Privacy Policy

Last updated: 2026-10-13

1. Who we are and what this policy covers

Fixby is operated by [Periwinkle Innovations Pvt Ltd — pending incorporation], [registered address — to be inserted] ("Fixby", "we", "us"). Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) Fixby is the "Data Fiduciary" for the personal data described here; under the GDPR and UK GDPR it is the "controller".

This policy covers the Fixby app for iPhone and iPad, the Fixby app for Android, our website (fixby.app), and the QR-code and public brand and product pages served from go.fixby.app and fixby.app/b. Where iPhone and Android behave differently, we say so, and section 9 collects the differences in one place.

Grievance officer (DPDP Act): [name and designation — to be appointed]. Contact: [dedicated grievance address — to be inserted]; until then, support@fixby.app with the subject "Privacy request".

2. What stays on your device

Fixby runs an AI model on your phone. By default, the following is created and stored on your phone and is not sent to any server. The two optional exceptions are described in section 4:

• Conversations — the questions you ask and the answers Fixby gives are produced on your phone by the on-device model. Only when that model cannot answer, and only if you allow it, is a question answered in the cloud instead (section 4); the answer is then labelled "Answered in the cloud"
• Voice recordings — speech-to-text runs on your phone and audio is never uploaded. On iPhone it uses Apple's on-device speech recognition; on Android it uses the phone's own on-device speech recogniser, which needs Android 12 or newer. On Android, the operating system (not Fixby) may download the speech-recognition language pack the recogniser needs
• Read-aloud — spoken answers and steps use your phone's built-in text-to-speech. Fixby does not send that text to a speech service. On Android, the voice comes from the text-to-speech engine chosen in your phone's settings, and Fixby does not force an offline voice: if that engine uses an online voice, the text being read aloud (answer text, never your voice) could be sent to the engine's provider under its own terms
• Chat history and maintenance history — stored locally for each appliance, and removed from the phone when you remove the appliance, sign out or delete your account
• Reminders — maintenance and warranty reminders are scheduled on the phone as local notifications
• AI model — downloaded once and run locally
• Technician summary — if you create a summary to hand to a repair professional, it is built on your phone and goes only where you send it through your phone's share sheet; Fixby does not receive it

There are two exceptions, both optional and both described in section 4: cloud answers (your typed question and matching manual passages go to our servers when the model on your phone can't answer, only after you allow it) and the per-conversation "Send this conversation to Fixby" choice. Your voice and audio are never part of either. Nothing else in this list leaves your phone for Fixby.

3. What leaves your device, why, and for how long

Account and sign-in

On iPhone you can sign in with Sign in with Apple or Google; on Android you sign in with Google. We receive and store:

• A unique, opaque user identifier from Apple or Google
• Your email address, if you choose to share it (we request only the email, not your name; Apple may give us a private relay address)
• The version and time of the Terms you accepted

We use this to create and secure your account, keep you signed in, and tie your appliances and purchases to you. An account created with Sign in with Apple can currently be opened only on iPhone.

Appliance details you enter

When you add an appliance, the details you enter are stored on our servers against your account: the appliance category, brand and model number, an optional nickname, and the purchase date, warranty length, invoice number and place of purchase you provide. If you add an appliance by scanning a manufacturer's Fixby QR code, we also record which QR code and product it came from. We use these to show your appliance list, match the right manual, and plan reminders. Please do not put anything in these fields that you would not want stored on a server.

Manual processing

When you add an appliance, your manual PDF is uploaded to our servers for processing by cloud AI models. This extracts structured data (maintenance schedules, error codes, specifications, safety warnings) that the on-device model then uses to answer your questions. Please do not upload documents that contain personal information.

• The manual's text and, where a page is a scan or contains a figure, images of those pages are sent to our AI processing providers. We currently use OpenAI; the system can also be pointed at Anthropic or NVIDIA (see section 6)
• The original PDF is kept on our servers, tied to your account, so it can be delivered back to your device (for example, to the in-app Manual viewer) without you re-uploading it. It is not shown to any other user or account
• The processed result (the "bundle": extracted text, structured data and cropped page images) is stored so we can deliver it to your device
• If someone else adds a manual with exactly the same file contents (matched by a content fingerprint), we reuse the existing bundle rather than process it again. The bundle is built from the manual, not from your account details, and is stored as a shared record separate from your account. Because a bundle can be reused for another person, please upload only manufacturers' manuals and not documents containing personal information
• Removing an appliance or deleting your account deletes your uploaded PDF (see sections 8 and 10)

Purchases

Your first appliance is free. Extra appliances are one-time in-app purchases. We never see or store your payment card details.

