FastIdea
ITExplore the app
INFORMATION AND TRANSPARENCY

Privacy notice

Your data, from the first thought on your phone to the project you share.

On this page
Last updated: September 10, 2026. Version 2026-09-10.

1. Controller and contact details

The data controller is BoopStudio di Francois Lampasona, Via Giacomo Matteotti 56, 91018 Salemi (TP), Sicily, Italy. For questions or requests about your data, write to lampasonafrancois@gmail.com.

2. Data and features

  • Website. Servers receive technical connection data, such as your IP address, browser and request time. We have not added advertising or profiling tools. Fonts are hosted with the website.
  • App without an account. Ideas, checklists and attachments stay on your device. The app may still contact update services and, if an error occurs, send the essential diagnostics described below.
  • Account and cloud. We process email addresses, credentials managed by the authentication service, account identifiers, profiles, ideas, tasks, attachments, workspaces, roles and notifications. When you first sign in, you choose which local ideas to import into the cloud. We record the version of the Terms you accepted and the privacy notice you read, together with the registration date.
  • Photos and camera. Photos and the camera are used when you choose to add an image, avatar or cover. You can deny or revoke permission in your device settings.
  • Push notifications. If enabled, we use your device token to deliver updates. Notification text may appear on your lock screen: you can limit previews in your system settings.
  • Archive, trash and tags. Tags and archive or trash status are part of an idea and sync when the idea is in the cloud. Trash keeps content and attachments until you choose to restore or permanently delete them; moving an idea to Trash does not permanently delete it.
  • Reminders and suggestions. Idea and task reminders are personal, stored on your device and delivered by the operating system with your permission. Reminder notifications do not contain idea titles or text. Archiving, trashing and completing tasks suspend their reminders. “Revisit an idea” uses only local dates and content, without sending them to an AI service.
  • iOS sharing and widgets. When you choose “Save to FastIdea” from another app, text, links and images are kept in an encrypted queue shared by the app and its extension. Content is imported locally the next time the app opens; temporary copies are removed after successful import. Items associated with an account are imported only for that account. You choose whether to move the idea to the cloud. The widget provides shortcuts and does not display idea content. Import identifiers, without text or images, prevent duplicates after an interruption.
  • Diagnostics. If a failure occurs, the app sends the error type and identifiers for the app version and update. The current version does not send idea text, passwords, raw error messages or stacks. The server also receives normal technical connection data.
  • Support. When you write to us, we receive your email address and message content. Send only necessary information and hide personal data in screenshots.
  • Voice and AI assistant. Only after your explicit request do we send the selected text or recording to OpenAI through our server, to transcribe it or prepare a draft. Recordings are limited to two minutes and the microphone starts only when you tap Record. We do not automatically send other ideas, images or workspace conversations. You can review and edit the result before saving it.
  • Optional usage measurement. If you enable Share essential usage data, we record the day you open the app, create an idea, use a template or accept an invitation. Events are associated with your account ID, without text, titles, email addresses, attachments or recordings. They are not anonymous data. The controller sees an aggregate report to improve the product; we do not use advertising SDKs. You can disable collection and erase these events in the app’s privacy choices.
  • Apple purchases. Apple handles subscription payments and renewals. We receive transaction IDs, the product, test or production environment, expiry dates and any refunds, linked to your FastIdea account to verify Pro access. We do not receive card details. Purchases made with TestFlight belong to Apple’s sandbox environment.

3. Purposes and legal bases

Accounts, cloud storage, collaboration and requested support are used to provide the service and rely on performance of a contract or steps you request before entering a contract (Article 6(1)(b) GDPR). Security and essential diagnostics rely on our legitimate interest in protecting and maintaining the service (Article 6(1)(f)), while respecting your rights. Mandatory compliance activities rely on Article 6(1)(c).

We do not perform automated marketing or profiling, or make solely automated decisions that produce legal effects concerning a person. Reading this notice and accepting the Terms does not constitute consent to advertising purposes. Account data is required only if you choose cloud features; other profile and content data is optional.

Optional measurement is based on consent (Article 6(1)(a)), which you may withdraw at any time without losing app features. Withdrawal does not affect the lawfulness of earlier processing. Transcription and AI assistance requested by you, and purchase verification, provide the functionality you request (Article 6(1)(b)). Do not submit other people’s sensitive data without an appropriate basis.

4. Protection and sharing

The local ideas database is encrypted and its key is stored in the device keychain. Transfers to services use encrypted connections. Cloud attachments are stored privately, with authorised access and temporary links. Local encryption is not the same as end-to-end encryption of the cloud service; exported files and local images also depend on device protections.

