Privacy Policy
Effective date: 6 October 2026
This policy applies from its first publication. It explains information handling; it does not itself authorise AI processing.
The short version
This summary is part of the policy. Nothing below contradicts it.
Your saved Memories are stored on your iPhone. Knotembo has no accounts and does not keep an ordinary server copy of that collection. Copies you export, device backups, AI processing and support correspondence are explained below.
Knotembo does not collect or hold your Memory content in ordinary app operation. For permitted AI processing, prepared content passes transiently through Knotembo to OpenAI and the answer is returned. Eligible items can be sent automatically while AI is on, as Section 5 explains.
We do not use your Content to train AI models, and our agreement with OpenAI does not permit OpenAI to use it to develop or improve its services unless we explicitly agree — and we do not agree.
Before AI sharing, a layered check runs on your iPhone to flag possible health or identity documents for your review. Automated checks can make mistakes and may not identify every document.
We hold limited operational information, including service identifiers, subscription and allowance records, acceptance evidence, and anything you choose to send to Support. These records may be personal information. Core service records exclude Memory content; support correspondence contains what you send us.
AI processing takes place overseas on OpenAI’s global systems. Its standard abuse-monitoring retention is up to 30 days, with safety and legal exceptions that can require longer retention. Section 6 explains the locations and limits.
We do not advertise to you or sell information about you. Support, privacy requests and complaints use the web form at knotembo.com/support. If you contact Support, you provide an email address so we can reply outside the app.
You can export your Memories, delete local copies, and ask us to delete operational records. Requests are subject to the identification and retention limits in Sections 10 and 11.
1 Who we are
Knotembo is operated by Knotembo Pty Ltd (ACN 701 798 629, ABN 44 701 798 629) of 134 Clontarf St, North Balgowlah NSW 2093 (“Knotembo”, “we”, “us”). This policy explains our information practices and commitments. It does not exclude any obligation we have under the Privacy Act 1988 (Cth), the Australian Privacy Principles or other applicable law.
Our Privacy Officer can be contacted through https://www.knotembo.com/support. Select or describe a privacy request in your message. Section 13 explains the support process. Reading or acknowledging this policy does not grant permission for AI processing.
2 What Knotembo is built not to collect
The app is designed to limit the information Knotembo receives and retains:
No accounts. There is no sign-up, username, password or profile. Random service identifiers do not contain your name or contact details, but may still identify an installation or relate to a person. We do not describe them as anonymous.
No content servers. We do not operate storage for your memories. What you save lives in the app on your iPhone.
No reading of your memories by us. Knotembo staff cannot access your memories through ordinary app operations. If you choose to send information or an attachment to Support, authorised support personnel and service providers may see what you send.
No advertising, no sale of personal information, no marketing list. We have no marketing channel and therefore never ask for marketing consent.
No marketing use of your support email. We use contact details supplied to Support to respond, administer the matter and keep the limited records described in Sections 10 and 13. We do not add them to a marketing list.
No face recognition, face grouping, biometric templates, or age inference from your content.
No third-party analytics or advertising SDKs in the app. Optional product analytics is not currently operating. The essential operational monitoring described in Section 4 is separate. If optional product analytics is introduced, we will first explain it and seek a separate opt-in choice.
Content-blind usage metering. We measure how much you use, never what you save: metering records allowance quantities, not Memory content. Section 4 describes the limited service information we hold.
3 Your memories stay on your iPhone
Knotembo does not collect or hold your memory content in ordinary app operation. Your memories are stored on your iPhone. When you choose an AI feature, a minimised copy passes transiently through Knotembo solely to deliver your request to OpenAI; Knotembo does not intentionally store the request or response body. OpenAI may retain or review limited content for safety, abuse-prevention or legal reasons described in Section 6. If you choose to send content to Support, authorised support personnel and service providers may access what you send for that request and retain it only for the documented support period or as legally required.
Your local Memory collection is under your control:
We cannot recover it for you if your phone is lost or broken. Keep an export or a suitable backup of important material. Device backup and recovery depend on your device and Apple settings; we do not promise restoration of every app record or the acceptance credential.
Memories do not sync between devices at launch.
Deleting the app removes its local data. It does not remove exported copies, backups or information already sent to a recipient.
Knotembo is a private place to keep and find the things that matter to you. It is not a substitute for keeping your own backup of anything important.
4 The information we do hold
The following records support the Service. Core entitlement and acceptance records exclude Memory content. Support records contain whatever you choose to send. Acceptance evidence and Apple subscription records are deliberately kept separately, without a cross-store link.
