ReMi 隐私政策
生效日期：2026-11-09 最后更新：2026-11-09
ReMi 是一个帮你记录家庭和生活的应用。你可以用一句话、一张照片或一段录音记下事情，ReMi 帮你整理、提醒、回答关于你记忆的问题，还能把每天画成一本带插画的日记。ReMi 也可以在对话中陪你一起听（「伴记」），并支持乐奇（Rokid）智能眼镜。
这份政策说明：我们处理哪些数据、为什么处理、交给谁处理、存多久，以及你可以怎么管理自己的数据。它适用于通过 Google Play 发布的 ReMi 安卓版。
1. 我们是谁
- ReMi 在 Google Play 上的开发者名是 「ReMi Memory」。个人信息控制者是 ReMi Memory，菲律宾马尼拉大都会。
- 隐私联系人 / 数据保护官：remi.support.app@gmail.com。
2. 先说结论
- 你的记忆存在你自己的手机上，数据库是加密的。我们的登录服务商和我们的服务器只保存你的账号，以及运营必需的少量记录（比如使用次数、你发给我们的举报）。如果你打开云备份，我们还会保存一份我们解不开的加密副本。
- AI 功能要把内容交给云端 AI 服务商。 整理记忆、写日记、在聊天里回答你、在伴记里跟上对话时，ReMi 会把相关内容——以及为了让 AI 理解上下文的相关旧记忆片段、你记录过的人名——交给阿里云或谷歌，由它们替我们处理。每个功能发什么，见第 4 节。
- 有些东西从不发给 AI： 密码本里的密码和其他保密栏位，以及你存下的证件和私密档案的内容。它们的标题可能会作为上下文（见 4.3）。
- 录音文件留在你的手机上。 伴记在听的时候，你的声音会实时或按小段发给云端 AI，用来转成文字和理解。
- 我们不卖你的数据，不做广告，不接入第三方的广告或统计工具。 我们会统计少数几个功能的使用次数（默认开，可以关），App 里内置的谷歌组件会给谷歌发不含你内容的诊断数据。
3. 我们处理哪些数据
3.1 你主动记录的内容
除非第 4 节说的某个功能要发出去，否则都留在你的手机上。
| 数据 | 例子 |
|---|
| 文字记忆、日记、待办 | 「今天带小宝去打疫苗」 |
| 照片 | 你拍的或选的照片、小票、截图 |
| 语音 | 语音记忆；伴记和会议录音；你录过的话，一段 12 秒的声音样本（「声纹」） |
| 和 ReMi 的对话 | 你的问题和 ReMi 的回答 |
| 人物 | 名字、关系、生日、备注、头像、用来认出 TA 的人脸数据，以及你记下的 TA 的公司和职位 |
| 财务 | 记账、预算、借出借入、卡片名称和后四位 |
| 健康 | 你记下的内容，比如过敏、体检报告 |
| 证件和私密档案 | 身份证、护照、合同、银行卡的照片和内容 —— 额外加密 |
| 密码 | 密码本里的账号 —— 密码、备注、验证码额外加密 |
| 地点 | 你存下的地点，比如「家」（经纬度和地址） |
| 导入的文档 | 你放进知识库的 PDF、Word 等文件 |
| 眼镜 | 你问「这是谁」「这是什么」时眼镜拍的照片 |
3.2 你的账号
- 用谷歌账号登录： 谷歌确认你的身份，我们收到你的邮箱、名字、头像链接和一个账号编号。登录服务由 Supabase 提供。你的昵称、币种和家庭画像只存在你的手机上。
- 不登录： ReMi 会为这次安装建一个匿名账号，只有账号编号，没有邮箱和名字。
3.3 自动产生的信息
- AI 用量计数： 每个账号（用一个无法反推的代码表示，不是你的邮箱），服务器记录哪天用了哪个 AI 功能、几次、发了多少数据、花了多少钱，不记录内容。用来防滥用和控制费用。
- 使用统计：见 3.6。
- 试用记录： 你打开「AI 使用统计」页时，服务器会记下你的账号在哪个试用组、从哪天开始。
- 局域网服务： 只有你打开「在电脑上用」时，ReMi 才在手机上开一个小服务器（通知栏常驻一条通知），让你自己同一 Wi-Fi 下的电脑连进来；它在局域网里只用一个短代码和手机型号告诉别的设备「我在这里」，不带你手机的名字。你不再打开，它就一直关着。
- App 里的谷歌组件： 手机上的文字识别、人脸检测、扫码（谷歌 ML Kit）和谷歌登录，可能会给谷歌发诊断信息，比如手机型号、安卓版本、App 版本和性能数据。不会发你的照片或文字。
- 不带内容的联网： App 会访问谷歌的一个地址，检查手机是不是在线；大约每天一次从公开服务取汇率；可能从 Google Play 或公开的模型网站（Hugging Face、ModelScope、GitHub）下载语音模型；只有你点「密码健康检查」时，才把每个密码的单向代码（哈希）的前 5 个字符发给「Have I Been Pwned」查泄露。这些服务能看到你的网络地址。
- 我们不收集：广告编号、通讯录、通话记录、短信、浏览记录。App 里没有崩溃上报或广告工具。
3.4 关于孩子和家人的信息
ReMi 面向 18 岁及以上的成年人，不面向儿童，儿童不应自行注册或使用 ReMi。
很多家长会在 ReMi 里记录孩子和家人的生活，比如孩子的名字、年龄、照片、成长和健康情况。对这些内容：
- 请只记录你有权记录的内容。关于孩子的内容，请你以家长或监护人的身份决定记什么；