• iPhone: purchases are handled by the Apple App Store, which takes your payment. We store a purchase record (Apple's transaction identifiers and the product) to confirm what you are entitled to, and we receive notifications from Apple about refunds and reversals.
• Android: purchases are handled by Google Play, which takes your payment. We store a purchase record (the Google Play order identifier, the purchase token and the product). Our server sends the purchase token to Google Play to confirm the purchase, together with a one-way scrambled (hashed) form of your Fixby account ID that Google keeps attached to the purchase. We also receive refund notifications from Google Play and check Google Play's list of cancelled purchases.
• Refunds are decided by the store you bought from. When a store refunds a purchase, the appliance that purchase paid for is withdrawn from your account and removed after 30 days.

Usage and diagnostics (on by default, can be switched off)

The app sends us content-free usage and diagnostic events so we can find bugs, fix crashes, check that features work, and see which help. These events come from a closed, fixed list — there is no free-text field, so no question or answer text can be included. They cover:

• Screens and steps — which screens or tabs you use and funnel steps such as signing in, accepting the Terms, adding an appliance, processing a manual, viewing the paywall and starting, cancelling or completing a purchase (never payment details), with the appliance's internal ID
• Answer feedback — whether you tapped 👍 or 👎 on an answer, and whether a suggested fix worked
• Answer-quality signals — for example that an answer was "not covered" by the manual, how many manual references it cited, or the category of a safety refusal (never the text)
• Performance — timings, speed and memory figures for the on-device model, manual search and voice, and the model download
• Device and app diagnostics — device model, iOS or Android version, app and AI-model version, crash and error summaries, and operating-system diagnostics: on iPhone, the crash, hang and launch summaries that Apple's MetricKit provides to apps; on Android, the reasons the system last closed the app (such as a crash, "app not responding" or low memory, recorded as a type and a count only) and the phone's heat (thermal) state while the on-device AI answers
• QR scans — if you scan a manufacturer's Fixby QR code, which code and product it resolved to, and the country from your device's region setting (not your location)

These events are linked to your account's random ID and to a device identifier, so we can understand problems on a particular phone and delete the data when you delete your account. They are therefore pseudonymous, not anonymous. The device identifier is, on iPhone, Apple's "identifier for vendor" (or, if iOS does not provide one, a random ID the app creates); on Android it is always a random ID the app creates and keeps in the app's encrypted storage. It is not Apple's advertising identifier (IDFA), Android's advertising ID or Android ID, it is not shared with anyone, and we do not use it to track you across other companies' apps or websites.

This is on by default. You can turn it off any time in the app under Settings > Share usage & diagnostics. When it is off, the app stops sending these events and stops sending crash reports to Sentry (below). If you reinstall the app, or your phone resets the app's stored settings, the switch goes back to its default (on), so please check it. The switch does not cover records our servers must keep to run the service: when you buy something, our servers record the outcome of checking the purchase with the store (a result code and timing, linked to your account), and the account, purchase and shared-conversation records described elsewhere in this policy.

Crash and error reports (Sentry)

The apps and our servers send crash and error reports to Sentry, a diagnostics service. A report contains the technical error, a stack trace, the app version, device model and iOS or Android version, and a short trail of recent app events. It may also carry technical context that Sentry's software adds on its own (such as language, time zone, available memory and storage, battery state, and a random installation identifier generated by that software). We have turned off Sentry's collection of personal data in the apps and on our servers: we do not send your name, email or account ID, we do not attach screenshots, and we do not ask Sentry to record your IP address. On our servers, authentication tokens and similar secrets are stripped before a report is sent, and reports about the "send a conversation" feature never include conversation text. A small share of app launches also sends performance timings to Sentry. In the apps, Sentry is disabled when you turn off Share usage & diagnostics in Settings. Reports from the iPhone app are stored in Sentry's EU data region (Germany).

Activity logging

Fixby logs certain account actions (such as archiving and unarchiving appliances) on our servers for operational and audit purposes. These logs contain only timestamps, action types and opaque identifiers — never manual content or conversation text — and are deleted with your account. Our servers' request logs record the route, status and timing of each request with a request identifier, and not IP addresses, account details or content. Our hosting and delivery providers process IP addresses as part of carrying your connection, and our servers use your IP address, in scrambled form and for a few hours at most, only to limit abuse (never stored with a question).

Fixby QR codes and public pages

If you open a Fixby QR link or one of our public brand and product pages, we record a page view with the opaque ID of the QR code or product and a country code (derived from the request by our delivery network, or from your device's region setting when the app resolves a scan). These page views are not linked to an account. The pages set no cookies and load no third-party scripts. If you use "Ask" on a product page, your question is handled as described in section 4, and we record only that a question was asked about that product, how it ended (answered, not covered by the manual, refused for safety, or unavailable) and the country code, never the question or your IP address.

On-device AI model download

The on-device AI model (about 1.1 GB) that powers Care, Ask and Fix answers is downloaded once from Hugging Face's servers (and the content-delivery providers it uses) over your phone's own network connection. It downloads over Wi-Fi by default, and the app offers a choice to use mobile data. This download exposes your phone's IP address to Hugging Face, not to Fixby — no manual, appliance or conversation content is involved.

Camera, microphone and notifications

The camera is used only on your phone, to read QR codes; images are not stored or uploaded. On Android, QR codes are read with Google's ML Kit software built into the app: the image is processed on your phone, but Google's ML Kit software may send technical information (such as device and app details, performance and error data and a per-installation identifier) to Google for diagnostics and analytics, under Google's own terms. The microphone is used only while you hold the microphone button, for on-device speech recognition. Notifications are used only for the reminders you set up. You can withdraw any of these permissions in your phone's settings.

Fonts and this website

The apps' typefaces are bundled inside the apps; the apps make no font requests to any third party. This website serves its fonts from fixby.app itself, so no third party receives a font request when you view a page. The website sets no cookies; it stores only your light/dark theme choice in your browser's local storage. The website is delivered through Amazon Web Services (S3 and CloudFront), which process your IP address to serve pages.

4. Optional: cloud answers, and sending a conversation to Fixby

Cloud answers

Normally your question is answered by the AI model on your phone and goes nowhere. In a few situations that model can't answer, and Fixby can instead answer from the cloud:

• in the app, while the model on your phone isn't ready (for example before it has finished downloading) or on a phone that can't run it;
• in the Fixby App Clip, and in the preview you get from a printed Fixby QR code before you sign in;
• when you use "Ask" on a manufacturer's product page on our website.

Only after you choose it. In the app, a consent card appears the first time the cloud would be used, appears again if its wording or the facts it states change, and you can switch cloud answers off in Settings > Cloud answers. If you don't allow it, the app answers from the manual's own passages on your phone and sends nothing. On the website, you tick an unticked checkbox for every question you ask, with or without JavaScript; nothing is sent without it. The choice is the same on iPhone and Android.

What is sent. The question you typed, and the passages of the manual that match it. Our servers find those passages and our AI provider, OpenAI, writes a cited answer from them. Never sent: your voice or any audio (speech is turned into text on your phone, and the web and Clip are text only), your name or email, your device ID, photos or your location. We do not send your account to OpenAI. When you are signed in, our servers do know which account is asking, only so that they can apply a daily limit; they do not store the question or the answer. Our servers also use your IP address, in scrambled form and for a few hours at most, to limit abuse; it is never stored with the question.

Which manuals. In the app, the manual of an appliance on your account, whether you uploaded it or a manufacturer provided it. On the website, in the App Clip and in the preview from a printed QR code, only manuals that a manufacturer partner has licensed to Fixby, and only while that partner has switched cloud answers on; a manual that someone uploaded for themselves can never be reached from there.

How long it is kept, and what it is used for. OpenAI processes what we send it, does not use it to train its models, and deletes it within 30 days. Fixby itself does not store your question or its answer. Our servers record only a content-free usage entry for each answer (where it was asked, how it ended, the model's name, timings and token counts), with no question, no answer, no IP address and no account or device ID, and keep it with the other usage records described in section 8. We never use questions or answers to train or fine-tune any AI model.

Safety. A question about a dangerous subject (such as gas, electricity or water hazards) is answered with a fixed warning and is not sent on to OpenAI. In the app that check runs on your phone first, so the question never leaves it. On the website and in the App Clip it runs on our server, before the question reaches OpenAI, and the written answer is checked again before you see it. Answers written by AI can be wrong: check the manual page they cite.

Sending a conversation

If an answer was wrong or a fix didn't work, the app may offer "Send this conversation to Fixby" — for example after you tap 👎 or report that a fix failed. It is entirely optional and we ask for your explicit consent every time; there is no standing permission, and the app shows you exactly what will be sent before you agree. If you agree, we receive:

• Up to the last 20 messages of that conversation — the question(s) you asked and the answer(s) Fixby gave. Apart from cloud answers (above), this is the only case in which the text of your questions leaves your phone
• The IDs of the manual excerpts and the page numbers the answers used
• The appliance and manual identifier
• The app and AI-model version

We use it only to evaluate and debug Fixby's answers. We never use it to train or fine-tune any AI model, and we do not share it with anyone beyond the service providers who host our systems (listed below). It is linked to your account, kept for 180 days, and deleted sooner if you delete it yourself (Settings > Conversations you've shared) or delete your account. Voice audio, photos, location and your device ID are never part of it. Because the text is what you typed or said, please avoid putting personal details in a conversation you choose to send.

5. Why we use your data

• To provide Fixby to you — your account, appliance details, manuals and purchases (GDPR: performance of a contract; DPDP Act: you provide the data for this purpose)
• For features you choose — cloud answers (in the app until you switch them off in Settings; on the website, for each question you tick the box for), sending a conversation (each time), and the camera, microphone and notification permissions (consent, which you can withdraw)
• To keep Fixby working and safe — crash reports, content-free usage and performance events, security and abuse prevention, and improving the app (GDPR: our legitimate interests, and you can object by switching off Share usage & diagnostics; DPDP Act: for the purposes described in this policy, and you can withdraw by switching it off)
• To meet legal duties — for example keeping tax records of purchases, and responding to lawful requests from authorities

6. Who processes data for us

We use these service providers to run Fixby. They process data on our behalf and only as needed to provide their service:

• Apple — Sign in with Apple, App Store purchases, the MetricKit diagnostics framework and on-device speech recognition built into iOS
• Google — Google Sign-In, if you choose it; on Android, Google Play (which sells and processes in-app purchases and with which we confirm each purchase), Google Play services, and Google's ML Kit software that reads QR codes in the Android app
• Fly.io — hosts our API, worker and database in Singapore. Cloud-answer questions pass through our API servers there while they are being answered, and are not stored. It also provides object storage (operated by Tigris Data, Inc.) where uploaded manuals, processed bundles and database backups are kept
• Upstash — a job queue for manual processing; it holds internal job identifiers, not manual content
• AI processing providers — OpenAI is our current provider for one-time manual processing (manual text and page images) and, only when you allow it, for writing cloud answers from your typed question and the matching manual passages (section 4). Cloud answers use OpenAI only. For manual processing our system can also be configured to use Anthropic or NVIDIA (NIM); we will update this page if we switch to or add one. We use their business API products, whose published terms say API inputs are not used to train their models; they may keep inputs for a limited time for abuse monitoring, and for cloud answers that is currently up to 30 days, after which they are deleted
• Sentry — crash and error diagnostics (see above)
• Hugging Face — serves the one-time on-device AI model download
• Amazon Web Services — hosts and delivers this website and Fixby's public brand and product pages (S3, CloudFront)
• Better Stack — uptime monitoring. It only checks our public web addresses and receives no user data

We may also disclose information where the law requires it or to protect people from harm, and if Fixby is reorganised or transferred to another company, in which case this policy would continue to apply to the data.

7. International transfers

Fixby's servers and database are in Singapore, our manual storage, AI processing providers (including OpenAI for cloud answers), website delivery and some other providers involve the United States, and iPhone crash reports are stored in Germany. Your data is therefore processed in countries other than your own, including India, Singapore, the United States and Germany. By using Fixby you understand your data will be transferred to and processed in those countries. We rely on contractual commitments from our providers and the safeguards described in this policy.

8. Data retention

On-device data stays on your phone until you delete it (by removing an appliance, signing out or deleting your account). Server-side data:

• Account data — kept while your account is active; deleted when you delete your account in the app (or within 30 days if you ask by email)
• Appliance details — kept while the appliance is registered. Appliances you start but never finish (no manual added) are removed after about 24 hours, and archived appliances are deleted 7 days after archiving (unarchiving within the 7 days cancels the deletion)
• Manual PDFs — kept while the appliance is registered, then deleted when you remove the appliance or delete your account (unless another account has registered the identical file, in which case it is deleted when that one is removed too). The PDF of an appliance withdrawn after a store refund is deleted with it after 30 days
• Manual bundles and processing files — kept as long as at least one account still has that manual registered. Once none does, an automatic clean-up that runs hourly deletes them, so in practice they are gone within about an hour
• Conversations you chose to send — 180 days, or until you delete them or your account if sooner
• Cloud answers (your question and the matching manual passages) — not stored by Fixby. Our AI provider (OpenAI) deletes what it received within 30 days. Fixby keeps only the content-free usage entry described in section 4, with the other usage records below. The abuse-limit counters (scrambled network address, and for signed-in use a scrambled account ID) expire after a few hours, or a few days at most
• Purchase records — the store's order or transaction identifiers (and, on Android, the purchase token) and the product, kept as required by applicable tax and financial rules [retention period — to be confirmed], and separated from your account when you delete it
• Usage and diagnostic events (including the cloud-answer entries, which carry no account or device ID) — raw events are kept for 13 months, after which only aggregated daily totals remain, which are not linked to any account, appliance or device. When you delete your account, your remaining events are disconnected from your account, appliances and device so they can no longer be traced back to you, and your device record is deleted
• Crash reports (Sentry) — kept for the retention period of our Sentry plan (currently 90 days)
• Database backups — our database is backed up continuously with a recovery window of 7 days, so data you deleted can remain in a backup for up to about 7 days before it ages out