Record
Information
Purpose
Service identifiers
Random installation and service references, and the credentials needed to authenticate particular service records. They do not embed your name or email.
Operate and authenticate the relevant service. Separate stores do not create a link between Apple subscriptions and acceptance evidence.
Entitlement and allowance
Verified Apple subscription and transaction references, trial or paid status, relevant dates, tier, period counters and grant status.
Verify access, allocate the correct period once, prevent duplicate grants, and administer allowances and remedies.
Acceptance evidence
Terms acceptances, global AI choices and withdrawals, the notice version and content fingerprint, event time, app build and locale, and a limited reference used to authenticate the event. We also retain the latest qualifying authenticated-contact record for each applicable Terms or AI authority, with its trusted service time and a limited reference supporting that contact. We replace that routine-contact record only when a later valid contact qualifies; we do not retain a full routine-contact history or infer permission from a missing contact record. Privacy-notice acknowledgements are distinct.
Apply current choices and retain limited evidence. No Memory content is included; a notice acknowledgement is not consent. Any separate retained technical permission evidence is covered by the technical-record inventory below.
Support
Name, email address, subject and message supplied through the web form. The form has no attachment field; email replies may contain what you choose to send.
Receive and respond to requests, handle complaints and remedies, and maintain the limited correspondence record.
Payment and accounting
Apple handles payment details. We receive entitlement information and Apple settlement and tax reports, not your card details.
Administer purchases and refunds and meet financial record-keeping obligations.
Technical and website records
Technical security records used to verify genuine app installations and authorise service requests, together with aggregate service-health and fixed error counts. Wix may process website-visitor technical information, including IP addresses, browser and device details, visit times, pages visited and cookie information. App technical records exclude Memory content, searches, Ask questions and AI answers.
Operate and secure the relevant services, within the verified record categories and retention periods below.
Our app backend services and core operational records are hosted by Amazon Web Services (AWS) in its Asia Pacific (Sydney) region in Australia. AI processing by OpenAI is described separately in Section 6. Wix.com Ltd., based in Israel, hosts our website and support form. Wix states that website-visitor information may be stored in the United States, Ireland, South Korea, Taiwan and Israel, and may be processed in other countries by its group companies and service providers. These disclosures cover the countries in which the relevant information is stored or accessed; support and AI arrangements are addressed separately below.
We receive information from you, your device, Apple’s subscription systems and the service providers involved in operating the app and website. We do not buy information about you from data brokers or use it for advertising profiles. Authorised personnel and contracted providers use the records only for the purposes described here, including support, accounting, security and legal obligations. Information may also be disclosed where law requires or permits it, with appropriate limits.
We use aggregate operational counts to monitor service failures and pause AI processing when needed. These counts do not include your Memory content, AI questions or answers, or user, installation or request identifiers. We also use fixed test messages containing no personal information to check service recovery; these tests do not use your allowance. These operational counts are kept separately from subscription and acceptance records.
5 Permissions come first - How AI features work
AI features are optional, off until you turn them on, and nothing is ever sent without your permission. The AI notice presented before your choice explains what can be sent, to whom, and for which uses; we ask again for certain sensitive items; and saying no never stops you saving or viewing anything.
You control AI with one overall choice. While AI is on, Knotembo can automatically send Memories you save to OpenAI for Understanding, subject to its on-device checks and your exclusions, without asking about each Memory. When you use Ask, it can send your question and relevant content from permitted Memories to OpenAI, including content sent before. Items flagged as possible health or identity documents require an item-specific choice before they can be sent. You can exclude individual Memories or turn AI off at any time. Turning AI off immediately stops this iPhone from making new submissions, including locally queued work and new retries. It does not cancel a request submitted from this iPhone before Off took effect. That request may continue through Knotembo’s AI service and may be sent to OpenAI after you turn AI off, but only as the same previously submitted request and subject to its original expiry, one-use and safety checks. Turning AI off does not extend those limits and cannot recall content already sent. The checks can make mistakes and may miss health or identity information.
For an item requiring specific permission, the notice explains that approval covers both Understanding and later Ask use of that item’s approved content. Your Ask question is separately disclosed as content sent to OpenAI. An item-specific approval does not authorise a different item or bypass another hold. Turning AI off immediately stops this iPhone from making new submissions, including locally queued work and new retries, even while confirmation with Knotembo is pending. It does not cancel a request submitted from this iPhone before Off took effect. That request may continue through Knotembo’s AI service and may be sent to OpenAI after you turn AI off, but only as the same previously submitted request and subject to its original expiry, one-use and safety checks. Turning AI off does not extend those limits and cannot recall content already sent. Turning AI on locally does not enable it until the required service records are confirmed.
