and what they share can go to OpenAI with Fenn’s answers in a conversation with others, and whenever Fenn looks up their location for someone they share it with.

What Fenn can do. When you ask it, Fenn can add places to your map; in your own conversation with it, it can also change their status or your note, and remove them. Each of these changes is recorded so that you can undo it. Fenn can also send you a follow-up later, and set an arrival alert (“tell me when Sam gets to the airport”), which works only while that person shares their location with whoever the alert tells.

What OpenAI keeps. We send our requests to OpenAI through its API, with storage turned off. OpenAI does not use API data to train its models unless a customer opts in; we do not opt in. Its abuse-monitoring logs may include requests and responses and are normally retained for up to 30 days, with longer retention where required by law or necessary to prevent harm. Its API data controls describe these limits and exceptions. Fenn’s answers are kept in their conversation like any other message.

8. Outside agents

You can connect AI agents and other software made by others, such as ChatGPT, Claude, Grok or your own scripts, to your map: by creating a personal token in the app, or by approving a connection an agent asks for. A connected agent reaches your account through the Anywhere agent API, and for now every connection can:

• read your name and your time zone;
• read your places and notes, and add, change or remove them;
• read the places where you spend time, your visits, your trips and the timeline they make, and change those places’ label (home, work or school);
• read your current status (section 2), locations your friends share with you, and your synced calendar;
• read and change your place tags, and send a notification that opens a place on your map.

What an agent does with what it reads is up to its provider (for example OpenAI for ChatGPT, Anthropic for Claude and xAI for Grok), under that provider’s terms and privacy policy, not this one. Depending on your settings with them, some providers may keep what their agent reads, or use it to train their models.

We record every change an agent makes and every time it reads your places, your history or your current status (which agent, what kind of data, how many items and when), keep these records for 90 days, and tell you about them (“Grok added 2 places to your map”). You can undo an agent’s changes, and disconnect any agent, in the app. We keep tokens only as hashes, which can’t be turned back into the tokens. Deleting your account disconnects every agent.

For ChatGPT and Dot, you start Connect in ChatGPT. On Anywhere’s connection page, you can allow the browser to read the prompt you already copied from Anywhere. Your browser may ask for clipboard permission. The page extracts your Anywhere connection key locally and sends only that key to Anywhere to verify your account; other clipboard contents are not submitted. You then confirm the displayed account name by choosing Connect Anywhere. Declining clipboard permission or cancelling leaves the new connection incomplete. A secure cookie lasting 15 minutes keeps this authorization request together; it is not used for tracking. ChatGPT holds a renewable connection, which expires after 30 days without renewal. Disconnecting in ChatGPT ends that connection; a personal token separately shared with another agent remains usable. Removing the agent in Anywhere revokes both.

To protect Anywhere, the agent API also processes the IP addresses that call it, and limits how much each connection can do.

9. People, contacts and sharing

The connection and sharing options available to you depend on your app version. Use the controls shown in your app to check and change who has access.

Connecting with people. Your invite link and QR code let people see your name and photo and request a connection or start a conversation, depending on the version. You can reset your link at any time: the old one stops working. Versions with number-based discovery also let people who have your phone number start a conversation from their contacts or by entering it, and show them your name, photo and number.

Optional contact discovery. In versions that offer this feature, if you allow access to your contacts (all of them or the ones you choose), Anywhere uploads their phone numbers to find which are on Anywhere, when you allow it and again when your contacts change. We keep a one-way hash of each number, rather than the number itself, to tell you when a contact joins. We don’t upload contact names, photos or other address-book details. Contacts who are on Anywhere appear with the name you saved for them. You can withdraw access in your iPhone’s Settings; deleting your account deletes the hashes. Versions without contact discovery do not upload your address book.

Phone invitations. In versions that offer tracked invitations by text, we keep a one-way hash of the invited number with who invited it and, for a group invitation, that group, for 90 days or until the person joins. This lets us connect the invitation when they join and tell you they joined. Other versions use an invite link without uploading the recipient’s address-book number.