- 这些内容和你的其他记忆一样，主要存在你的手机上，只有在提供你使用的功能时才按第 4 节交给云端 AI 处理；
- 我们不会用这些内容给孩子建营销画像，也不会把它们给任何人做广告；
- 如果你认为我们处理了不该处理的儿童信息，请按第 1 节联系我们，我们会删除。
3.5 你的记忆、录音和照片里的其他人
ReMi 是给你自己和家庭生活用的。你录下对话、拍下别人、或让 ReMi 认人脸时，也在处理别人的信息：
- 录音前请先告诉在场的人，只在合法的场合录。 在包括菲律宾在内的一些国家，未经在场所有人同意录下私人对话可能构成犯罪。
- 人脸识别（比如通过眼镜问「这是谁」）在你的手机上进行，人脸数据只在你的手机和你自己的备份里。
- 关于其他人的信息，只按第 4 节说的方式交给云端 AI。
3.6 使用统计（「帮助改进 ReMi」）
- 为了知道哪些功能有人用，App 每天最多给我们的服务器发一次：日期、App 版本、安卓大版本号、你的试用组，以及几件事的次数（打开 App、存了一条记录、点了分享）。服务器根据网络连接加上你所在国家的两字母代码，不保存你的网络地址。
- 服务器按你账号的单向代码，记下你开始使用后的前 31 天里哪几天打开过 App、第一条记录是哪天、从哪天开始用，保留 13 个月。
- 默认开启，你可以随时在「设置 → AI 使用统计 →『帮助改进 ReMi』」关掉。 关掉后 App 不再计数、不再发送。AI 用量计数（3.3）照常，因为那是提供服务所必需的。
3.7 举报
你举报一条 AI 回复、一篇日记、一张插画或主题图时，ReMi 会发给我们：问题类型、在哪里发生的、被举报的文字（最多 8,000 字；图片只发类型、日期和画风，从不发图片本身）、你的补充说明、涉及的功能，以及 App 的语言和版本。我们用这些处理举报。举报保存 30 天；涉及儿童性虐待的举报按法律要求保存更久。
4. 哪些在手机上做、哪些交给云端 AI、为什么
4.1 在手机上做
下面这些在你的手机上运行，结果也留在手机上：
- 识别照片里的文字；检测和认出人脸；读取支持的证件（护照、菲律宾 PhilSys、UMID、驾照、中国身份证），并在发出任何东西之前把证件号码和人脸涂黑；
- 语音转文字和朗读（语音模型装好以后）；
- 记忆搜索；
- 读取你导入的文档（扫描件或加密文件除外，见 4.2）；
- 通过眼镜认人，以及 ReMi 为认出的人显示的「要点」（公司和职位、你记下的喜好、你答应过 TA 的事）。要点通过蓝牙发到你的眼镜上，读出来时只用手机自己的声音。
4.2 交给云端 AI 的
云端 AI 请求先经过我们托管在 Cloudflare 上的中继服务器，再转给服务商（见第 7 节），中继不保存内容。纯文字的事先交给阿里云；带照片、声音、联网搜索的，以及画插画，交给谷歌。
- 存记忆（整理这条记忆）： 你这次输入的内容；附带的照片和录音（像证件或银行卡的照片不发）；最多 8 条相关旧记忆的片段（每条最多 80 字）；照片里认出的人名，以及这些人最近记忆的简短片段；最近事件的标题和相关待办的关键词；跟这条有关时，你标为重要的过敏或疾病；带照片的记忆还会带上你的家庭画像，包括孩子的年龄（孩子名字用占位符代替）。
- 聊天： 你的问题和今天最近的对话；本月预算和已花金额；你添加的卡片的名称和后四位；跟问题有关时，还会带最多 5 条相关记忆（每条最多 200 字）、最多 5 笔相关记账和合计、你的待办列表、相关密码条目的标题和分组、相关档案的标题、类型和归属人。纯文字问题，谷歌的 AI 服务可能会用谷歌搜索联网查。你在聊天里发的照片，会连同 ReMi 在照片里认出的人名一起发出。离开聊天页时，当天的对话会发出去，用来记下重要的事。
- 日记和插画： 当天记忆的全文，以及出现的人的名字、关系和备注；你选的画风和主角形象描述。插画默认只用文字描述，除非你选「用照片画」——选了之后，相关的人和宠物的照片可能会发出去（像证件的照片不发）。用你的照片生成卡通形象也要你这样选。主题： 你上传的照片会发给谷歌。
- 证件、作业题、表格： 先在手机上读。只有手机读不全、而且你同意了，才发照片——证件会先把号码和人脸涂黑，除非你选择整张发送。填表时 ReMi 只告诉 AI「哪些栏要填」，你的真实信息在手机上填回去。
- 语音记忆： 手机上的语音模型没就绪或处理不了时，录音会发给我们的语音转文字服务商；它也失败时，发给整理记忆的 AI。
- 伴记（陪你一起听）： 实时模式下，你的麦克风声音从手机直接传给谷歌转成文字；如果你录过声纹，声纹会和短片段一起发出，让 AI 分辨哪句是你说的。分段模式下，大约每 15–25 秒的声音会连同最近的对话、你的声纹（录过的话）发给谷歌，谷歌可能会用谷歌搜索联网查。说了什么由阿里云分析和总结（谷歌备用）。只有你打开摄像头或让 ReMi 拍照时才发画面；只有你打开「伴记带上相关记忆」时才发 3 条相关记忆的片段。结束时，没转出文字的片段会在手机上或由我们的语音转文字服务商补转。录音文件本身留在你的手机上；你在会议上点「重新分析」时，整场录音会发给谷歌。