The relay does not add your name, email address or a stable user identifier to the AI request for routing. This does not make the content anonymous: the Memory, your Ask question or the answer may itself identify you or another person.
6 OpenAI who processes AI requests: Where and for how long?
Who. AI requests are processed by OpenAI OpCo, LLC (United States), under a written services agreement and data processing addendum between OpenAI and Knotembo Pty Ltd.
Where. AI processing takes place on OpenAI’s global systems, including in the United States. We do not offer a country-specific processing guarantee. We treat sending personal information to OpenAI as an overseas disclosure. Your AI choice permits the processing described in the notice; it does not waive any responsibility we owe under Australian law.
Retention and review. OpenAI’s standard abuse-monitoring logs may contain inputs and outputs and are normally kept for up to 30 days. Longer retention may apply where required by law or reasonably necessary to protect its services or others from harm. Flagged content may be retained and reviewed by people, including images or files flagged as possible child sexual abuse material. Depending on the model, encrypted prompt-cache data may also be retained for up to 24 hours. Knotembo does not use Zero Data Retention and does not intentionally store request or response bodies in its relay.
Never for training. We do not use your Content to train AI models. Our AI provider’s terms with us do not permit it to use content sent through Knotembo to train its models, and we will never opt in to any programme that would.
Subprocessors and locations. OpenAI’s published API supplier locations include Australia, Brazil, Canada, Finland, France, Germany, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, the Netherlands, Norway, the Philippines, Poland, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States. Applicable locations depend on the supplier and processing or review involved; this is not a statement that every request goes to every country. The current list and processing purposes are at https://openai.com/policies/sub-processor-list/. We review provider arrangements and changes as part of our service controls.
7 The on-device health and identity check
Before AI sharing, Knotembo runs a layered check on your iPhone. It uses fixed rules and a bundled on-device text classifier to flag possible person-specific health information. A classifier flag can only add a review step — it cannot authorise or send an item. If the check cannot run reliably, the item stays on your iPhone. Automated checks can make mistakes and may not identify every health document.
Before AI processing, Knotembo uses on-device checks to flag possible health and identity documents. An item flagged as a possible health document stays on your iPhone unless you confirm that it is your own—or mark the check as wrong—and then give item-specific permission to send it to OpenAI. If you tell Knotembo that the item concerns someone else, it stays on your iPhone and cannot be sent through Knotembo’s AI feature. An item flagged as an identity document stays on your iPhone unless you give item-specific permission to send it to OpenAI. Automated checks can make mistakes and may not identify every document.
For a health hold, the app explains the relevant layer: a fixed rule matched, the on-device classifier found a possible health-information pattern, or the check could not run reliably. Where the app offers “This isn’t health information”, you can use it to correct the pending health question for that item. That action is unavailable where the classification is backed by a provider-number, IHI or DVA signal. It cannot clear an identity question or any other required check, including a check that could not complete reliably. Other checks still apply before the item can be sent.
The classifier runs on your iPhone and sends no classifier telemetry. Its result can add a hold but cannot itself authorise transmission. Item-specific permission, where required, covers Understanding and later Ask use of that item as disclosed before the choice. Permission does not override any remaining hold. A hold may leave an item available locally without an option to send it.
10 How long we keep operational records
[Placeholder text for section 8 content]
9 Law enforcement and legal requests
[Placeholder text for section 9 content]
10 Keeping records
These limits apply to the relevant record or event individually. Ordinary activity does not restart a superseded or withdrawn event’s clock. Terms and AI dormancy dates are independent. Ending an Apple subscription does not itself withdraw AI permission or end the separate Terms agreement. The periods do not shorten your consumer rights or make possession of a retained record a prerequisite to considering a complaint.
Record
Retention limit
Terms acceptance
Retained for seven years after the event is superseded or the relevant online agreement ends, subject to the earlier seven-year dormancy limit described below and any documented preservation hold. Terms dormancy is measured from the installation’s last qualifying authenticated use of a Knotembo online service. The limited recording rule below applies only while that acceptance is still operative. Returning after final dormancy expiry requires acceptance of the then-current Terms.
Global AI permission
Retained for seven years after the event is superseded or withdrawn, subject to the earlier seven-year dormancy limit described below and any documented preservation hold. AI dormancy is measured separately from the last qualifying authenticated AI request or AI-permission synchronisation. The limited recording rule below applies only while that permission is still operative. Returning after final dormancy expiry requires a fresh AI choice.
Privacy notice acknowledgement
retained for seven years from the acknowledgement event, unless subject to a documented preservation hold. A later acknowledgement does not extend an earlier event’s period.
Declined permission choices
If you decline during onboarding and do not proceed, Knotembo does not keep a server record of that choice linked to you. If you decline an optional permission while continuing to use Knotembo, we keep only the current decision state needed to apply your choice. We delete or overwrite that state within 30 days after it is replaced, the relevant Memory or feature is removed, or your relationship with Knotembo ends. Temporary technical logs are governed by the separate technical-log retention period.
Current entitlement state
While the relevant trial or paid entitlement is active, then for 90 days after its verified end. Superseded state is kept for 90 days after replacement. Limited financial records and matter-specific holds follow their separate rows.
Allowance counters and grant history
Ordinary use ends on a fixed date set when the allowance period starts and never moved by usage, help claims, restoration or later activity: for a trial allowance, 00:00 UTC on the first day of the month 12 calendar months after the trial’s UTC start month; for a paid allowance, 13 calendar months. Each period’s record expires on its own date, and records are not erased merely because a new period begins. A service-recovery award extending into a later period follows that later period’s date. Expired counters follow the deletion rule below; earlier deletion on a valid request is described in Section 11.
Service identifiers
Only while needed for the record they authenticate or support; they follow that record’s applicable limit. A standalone expired identifier is not retained to rebuild a link between separate stores.
Ordinary support
Deleted within 90 days after the request closes, unless relevant material is subject to the specific complaint, claim or legal-retention rule below.
Complaint refund or legal claim
Relevant correspondence may be retained for up to 7 years after final resolution where reasonably necessary to administer the transaction, resolve the dispute, or establish, exercise or defend legal rights. A documented hold must identify the need and be reviewed; 7 years is a maximum, not an automatic term for every refund request.
Unnecessary sensitive information
Quarantined and destroyed earlier where it is not needed for the request or necessary evidence. The ordinary support period does not justify retaining unnecessary sensitive content.
Company financial records
Apple settlement and tax reports, and other records required to explain company transactions, are retained for 7 years after the transactions covered are completed, or longer if another legal requirement applies. This does not place all entitlement or usage data on a 7-year schedule.
Operational monitoring
Short-window operational counter rows and detailed backend diagnostic logs: no more than 7 days. Aggregate monitoring and service-health metrics: up to 455 days.
Technical and website logs
Website visitor and security logs we control: 30 days from each event.
A latest-contact record supports only the applicable acceptance or permission and follows that record’s retention limit. Replacing that contact record does not restart a retention period for a superseded or withdrawn choice. Restoring, reading or reconciling records does not create permission, reactivate an expired authority or reset those periods.
Completion near the dormancy deadline
We treat an existing Terms acceptance or AI permission as dormant after seven years without the relevant verified activity described above. Qualifying activity keeps the existing acceptance or permission current if Knotembo’s systems authenticate and accept it before that deadline, using Knotembo’s trusted server time. Technical processing and recording of an accepted event may complete later: the completed record carries the original accepted time, and the next dormancy period runs from that time, not from when recording finished. A retry does not become a new instruction. Delayed completion cannot undo a withdrawal, superseding decision or final closure, recreate an authority that has been finally closed or deleted, or allow the affected connected features to run while the required record is expired or unconfirmed. It does not restart the fixed retention period for an acceptance or permission that has already been superseded or withdrawn, or for a privacy-notice acknowledgement.
While an accepted event’s recording is pending, we use the pending record only to complete or reconcile that same event for its original purpose. If the event cannot be completed, the time allowed to delete the expired record still runs from the original expiry. A hold for a complaint or legal claim preserves only the necessary evidence; it cannot keep AI permission or online access active.
Deletion after expiry
When a record reaches the end of its retention period, we stop using it for its ordinary purposes and delete it from active systems as soon as practicable, within 30 days. Any remaining backup copy is isolated from ordinary use and expires under our backup deletion schedule. If a backup is restored, expired records remain unavailable for ordinary use and are deleted again. Restored acceptance and AI-permission records remain isolated from the live authority path until we can establish which choices remain current. If later withdrawals or closure cannot reliably be established, restored records do not reactivate AI or establish current permission. AI remains unavailable until current permission is established by a fresh explicit choice through a verified authenticated process. Historical evidence keeps its original dates and retention limits. This process does not change the Memories saved locally on your iPhone. We may retain a limited record for longer where it is still needed for a specific complaint or legal claim, or where retention is required by law. We restrict that record to the relevant purpose and review the need to keep it.