What you share, person by person. You choose who can access your information through the friend or conversation sharing settings available in your app. Review those settings when connecting with someone. The available choices include:

• Your location: people you give access to can see your position on their map, whether Anywhere can locate you, the place you are at (its label, name or address) or the trip you are on (how you travel and how fast, its destination and estimated arrival time), and your time zone. While you share, we keep a copy of this status in their account; it is removed when you stop sharing, block them or delete your account. Versions that offer history sharing also let Fenn tell them where you have been, only when you grant that additional access to everyone in the conversation. They never see your battery level or your sleep.
• Your calendar, where offered: your availability (busy or free times only) or your calendar’s titles, times and places, never notes. Only Fenn reads it for others, and only when you grant access to everyone in the conversation. Versions without calendar sharing keep it private from other people.
• Your places: which places you saved, their status and your ratings, never your notes, lists or visits.

A person you share your location with can ask Fenn where you are or ask for an arrival alert. What you share goes to OpenAI when Fenn looks it up to answer them, and your location goes with each of Fenn’s answers in a conversation where you share it with everyone, whatever was asked (section 7).

Blocking and reporting. Blocking someone stops direct contact and sharing with that person, takes your direct conversation out of your chats and gives you a new invite link. In versions with number-based discovery, it also hides you from each other’s contacts and number searches. Groups you are both in remain. Some versions retain your sharing choices while blocked and restore them if you unblock the person; check your settings before unblocking. When you report someone, we store who you reported, the reason and the conversation the report came from, if any, so that we can investigate. You can also contact us at c@fenn.chat. Our Terms of Use explain how we handle abusive content and accounts.

10. Notifications

With your permission, Anywhere sends you notifications: new messages (with the sender’s name and the message’s text), friend requests and connections, or people from your contacts or invitations joining Anywhere where those features are available, Fenn’s follow-ups and arrival alerts, and what outside agents read and change on your map. They travel through Firebase Cloud Messaging (Google) and Apple’s push notification service. You choose which conversations notify you in the app, and you can turn notifications off in your iPhone’s Settings.

11. Analytics

To understand how Anywhere is used and where it fails, the app sends usage events to Amplitude, our analytics provider, in the United States: for example the screens you open, that a place was saved or a permission granted, counts in broad ranges (“2–4 places”), and the app’s performance from Apple’s MetricKit (launch times, hangs and crashes). Events never contain your name, your notes, your messages, place names, addresses, coordinates, searches, links or contact details.

Events are linked to your Anywhere user ID and to an identifier Amplitude keeps for the app on your iPhone, with your iPhone’s model, its iOS version, the app’s version and language, and your IP address, from which Amplitude derives an approximate location (city, region and country). A few events are sent by our servers, under the same rules: for example that Fenn answered, or that an outside agent made a change. We don’t use analytics for advertising, we don’t use Apple’s advertising identifier, and we don’t track you across other companies’ apps or websites.

12. Diagnostic logs

The app keeps a technical log on your iPhone, a few megabytes that it overwrites as it goes. Any value written in it that could reveal you or your content, such as a name, a message or a position, is replaced by “<private>”, unless the code marks it as a safe technical value.

When we need to investigate a problem, we can ask your iPhone to upload this log, even while the app is closed: a silent notification wakes it in the background. The upload includes the diagnostic files kept beside the log, such as the last 48 hours of your location journal (section 2). Uploaded logs are kept for 30 days, then deleted, and deleting your account deletes them too. Only the people who maintain Anywhere can read them.

If you send feedback or a crash report through TestFlight, Apple shares it with us, with the details Apple adds (such as your device and, for feedback, your email address).

13. The website

The pages of anywhere.fenn.chat are hosted by Firebase Hosting (Google), which processes your IP address and browser details to deliver them and keep them secure. The website has no analytics, no advertising and no tracking cookies. Invite pages keep the code in their address to themselves: they don’t pass it to other sites and search engines don’t index them. The pages that connect an outside agent use a cookie only to link your approval in the app to the browser that asked for it.

14. How we use your data

• To provide Anywhere: build your map and your history, sync them across your iPhones, deliver your messages, share what you choose with the people you choose, answer you through Fenn, and serve the outside agents you connect.
• To keep Anywhere working and safe: fix problems, prevent abuse and fraud, enforce limits, and review reports.
• To improve Anywhere: understand, from analytics, which features are used and where people get stuck.
• To tell you about your account and about Anywhere, for example through the notifications you allowed.
• To comply with the law, and to protect the rights and the safety of people.

We don’t sell your personal information, we don’t share it for targeted advertising, and we don’t use it to build advertising profiles. We don’t train AI models on your data, and our providers don’t either.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: our contract with you (providing Anywhere under our Terms of Use); your consent (the permissions you give on your iPhone and the outside agents you connect), which you can withdraw at any time; our legitimate interests in keeping Anywhere secure, fixing it and understanding how it is used (analytics and diagnostic logs), balanced against your rights; and our legal obligations.