Workspace members see shared content according to their role and participants’ profile data, which may include email addresses. A registered user who knows your exact email or username can find your name and avatar to invite you; the search does not return your email address. Ideas and attachments are not published in invitation previews. If you export a document to another service, you choose the recipient and that service’s privacy policy also applies. Exporting for an AI chat does not automatically send content to a model. Links are saved without automatically loading external websites or preview images.

When you share an active invitation link, recipients can see the workspace name and cover without an account, on the website and in chat previews. The link lets them join the workspace in the app after signing in to their account. Revoking it prevents new joins through that invitation and new personalized previews; messaging apps may retain previews they have already received under their own terms.

Templates and history. Personal templates remain in the device’s encrypted database, separated by account. Publishing a template makes only the confirmed snapshot of its title, text and checklist accessible to anyone with the link. Photos, comments, members and history are not published. Revoking the link prevents further access from the service; it cannot erase copies already saved by others. History keeps up to 50 versions of an idea’s text and details; comments and assignments are visible to authorized workspace members.

5. Retention and deletion

Content stays available while you keep it in the service. You can move ideas to Trash, permanently delete them from the Library, delete attachments, export content and request account deletion from Settings. Local-only ideas stay on your phone until you delete them or remove the app’s data; signing out removes the local copy of cloud data.

Account deletion removes your profile, registered devices, notifications and personal content. Workspaces you own are removed: ideas written by other members become personal to their authors. Tasks you added to other people’s ideas may remain without a reference to your account. To keep a workspace, you can transfer ownership first. Files you uploaded, including covers in other people’s workspaces, are removed with your account. Reminders, pending imports and local data associated with the account are also removed from the device; guest drafts that are not associated with the account remain separate.

Technical deletion identifiers, without idea text, allow offline devices to catch up within a 180-day sync window. Technical logs follow providers’ retention windows and are not copied into a permanent application archive. Support requests are retained to handle them and for as long as necessary to meet legal obligations or defend a legal right. Backups and retention obligations may involve additional technical time after removal from active data.

Temporary recordings are deleted from the device when the flow finishes or is cancelled. FastIdea does not store the text sent to AI, recordings or generated drafts on its servers. It keeps only request IDs, operation types and counters for limits and abuse prevention for 32 days. Monthly cost totals without user identifiers remain for 13 months. Optional usage events remain for 90 days; the first idea date after consent and the privacy choice remain until withdrawal or account deletion. Apple receipt records are kept to manage access and removed from application data with the account; Apple applies its own rules to payment data.

6. Service providers

Our infrastructure uses Supabase for authentication, databases and files; Railway for APIs and diagnostics; Vercel for the website; Expo and Apple or Google services for distribution, updates and device notifications. Support email uses Gmail. Each provider receives the data needed for its function, according to its role and applicable terms. People you share a workspace with receive the content you make accessible to them.

OpenAI receives only the content you choose to send to AI features. For text processing we disable response state storage; OpenAI may retain abuse-prevention logs for up to 30 days under the applicable API terms. The transcription service documentation specifies no application-state or abuse-log retention for that endpoint. API data is not used to train models by default. These requests do not guarantee exclusively European data residency.

7. International transfers

The project’s Supabase database is configured in the Ireland region. Some providers and subprocessors also operate outside the European Economic Area: the database region does not guarantee that all processing takes place exclusively in the EU. Transfers require the safeguards provided by Articles 44–49 GDPR, such as adequacy decisions or standard contractual clauses, depending on the service involved. You can request information about recipients and applicable safeguards by writing to the controller.

8. Cookies and preferences

The website uses the language in the page address and, on your first visit, your browser preference, without storing language cookies. In the app, we save your choice of Italian, English or the system language on your device. When you sign in, we also save the current language in your authentication profile to deliver notifications in that language. You can change it in Settings.

The website does not set advertising or profiling cookies. It stores your light/dark preference in the browser to remember your choice. Password recovery manages the temporary session needed for the operation. Details about purposes, duration and removal are available on the Cookies and browser data page. If non-essential tools are added, the required consent choices will be introduced beforehand.

Web access. The web app’s authenticated session is stored in sessionStorage for the open tab, separately from password recovery. Signing out removes it. Open ideas remain in page memory; save changes before closing. The public site does not enable the app’s optional measurement.

9. Your rights

Where Articles 15–22 GDPR apply, you may request access, rectification, erasure, restriction and portability of your data, or object to processing based on legitimate interests. Write to lampasonafrancois@gmail.com. We will respond within the time limits of Article 12 GDPR, normally within one month; if a complex request requires a legally permitted extension, we will explain why. We will ask only for information needed to verify your identity.

You may lodge a complaint with the Italian Data Protection Authority or the competent authority in your country, without prejudice to other remedies available by law.

10. Updates

The date and version at the top identify this document. If processing changes substantially, we will update this notice and provide the required communications. You can contact us at any time for clarification.

Back to the beginning Contact us