- 眼镜： 语音指令在手机上或由语音转文字服务商转成文字；提问跟聊天一样处理；「这是什么」会把照片和你当时的地址一起发出；导航会经我们的中继把起点和终点发给谷歌地图。眼镜的麦克风用不了时，可能改用你手机自带的语音识别服务——那个服务（常见的是谷歌的）可能会处理你的声音，取决于你的手机。
- 后台整理（你记忆里的人物、地点、物品的画像）：默认只发最多 30 条相关记忆的日期和第一句；只有你打开「后台整理时让 AI 读全文」，才发每条的前 300 字。
- 手机读不了的导入文档（扫描件或加密文件）会发给谷歌提取文字。
4.3 从不发给 AI 的
- 密码本里的密码、保密备注、验证码和受保护的栏位；
- 已存证件和私密档案的内容（号码和正文）。它们的标题、类型和归属人可能在聊天里作为上下文；
- ReMi 帮你填表时你的真实信息。绿色底的内容，就是 AI 没有看到的。
发送前，ReMi 会在手机上检查要发出的文字，如果里面有你存过的密码就拦下。这个检查只管文字，不管照片和录音。
4.4 你自己选择接入的服务
- 你自己的 AI 服务商钥匙，或你自己的电脑： 你设置了才会用，ReMi 会把相关请求直接发给你选的服务商或电脑，按它们自己的条款处理。
- 你电脑上的 AI 工具（记忆接口）：要先配对，并在手机上逐个批准。密码、证件和健康信息不会给它们。
- 乐奇（Rokid）眼镜： ReMi 通过蓝牙直接跟你的眼镜通信。如果你选择经乐奇自己的 App 连接，那个 App 做的事适用乐奇的隐私政策。
5. 我们为什么处理这些数据（法律依据）
| 用途 | 依据 |
|---|
| 提供记录、整理、提醒、对话、插画日记、眼镜和同步等功能 | 履行我们和你之间的约定（用户协议） |
| 健康信息、政府证件、人脸和声音数据等敏感信息 | 你的明示同意：功能第一次用到前在 App 里单独询问；你可以随时关掉功能撤回 |
| 把内容交给境外的云端 AI 服务商 | 你的同意 + 我们与服务商之间的合同保护（第 8 节） |
| 使用统计、防滥用、用量限制和安全 | 运营、改进和保护服务的正当利益，以及法律义务 |
| 回应执法机关或法院的合法要求 | 法律义务 |
撤回同意不影响之前已经完成的处理。撤回后，依赖这项同意的功能将无法使用。
6. 存在哪里、怎么保护
- 手机上： ReMi 的数据库是加密的，钥匙保存在手机系统的安全存储里。证件、私密档案、密码，以及你记录的人的敏感信息，还会再用你主密码派生的钥匙加密一次（XChaCha20-Poly1305 加密；主密码用 Argon2id 保护）。我们没法帮你找回主密码：忘了主密码又丢了恢复码，这些加密内容就打不开了。照片、录音和其他媒体文件存在 ReMi 的私有存储空间里，其他 App 读不到，但目前还没有另外加密。
- 自动备份： 默认开启，大约每天一次。备份是加密的。一份存在 ReMi 自己的存储空间，一份存在手机「下载」目录下的「ReMi」文件夹里，卸载 ReMi 后这一份还在。设了主密码的话，换新手机时输主密码或恢复码就能恢复；没设的话，备份只能在原来这台手机上恢复。伴记和会议录音不在备份里。
- NAS 备份（可选）： 你设置了自己的 WebDAV 服务器后，ReMi 会在 Wi-Fi 下把同一份加密备份文件复制过去。
- 云备份（可选，默认关）： 需要先设主密码。数据在你的手机上先用受主密码保护的钥匙加密，再存到我们的服务器（Cloudflare R2）上，我们读不了。伴记和会议录音不包括在内。
- 你自己的设备之间： 「在电脑上用」和换新手机都在你的 Wi-Fi 里直接进行，不经过我们的服务器，需要你先在手机上同意连接。换新手机时两台手机要核对 6 位数字，数据库和文件在传输中是加密的。
- 传输： 发给我们服务器和服务商的数据都走加密连接（HTTPS / TLS）。
- 我们的服务器不保存 AI 请求的内容，服务器设置为不保存请求日志。
- ReMi 不使用安卓的系统云备份。
- 指纹 / 面容解锁用的是手机系统自己的功能，ReMi 不会为此保存你的指纹或面容数据。
- 没有系统能保证绝对安全。我们会持续检查和改进保护措施。
7. 谁会处理你的数据
我们只把数据交给代我们提供服务的处理方，并要求他们只为 ReMi 处理。
| 处理方 | 替 ReMi 做什么 | 数据所在地 | 保留多久 |
|---|
| 阿里云（百炼 Model Studio 国际站） | 文字类 AI：整理记忆、写日记、人物和地点画像、伴记的分析和总结；聊天备用 | 新加坡 | 最多 30 天；被它的内容安全系统标记的内容最长 2 年。 |
| 谷歌云（Vertex AI） | 看照片、听录音、读文档；聊天（含谷歌搜索）；伴记分段分析；插画和主题图；文字任务备用 | 谷歌的全球基础设施（请求可能在任何地区处理） | 不用于训练模型。可能缓存最多 24 小时；谷歌可能为发现滥用记录请求；谷歌搜索的查询保留最多 3 天 |
| 谷歌（Gemini API 实时） | 伴记实时模式：你的声音（以及你打开摄像头时的画面）从手机直接传过去实时转写 | 谷歌 | 按谷歌付费版 Gemini API 条款：不允许谷歌拿来改进它的产品；谷歌为发现滥用可能短期保留 |
| 谷歌地图平台 | 眼镜导航算路线（起点、终点、出行方式） | 谷歌 | 按谷歌地图平台条款 |