15. Who we share it with

• People you choose: the people you share with, the members of your conversations and anyone you give your invite link to, as described above.
• The outside agents you connect (section 8).
• Our service providers, who process data for us under contracts that limit its use to providing their service to us:
  • Google (Firebase, Google Cloud and Google Maps Platform): accounts, database, file storage, servers, the website, notification delivery and place lookups;
  • OpenAI: Fenn’s answers and finding the places named in chats;
  • Amplitude: analytics;
  • Prelude: texting the codes that confirm your phone number, and detecting fraud;
• Apple, for notification delivery, Apple Maps and speech recognition, under Apple’s privacy policy.
• For legal reasons: when the law requires it, or when we believe in good faith that it is needed to protect someone’s safety, investigate abuse or defend our rights.
• In a merger or an acquisition: if Fenn AI LLC is part of one, your data may be transferred with it, and we will tell you before it becomes subject to a different privacy policy.

16. How long we keep it

When you delete your account, we delete what we hold about you at once, except the messages you sent to conversations with other people, which stay part of their history, and your analytics events, which contain no content: write to us and we will delete those too. Copies held by our providers for their own operations, such as OpenAI’s, are deleted on the schedule above.

17. Your choices and rights

• Permissions. Location, motion, photos, contacts, calendar, notifications, camera, microphone and speech recognition can each be turned off in your iPhone’s Settings. Anywhere keeps working with what you allow.
• In the app, you can stop sharing your location or places, and your calendar where that feature is offered, block someone, delete a message for everyone, change or remove your places and notes, disconnect Google Calendar and disconnect outside agents. A message you delete stays hidden in our database while its conversation exists, and a place you remove until you delete your account (section 3 and section 4).
• Signing out removes your account’s data from your iPhone; your account keeps it on our servers for when you sign in again with your phone number. Delete your account instead if you want its data gone from our servers.
• Deleting your account, from the app’s settings, deletes your account and what we hold about you: your profile, places, notes, history, calendar copies, conversation with Fenn, friendships or sharing connections and any contact hashes, agent connections, Google Calendar connection, files and uploaded logs, with the exceptions in section 16. It can’t be undone.

Depending on where you live, you may have the right to access the personal data we hold about you and get a copy of it, to have it corrected or deleted, to object to or restrict how we use it, and to withdraw your consent. To use these rights, write to c@fenn.chat. We respond as required by the law that applies to your request, and may ask you to confirm it from the app so that we know it comes from the account’s owner. You can also complain to your data protection authority.

California residents. In the past 12 months we have collected these categories of personal information, for the purposes in section 14: identifiers (your user ID, your phone number, device identifiers); personal records (your name and photo); internet or other electronic network activity (usage events, IP addresses); geolocation data (your precise location and history); audio, electronic and visual information (photos, videos and voice messages); and inferences (such as which place is your home and where you are likely going). We use sensitive personal information (your precise location and the contents of your messages) only to provide Anywhere as you ask. We have not sold or shared personal information for cross-context behavioral advertising, and we don’t, including that of people under 16. You have the right to know, delete and correct your personal information, and we won’t treat you differently for using these rights. An authorized agent can make a request for you with your written permission.

18. Where it is stored

Your account’s data is stored by Google Cloud in the United States (Oregon). Amplitude and OpenAI process data in the United States too. If you use Anywhere from another country, your data is transferred to the United States, where data protection laws may differ from yours. Contact us if you would like more information about where your data is processed.

19. Security

Data travels encrypted (TLS) between your iPhone, our servers and our providers, and Google Cloud encrypts it at rest. Our security rules let only you read your account, and let the people you share with and your conversation members read only what you share with them. Agent and log tokens are stored only as hashes, and Google Calendar tokens are sealed with a key of their own. On your iPhone, Anywhere’s data is protected by iOS data protection. No system is perfectly secure: if a breach affects your data, we will tell you as the law requires.

20. Children

Anywhere is for people 18 and older, and isn’t directed to children. We don’t knowingly collect personal data from anyone under 18, and we delete it if we learn we have. If you think a child is using Anywhere, write to us.

21. Changes to this policy

We will update this policy as Anywhere changes. When a change matters, we will tell you in the app before it takes effect. The date at the top shows the current version.

22. Contact us

For any question about your privacy or this policy, or to use your rights: