Privacy policy

Farkad processes voice recordings, photos and the health information extracted from them. This page states plainly what is collected, on what legal basis, who else processes it, and what you can require of us.

Last updated

Who is responsible

Farkad is the controller for the personal data described here. Brahim Redouane Mellah, its founder, is the person responsible for the protection of personal information, which Quebec's Law 25 requires us to name. Questions about this policy, or any request concerning your data, go to mellah.brahim.redouane@gmail.com.

Email us

What is collected

Five kinds of data: what you log (the audio you record, the text you type and the photos you take or choose), the entries extracted from it in the 7 areas you track (water, exercise, food, supplements, medication, sleep, and recovery), your memory in Profile > Memory (the facts you add and those Farkad learns from what you say or type, never from a photo, such as a diet, an allergy or a condition, each of which you can switch off or delete, though a fact you said and then deleted may be learned again if you say it again; and the habits counted from your last four weeks of logs, which you can see but not yet switch off one by one), the account identifiers needed to keep your data yours, and, once you subscribe, what a payment leaves behind: which Stripe customer your account is, and what that subscription currently grants. Card details are typed into Stripe's own checkout and never reach us. Entries about medication, symptoms and sleep, and the health facts in your memory, are health data under Article 9 GDPR and are treated as such.

Why it is processed, and on what basis

Recordings are transcribed, photos are described, and both are turned into structured entries so the product can do what you installed it for — that processing is necessary to perform our contract with you, Article 6(1)(b). Health data is processed only on your explicit consent, Article 9(2)(a), asked for separately before anything reaches the AI and withdrawable at any time without losing access to the rest of the app.

How long it is kept

Audio recordings and photos are deleted 30 days after you log them. The entries extracted from them stay until you delete them or close your account. Withdrawing consent stops further health-data processing; it does not by itself erase what is already stored, which is what a deletion request is for. Database backups, kept to recover from a failure, can still hold a deleted record for up to 91 days, after which they expire on their own.

Who else processes it

Google Cloud and Firebase host the application, the database and the storage for audio and photos, in Google's European regions, outside Quebec and Canada. Google's Gemini AI, through Google Cloud Vertex AI, reads what you log: the recording, the text you type, the photo and its caption, and your memory: the facts you have not switched off and your habits. Nothing is sent before you agree in the app, Google processes it only on our behalf and does not use it to train its models, and the call goes through Google's global endpoint, which may serve it from any region Google operates. You can withdraw that agreement at any time in Profile. Stripe processes subscription payments: it receives the email address on your account and the billing address you give it at checkout, and no health data. Google and Stripe are bound by their data processing terms to protect your data at least as well as this policy does. Signing in with Apple or with Google tells that provider you use Farkad and gives us the address you agree to share; neither receives anything you log. No data is sold, and none is used for advertising.

Diagnostics from the app

When the app fails, it sends Google's Firebase Crashlytics a crash report: where in the code it failed, the device model and the system version, never what you logged. The app sends no usage analytics and no screen timings.

On this website

The website sets no cookie and runs no analytics or advertising; your browser remembers the light or dark theme you pick, and that stays on your device. What you type into the demo is sent to Google's Gemini to show what Farkad would log, and is not stored. To keep the demo and checkout from being abused, we keep your IP address only as a salted digest, which expires after an hour; Google Cloud's request logs record it as part of serving those requests.

How it is protected

Data is encrypted in transit and at rest. Only the genuine Farkad app can reach the database, the storage and the AI, each account can read only its own records, and what you log is redacted from our operational logs. If a breach puts you at risk of serious harm, we tell you and the regulator, as Law 25 and PIPEDA require.

Your rights

You may request access to your data, correction, erasure, a portable copy, and you may withdraw a consent you have given. Those rights are the same wherever you are: Quebec's Law 25 and Canada's PIPEDA, the state privacy laws in the United States, and Algeria's Law 18-07 all grant them, and we do not ask which one you are relying on. Send any of them to mellah.brahim.redouane@gmail.com and we will respond within 30 days. You may also complain to your own regulator — in Quebec the Commission d'accès à l'information, federally the Office of the Privacy Commissioner of Canada, in Algeria the ANPDP.

Email us

Children

Farkad is not meant for anyone younger than the age at which they may consent to health-data processing where they live — sixteen where no other age is set. An account we learn belongs to someone younger is deleted.

Changes to this policy

When this policy changes, the date on this page changes with it. A change to how health data is used asks for your consent again in the app before it applies.

Contact

Write to mellah.brahim.redouane@gmail.com for anything on this page, including a request to exercise one of the rights above.

Email us