| Groq | 语音转文字 | 美国 | 默认不保留；为排障或查滥用记录时最多 30 天 |
| Cloudflare | 我们在 App 和 AI 服务商之间的中继（传输中经手内容但不保存）；托管我们存账号、用量计数、举报和加密云备份的服务器 | 全球网络；中继在美国中部附近运行 | 中继不保存内容；我们的记录见第 9 节 |
| Supabase | 登录和账号 | 新加坡 | 直到你删除账号 |
| 谷歌 Firebase | 正在退役的旧登录和设置服务；退役前 App 可能会去查旧账号数据 | 美国 | 随账号删除，按谷歌条款 |
| 谷歌（安卓系统和 Google Play 服务） | 谷歌账号登录；把存下的地点换成地址；下发语音模型；手机端识别组件的诊断数据 | 谷歌 | 按谷歌自己的政策 |
| 你手机的语音识别服务 | 眼镜麦克风用不了时的语音输入 | 取决于你的手机（常见是谷歌） | 按该服务商的条款 |
我们不会把你的数据卖给任何人，也不会交给广告商。
除此之外，只有以下情况我们才会披露数据：法律要求或执法机关、法院的合法要求；保护你或他人的生命安全；ReMi 的业务被合并或转让时（我们会事先告诉你）。
8. 跨境传输
我们在菲律宾运营，服务商位于美国、新加坡等国家（见第 7 节）。数据离开你所在的国家时，我们依靠和服务商之间的数据处理条款（服务商提供标准合同条款的，也包括这些条款），要求他们提供不低于你所在国法律要求的保护。
9. 存多久
| 数据 | 保留期 |
|---|
| 手机上的数据 | 直到你删除。删除的记忆和档案先进「设置 → 最近删除」，你可以恢复或立即删除；30 天后连同照片、录音彻底清除 |
| 伴记和会议录音 | 存在你的手机上，直到你删除 |
| 你的账号 | 直到你删除账号。 |
| AI 用量计数和试用记录 | 直到你删除账号 |
| 按你账号保存的使用统计 | 13 个月 |
| 合并了所有用户、不带账号的统计 | 保留 |
| 举报 | 30 天；涉及儿童性虐待的，按法律要求（目前 365 天） |
| 加密云备份 | 直到你删除账号，或请我们删除 |
| 插画批量任务的记录 | 72 小时 |
| AI 服务商那边 | 见第 7 节 |
10. 你的权利
根据你所在国家的法律（菲律宾《2012 年数据隐私法》、新加坡和马来西亚的《个人数据保护法》、汶莱《个人数据保护令》），你有权：
- 知情和查看：我们处理了你的哪些数据。你手机上的数据可以直接在 App 里看到；
- 更正：随时在 App 里修改；
- 删除：删除单条记忆，或删除整个账号（第 11 节）；
- 带走：在「设置 → 备份」里把数据导出成文件；
- 撤回同意 / 反对：在设置里关掉相关功能，或联系我们；
- 投诉：向我们投诉，或向你所在国家的监管机构投诉：菲律宾国家隐私委员会（NPC）、新加坡个人数据保护委员会（PDPC）、马来西亚个人数据保护局（JPDP）、汶莱资讯通信科技产业局（AITI）。
请发邮件到第 1 节的邮箱行使这些权利。我们会在 30 天内回复。为保护你的账号，我们可能需要先确认你的身份。
11. 删除账号
删除账号时，我们会删除：你的登录账号；AI 用量计数、试用记录和使用统计；你发过的举报；你的加密云备份。我们还会断开你配对过的电脑。如果你的账号是在旧登录服务（谷歌 Firebase）上建的，App 也会删除那里的数据。
- 涉及儿童性虐待的举报，按法律要求的期限保存，并去掉你的身份；合并了所有用户、不带账号的统计会保留。
- AI 服务商按第 7 节的期限删除它们那边的副本。
- 手机上的数据由你选：删掉这台手机上的 ReMi 数据（数据库、媒体，以及 ReMi 做的备份，包括「下载」目录里的），或者留着。想全部清除的话，删完后再卸载 ReMi。你复制到别处的副本——NAS、电脑、另一台手机——需要你自己删除。
12. 数据泄露
如果发生可能伤害你的数据泄露，我们会按法律要求通知监管机构和受影响的用户（菲律宾要求在知道后 72 小时内通知）。
13. 政策变更
政策有重要变化时，我们会在生效前在 App 里告诉你。
14. 联系我们
ReMi Memory · 菲律宾马尼拉大都会 · remi.support.app@gmail.com
ReMi Privacy Policy
Effective date: 2026-11-09 Last updated: 2026-11-09
ReMi helps you capture family and everyday life. You can save a moment with one sentence, a photo or a voice note. ReMi organizes it, reminds you, answers questions about your memories, and turns your days into an illustrated diary. ReMi can also listen along in a conversation ("BanJi") and work with Rokid smart glasses.