The periods above are purpose limits. The limited recording process described above does not permit ordinary use of an expired record while completion is unresolved. For a row that promises deletion within a particular period, the 30-day active-system limit is not an extra period on top of that promise. Remaining backup copies of an expired or deleted record are isolated from ordinary use and expire within 30 days after that record’s applicable retention period ends or it is deleted earlier, whichever occurs first. An earlier deadline applying to all copies of a particular record still applies. Copying or restoring a backup does not restart the deadline. A preservation hold retains evidence only and does not keep a Terms or AI authority operational.
11 Access correction and deletion
You access and manage your Memories in the App and you can continue to view, manage and export your saved Memories in the app, even if your subscription has lapsed or been cancelled. Use the available local controls to correct saved information where supported or replace an item with a corrected copy. Clear All Memories or uninstalling removes the app’s local Memories. We cannot remotely access or restore your local collection. Local deletion does not remove backups, exports or copies already sent elsewhere.
Your export is not encrypted. Someone who gets the file may be able to read the information in it. You choose where to save it—keep it somewhere you trust and treat it with the same care as the documents it contains. Deleting a Memory in Knotembo does not delete copies you have exported.
You may request access to, correction of or deletion of our operational records through the App or via our website support page at https://www.knotembo.com/support. We take proportionate steps to identify and authenticate the relevant records and explain any limit. A lost acceptance credential or deleted installation may make an acceptance record impossible to authenticate; an Apple receipt does not identify that separate record. Unauthenticated records expire under Section 10. We do not turn that difficulty into rejection of a complaint on its merits. We will explain what was deleted, retained or not located, our reasons, and the available complaint route. We retain records only where required by law or reasonably needed for a purpose described in Section 10. If you ask us to delete commercial service records while your subscription continues, we delete closed history and nonessential detail and keep only the minimum current-period accounting needed to honour your remaining allowance and prevent duplicate grants; our response explains what was kept and its fixed deletion date. Because the allowance is shared across your phones, a deletion request can affect the allowance on every phone using that subscription. If you require complete erasure instead, we explain the consequences before acting: we can no longer honour that period’s remaining allowance, connected AI features stop for that period, and we will help you cancel renewal through Apple. Erasure does not affect your right to seek a remedy, and we assess any complaint without requiring the erased records.
Export copies your Memories out. Clear All Memories deletes the app’s local collection. A support request asks us to deal with operational records, subject to the limits above. Cancelling the subscription stops future renewals and deletes nothing. These are separate choices.
12 Security and if something goes wrong
Your device’s passcode and security controls help protect local Memories. Traffic between the app, the relay and OpenAI is encrypted in transit. Operational records are access-controlled. Knotembo staff cannot browse your local Memory collection through ordinary app operations. Authorised support personnel can read what you choose to send to Support. Exported archives are not encrypted by Knotembo.
We assess security incidents involving operational records, support correspondence, transient processing and provider information. Where the Notifiable Data Breaches scheme or another law requires it, we notify affected people and the relevant regulator. Whether notification is required depends on the incident, the applicable law and any effective remedial action; the absence of an ordinary server copy of your Memories does not eliminate every privacy risk.
13 Contact questions and complaints
The support menu in the Knotembo app is static and does not itself send Knotembo any information. If you choose to contact Support, you will use the web form at knotembo.com/support.
The form asks for your name, email address, a subject and a written message. Knotembo collects that information to receive, assess and respond to your request, administer any resulting complaint or refund matter, and maintain the limited support records described below. Contacting Support is voluntary. If you do not provide an email address and enough information about the issue, we may be unable to respond or resolve it.
Support correspondence takes place by email outside the app. The form does not automatically include or give Knotembo access to your Memories. Please do not include Memory content in your support request.
Privacy requests and complaints also go through https://www.knotembo.com/support. We acknowledge complaints within 7 business days, respond substantively within 14 business days, and identify who is handling them. If a final answer needs more time, our response explains why and when to expect the next update. We do not publish an email address. Support providers and locations: Knotembo PTY LTD, Sydney, Australia.
If you are not satisfied with our response to a privacy matter, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). For legal and compulsory process, our registered office is the service address: Knotembo Pty Ltd, 134 Clontarf St, North Balgowlah NSW 2093.
14 Changes to this policy
We will tell you in the app when this policy changes. Current and previous published versions are available at knotembo.com. If a change expands the purposes, recipients or processing arrangements covered by your AI permission, the app will seek a fresh choice before that expanded processing begins. Other changes to operational information handling must comply with applicable law and are explained in the updated notice. Reading or acknowledging an update is not AI consent.