This policy explains what data we process, why, who processes it for us, how long it is kept, and how you can control it. It applies to the ReMi app for Android distributed through Google Play.
1. Who we are
- ReMi is published on Google Play under the developer name "ReMi Memory". The personal information controller is ReMi Memory, Metro Manila, Philippines.
- Privacy contact and Data Protection Officer: remi.support.app@gmail.com.
2. The short version
- Your memories are stored on your phone, in an encrypted database. Our sign-in provider and our servers keep your account and a few records we need to run the service, such as usage counts and the reports you send us. If you turn on cloud backup, we also keep an encrypted copy that we cannot read.
- AI features send content to cloud AI providers. To organize a memory, write your diary, answer you in chat or follow a conversation in BanJi, ReMi sends the content involved — and, to give the AI context, short excerpts of related earlier memories and the names of people you have recorded — to Alibaba Cloud or Google, which process it for us. Section 4 lists what is sent for each feature.
- Some things are never sent to AI: the passwords and secret fields in your password vault, and the contents of the IDs and documents you have saved. Their titles may be used as context (Section 4.3).
- Recording files stay on your phone. While BanJi is listening, your voice is sent to cloud AI, live or in short segments, so that it can be transcribed and understood.
- We don't sell your data, show ads, or use third-party advertising or analytics tools. We count how often a few features are used (on by default; you can turn it off), and Google components built into the app send Google diagnostic data that does not include your content.
3. What we process
3.1 Content you record
This stays on your phone unless a feature described in Section 4 sends it.
| Data | Examples |
|---|
| Notes, diary, to-dos | "Took the baby for her vaccine today" |
| Photos | Photos you take or choose, receipts, screenshots |
| Voice | Voice notes; BanJi and meeting recordings; a 12-second sample of your voice ("voiceprint"), if you record one |
| Chats with ReMi | Your questions and ReMi's answers |
| People | Names, relationships, birthdays, notes, profile photos, the face data used to recognize them, and the company and role you note for them |
| Finances | Expenses, budgets, money lent or borrowed, card names and the last 4 digits |
| Health | Things you note, such as an allergy or a check-up report |
| IDs and private documents | Photos and details of IDs, passports, contracts and bank cards — extra encryption |
| Passwords | Logins in your password vault — passwords, notes and one-time codes are extra encrypted |
| Places | Places you save, such as "home" (coordinates and address) |
| Imported documents | PDF, Word and other files you add to your knowledge base |
| Glasses | Photos your smart glasses take when you ask "who is this?" or "what is this?" |
3.2 Your account
- Sign in with Google. Google confirms who you are, and we receive your email address, name, profile photo link and an account ID. Our sign-in service is provided by Supabase. Your nickname, currency and family profile stay on your phone.
- If you don't sign in, ReMi creates an anonymous account for this installation. It has an account ID but no email address or name.
3.3 Information created automatically
- AI usage counts. For each account — identified by a one-way code, never your email — our server records which AI feature was used on which day, how many times, how much data was sent and what it cost. No content is recorded. We use this to prevent abuse and control costs.
- Usage statistics — see 3.6.
- Trial record. When you open the AI usage page, our server records which trial group your account is in and when it started.
- Local network service. Only when you turn on "Use on computer" does ReMi run a small server on your phone (with an ongoing notification) so that your own computer on the same Wi-Fi can connect to it. It announces itself on the local network with a short code and your phone's model, not your phone's name. It stays off until you turn it on again.
- Google components in the app. On-device text recognition, face detection and code scanning (Google ML Kit), and Sign in with Google, may send Google diagnostic information such as your device model, Android version, app version and performance data. They do not send your photos or text.
- Connections that carry no content. The app checks whether you are online by contacting a Google address; fetches currency exchange rates from a public service about once a day; may download its voice models from Google Play or from public model sites (Hugging Face, ModelScope, GitHub); and, only when you run a password health check, sends the first 5 characters of a one-way code (hash) of each password to the "Have I Been Pwned" service. These services can see your network address.
- We do not collect your advertising ID, contacts, call logs, SMS or browsing history. The app contains no crash-reporting or advertising tools.
3.4 Children and family members
ReMi is for adults aged 18 and over. It is not directed to children, and children should not sign up for or use ReMi on their own.
Many parents use ReMi to record their children's and family's lives, such as a child's name, age, photos, milestones and health. For this content:
- Please record only what you have the right to record. You decide what to record about your children as their parent or guardian.
- Like your other memories, it is stored mainly on your phone. It is sent to cloud AI only to provide the features you use, as described in Section 4.
- We do not build profiles of children for marketing, and we never give this content to anyone for advertising.
- If you believe we have processed a child's information we should not have, contact us (Section 1) and we will delete it.
3.5 Other people in your memories, recordings and photos
ReMi is for your personal and family life. When you record a conversation, photograph people or let ReMi recognize faces, you are also handling other people's information:
- Tell people before you record them, and record only where it is lawful. In some countries, including the Philippines, recording a private conversation without the consent of everyone in it can be a crime.
- Face recognition (for example, asking "who is this?" through your glasses) runs on your phone. Face data stays on your phone and in your own backups.
- Information about other people is sent to cloud AI only as described in Section 4.
3.6 Usage statistics ("Help improve ReMi")
- To learn which features are used, the app sends our server, at most once a day: the date, the app version, the Android major version, your trial group, and counts of a few events (opening the app, saving a record, tapping share). Our server adds your country as a two-letter code taken from the network connection. It does not store your network address.
- Against your account's one-way code, our server keeps which of your first 31 days you opened the app, the date of your first record and your start date, for 13 months.
- This is on by default. You can turn it off at any time under Settings → AI usage → "Help improve ReMi". When it is off, the app stops counting and sending. AI usage counts (3.3) continue, because they are needed to run the service.
3.7 Reports
When you report an AI reply, a diary entry, an illustration or a theme picture, ReMi sends us the kind of problem, where it happened, the text you are reporting (up to 8,000 characters — for pictures, only the kind, date and style, never the image), your note, the feature involved, and your app language and version. We use this to review the report. Reports are kept for 30 days; reports about child sexual abuse are kept longer, as the law requires.
4. What happens on your phone, what is sent to cloud AI, and why
4.1 On your phone
These run on your phone, and their results stay there:
- reading text in photos; detecting and recognizing faces; reading supported IDs (passports, Philippine PhilSys, UMID and driver's licenses, and Chinese ID cards) and blacking out ID numbers and faces before anything is sent;
- speech-to-text and reading aloud, once the voice models have been installed;
- memory search;
- reading documents you import, except scanned or protected files (see 4.2);
- recognizing people through your glasses, and the short "brief" ReMi shows about a recognized person (company and role, a preference you noted, things you promised them). The brief is sent to your glasses over Bluetooth and is read aloud only with your phone's own voice.
4.2 Sent to cloud AI
Cloud AI requests go through our relay server, hosted on Cloudflare, which forwards them to the provider (Section 7) without storing their content. Text-only tasks go to Alibaba Cloud first. Tasks with photos, audio or web search, and illustrations, go to Google.
- Saving a memory. What you entered; attached photos and audio (photos that look like an ID or a bank card are held back); short excerpts (up to 80 characters) of up to 8 related earlier memories; the names of people recognized in your photo, with short excerpts of their recent memories; titles of recent events and keywords of related tasks; allergies or conditions you have marked as important, when relevant; and, for photo memories, your family profile with your children's ages (their names are replaced with placeholders).
- Chat. Your question and today's recent conversation; your monthly budget and spending; the names and last 4 digits of the cards you have added; and, when relevant to your question, up to 5 related memories (up to 200 characters each), up to 5 matching expenses with totals, your task list, the titles and groups of matching password entries, and the titles, types and owners of matching saved documents. For text questions, Google's AI service may look things up on Google Search. Photos you send in chat go with the names of people ReMi recognizes in them. When you leave chat, the day's conversation is sent to save what matters from it.
- Diary and illustrations. The day's memories in full, and the names, relationships and notes of people who appear in them; your art style and the description of your character. Illustrations use text descriptions only, unless you choose "Use photos" — then photos of the people and pets involved may be sent (photos that look like an ID are held back). Making a cartoon character from your photo needs the same choice. Themes: the photo you upload is sent to Google.
- IDs, homework and forms. These are read on your phone first. Only if that is not enough, and you agree, is the photo sent — for IDs, with the number and face blacked out, unless you choose to send the whole image. For forms, ReMi sends only which fields need to be filled in; your real details are filled in on your phone.
- Voice notes. If the on-phone voice model is not ready or cannot handle the recording, the recording is sent to our speech-to-text provider; if that fails, it is sent to the AI that organizes the memory.
- BanJi (listening along). In live mode, your microphone audio streams directly from your phone to Google for transcription; if you have recorded a voiceprint, it is sent with short clips so the AI can tell your voice from others. In segment mode, about every 15–25 seconds of audio is sent to Google, together with the recent conversation and your voiceprint (if you recorded one), and Google may look things up on Google Search. What was said is analyzed and summarized by Alibaba Cloud, with Google as a backup. Camera pictures are sent only if you turn the camera on or ask ReMi to take a photo; 3 short excerpts of related memories only if you turn on "Use related memories in BanJi". At the end, any segments that were not transcribed are transcribed on your phone or by our speech-to-text provider. The recording file itself stays on your phone; if you tap "re-analyze" on a meeting, the whole recording is sent to Google.
- Glasses. Voice commands are transcribed on your phone or by our speech-to-text provider; questions are answered like chat; "what is this?" sends the photo with your current address; navigation sends your starting point and destination to Google Maps through our relay. If your glasses' microphone is not available, your phone's built-in speech recognition service may be used — depending on your phone, that service (often Google's) may process your voice.
- Background organizing (profiles of the people, places and things in your memories). By default, only the date and the first line of up to 30 related memories are sent; the first 300 characters of each, only if you turn on "Let AI read full text in background tidying".
- Imported documents that cannot be read on your phone (scanned or protected files) are sent to Google to extract the text.
4.3 Never sent to AI
- The passwords, secret notes, one-time codes and protected fields in your password vault.
- The details of saved IDs and private documents (numbers and contents). Their titles, types and owners may be used as context in chat.
- Your real details when ReMi helps you fill in a form. Content shown on a green background is content the AI never saw.
Before sending, ReMi checks outgoing text on your phone and blocks it if it contains a password you have saved. This check covers text, not photos or audio.
4.4 Services you choose to connect
- Your own AI provider key, or your own computer: if you set either of these up, ReMi sends the relevant requests directly to the provider or computer you chose, under its own terms.
- AI tools on your own computer (memory interface): only after you pair them and approve each one on your phone. Passwords, IDs and health information are not shared with them.
- Rokid glasses: ReMi talks to your glasses directly over Bluetooth. If you choose to connect them through Rokid's own app, Rokid's privacy policy applies to what that app does.
5. Why we process data (legal bases)
| Purpose | Basis |
|---|
| Providing recording, organizing, reminders, chat, illustrated diaries, glasses features and sync | Performing our agreement with you (Terms of Service) |
| Health information, government IDs, face and voice data, and other sensitive information | Your explicit consent, asked in the app before a feature first uses it; you can withdraw it at any time by turning the feature off |
| Sending content to cloud AI providers outside your country | Your consent, plus contractual safeguards with providers (Section 8) |
| Usage statistics, abuse prevention, usage limits and security | Our legitimate interests in running, improving and protecting the service, and legal obligations |
| Responding to lawful requests from authorities or courts | Legal obligation |
Withdrawing consent does not affect processing already done. Features that rely on that consent stop working after you withdraw it.
6. Where data is stored and how it is protected
- On your phone: ReMi's database is encrypted with a key kept in your phone's secure storage. IDs, private documents, passwords and the sensitive details of the people you record are encrypted again with a key derived from your master password (XChaCha20-Poly1305; the master password is protected with Argon2id). We cannot recover your master password: if you forget it and lose your recovery code, those encrypted items cannot be opened. Photos, recordings and other media files are kept in ReMi's private app storage, which other apps cannot read, but they are not yet separately encrypted.
- Automatic backups: on by default, about once a day. Backups are encrypted. One copy is kept in ReMi's app storage and one in a "ReMi" folder in your phone's Download folder, which remains after you uninstall ReMi. If you have a master password, you can restore a backup on a new phone with your master password or recovery code; without one, a backup can be restored only on the same phone. BanJi and meeting recordings are not included in backups.
- NAS backup (optional): if you set up your own WebDAV server, ReMi copies the same encrypted backup file to it over Wi-Fi.
- Cloud backup (optional, off by default): requires a master password. Your data is encrypted on your phone, with a key protected by your master password, before it is stored on our server (Cloudflare R2). We cannot read it. BanJi and meeting recordings are not included.
- Between your own devices: "Use on computer" and moving to a new phone work directly over your Wi-Fi, without our servers, after you approve the connection on your phone. Moving to a new phone requires matching a 6-digit code on both phones, and the database and files are encrypted in transit.
- In transit to our servers and providers, data uses encrypted connections (HTTPS/TLS).
- Our servers do not store the content of AI requests, and they are configured not to keep request logs.
- ReMi does not use Android's cloud backup.
- Fingerprint and face unlock use your phone's own system. ReMi does not store your fingerprint or face data for this.
- No system is perfectly secure. We keep reviewing and improving our safeguards.
7. Who processes your data
We share data only with processors that provide services on our behalf, and we require them to process it only for ReMi.
| Processor | What it does for ReMi | Where | How long it keeps data |
|---|
| Alibaba Cloud (Model Studio, international) | Text AI: organizing memories, diaries, profiles of people and places, BanJi analysis and summaries; backup for chat | Singapore | Up to 30 days; content flagged by its safety systems up to 2 years. |
| Google Cloud (Vertex AI) | AI for photos, audio and documents; chat, including Google Search lookups; BanJi segment analysis; illustrations and themes; backup for text tasks | Google's global infrastructure (requests may be served from any region) | Not used to train models. May be cached for up to 24 hours; Google may log prompts to detect abuse; Google Search lookups are kept for up to 3 days |
| Google (Gemini API, live) | BanJi live mode: real-time transcription of your voice (and camera pictures, if you turn the camera on), sent directly from your phone | Google | Under Google's paid Gemini API terms, which do not allow Google to use it to improve its products; Google may keep it for a limited time to detect abuse |
| Google Maps Platform | Calculating routes for glasses navigation (starting point, destination, travel mode) | Google | Under Google Maps Platform terms |
| Groq | Speech-to-text | United States | Not kept by default; if logged for reliability or abuse investigation, up to 30 days |
| Cloudflare | Our relay between the app and AI providers (it handles content in transit but does not store it); hosts our servers for accounts, usage counts, reports and encrypted cloud backups | Global network; the relay runs near the central United States | Relay: no content kept. Our records: Section 9 |
| Supabase | Sign-in and account | Singapore | Until you delete your account |
| Google Firebase | An older sign-in and settings service that we are retiring; until then, the app may contact it to check for older account data | United States | Deleted with your account, under Google's terms |
| Google (Android and Google Play services) | Sign in with Google; turning a saved place into an address; delivering voice models; diagnostics from on-device recognition components | Google | Under Google's policies |
| Your phone's speech recognition service | Voice input for glasses when the glasses' microphone is not available | Depends on your phone (often Google) | Under that provider's terms |
We never sell your data or give it to advertisers.
Beyond this, we disclose data only when the law requires it or when authorities or courts make a lawful request, to protect someone's life or safety, or if ReMi's business is merged or transferred (we will tell you beforehand).
8. International transfers
We operate from the Philippines. Our processors are in the United States, Singapore and other countries (Section 7). When data leaves your country, we rely on the processors' data processing terms (including standard contractual clauses where they offer them) to require protection at least equal to what your country's law requires.
9. How long we keep data
| Data | How long |
|---|
| Data on your phone | Until you delete it. Deleted memories and documents go to Settings → Recently deleted, where you can restore them or erase them at once; after 30 days they are permanently erased, together with their photos and recordings |
| BanJi and meeting recordings | On your phone until you delete them |
| Your account | Until you delete your account. |
| AI usage counts and trial record | Until you delete your account |
| Usage statistics kept for your account | 13 months |
| Statistics combined across all users (with no account attached) | Kept |
| Reports | 30 days; reports about child sexual abuse, as long as the law requires (currently 365 days) |
| Encrypted cloud backup | Until you delete your account, or ask us to delete it |
| Records of illustration batches | 72 hours |
| At AI providers | See Section 7 |
10. Your rights
Depending on where you live (the Philippine Data Privacy Act of 2012, the Personal Data Protection Acts of Singapore and Malaysia, and Brunei's Personal Data Protection Order), you have the right to:
- Be informed and access the data we process about you. Data on your phone is visible directly in the app.
- Correct it at any time in the app.
- Delete a single memory or your whole account (Section 11).
- Take it with you: export your data in Settings → Backup.
- Withdraw consent or object: turn the feature off in Settings, or contact us.
- Complain to us, or to your regulator: the National Privacy Commission (Philippines), the Personal Data Protection Commission (Singapore), the Personal Data Protection Department (Malaysia), or the Authority for Info-communications Technology Industry (Brunei).
Email us at the address in Section 1. We reply within 30 days. We may need to confirm your identity first, to protect your account.
11. Deleting your account
- In the app: Profile → Personal → "Delete account" (at the bottom of the page). You confirm with your phone's screen lock, sign in with Google again, and confirm. If you use ReMi without signing in, you can delete your anonymous account in the same place; you confirm with your phone's screen lock.
- Without the app: visit https://remi-account.remi-ai.workers.dev/delete, or email us from the address you sign in with.
When you delete your account, we delete your sign-in account; your AI usage counts, trial record and usage statistics; the reports you sent; and your encrypted cloud backup. We also disconnect the computers you paired. If your account was created with our older sign-in service (Google Firebase), the app also deletes the data held there.
- We keep reports about child sexual abuse for the period the law requires, with your identity removed, and statistics combined across all users, which have no account attached.
- AI providers delete their copies on the schedule in Section 7.
- On your phone, you choose whether to delete ReMi's data on this phone (the database, media and the backups ReMi made, including those in your Download folder) or keep it. To remove everything, uninstall ReMi afterwards. Copies you made elsewhere — on a NAS, on your computer or on another phone — you need to delete yourself.
12. Data breaches
If a breach could harm you, we will notify the regulator and affected users as the law requires (in the Philippines, within 72 hours of becoming aware of it).
13. Changes to this policy
We will tell you in the app before any significant change takes effect.
14. Contact
ReMi Memory · Metro Manila, Philippines · remi.support.app@gmail.com