9. iPhone and Android: where they differ

iPhone (iOS)

• Sign in with Apple or Google; purchases through the Apple App Store
• Diagnostics from Apple's MetricKit; device identifier is Apple's identifier for vendor (or a random ID)
• Crash reports go to Sentry's EU data region (Germany)
• Speech recognition uses Apple's on-device recognition; read-aloud uses Apple's built-in text-to-speech
• Backups: your downloaded AI model, processed manuals and manual PDFs are excluded from iCloud and device backups, but your local chat history and maintenance history are part of your iPhone's normal backup. If you restore an iPhone from a backup, that history comes with it

Android

• Google sign-in only (there is no Sign in with Apple on Android); purchases through Google Play, and Google Play services provides sign-in and billing
• Diagnostics from Android's own exit reasons and thermal state; the device identifier is always a random ID created by the app, never your Android ID or advertising ID
• Google's ML Kit software reads QR codes (see section 3)
• Speech recognition needs Android 12 or newer and uses the phone's on-device recogniser; read-aloud uses the phone's selected text-to-speech engine (see section 2)
• Backups: Fixby turns off Android's cloud backup and phone-to-phone transfer for all of its own data. Your conversations, chat and maintenance history, downloaded manuals and sign-in are not copied to Google Drive or to a new phone; on a new phone you sign in again, the app downloads what it needs again, and your old chat history does not come with you

10. Account deletion

You can delete your account at any time from Settings > Account > Delete Account in the app. If you cannot access the app, email support@fixby.app from the email address associated with your account. When you delete your account in the app:

• On our servers, your account, appliances, uploaded manual PDFs (subject to the shared-file note in section 8), entitlement record, activity log, device record and any conversations you sent us are deleted straight away
• Your purchase records are kept for tax and financial reasons but separated from your account, and your remaining usage events are disconnected from you (section 8)
• The shared processed bundle of a manual, and its processing files, are deleted by the hourly clean-up once no account has that manual registered
• On your phone, the app removes your local data (chat and maintenance history, downloaded manuals and bundles, scheduled reminders). It does not remove the downloaded AI model, which is not personal data and saves you downloading it again
• Crash reports already held by Sentry and data in database backups age out as described in section 8

See our account deletion page for the same information in step-by-step form. Account deletion is permanent. Deleting your account does not cancel or refund store purchases; contact Apple or Google for that.

11. Your rights

You can ask us to give you a copy of the personal data we hold about you, to correct it, or to delete it, and you can withdraw your consent to usage & diagnostics at any time in Settings (your consent to cloud answers by switching them off in Settings, or by not ticking the box on the website; and your consent to a shared conversation simply by not sending it, or by deleting it later). Because most of your data is on your own phone, much of this you can do yourself in the app: delete a shared conversation, remove an appliance, switch off diagnostics, or delete your account. For anything else, email support@fixby.app with the subject "Privacy request" from the email address on your account; we will respond within 30 days.

• If you are in India, under the Digital Personal Data Protection Act, 2023 you have the right to access information about your personal data, to have it corrected, completed and updated, to have it erased, to nominate another person to exercise your rights if you die or become incapacitated, and to have your grievances addressed. Contact our grievance officer (section 1) first; if you are not satisfied with our response you may complain to the Data Protection Board of India. If a personal data breach affects you, we will tell you and the Board as the law requires.
• If you are in the European Economic Area, the United Kingdom or a similar jurisdiction, you also have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to your local data-protection authority.
• If you are in California or another US state with a privacy law, you may ask what personal data we hold, ask us to correct or delete it, and you will not be treated differently for doing so. We do not sell or share personal data for advertising.

12. What we do not do

• We do not sell, rent, or share your personal data with third parties for their own purposes
• We do not serve advertisements
• We do not track you across other companies' apps or websites, and we do not use Apple's advertising identifier (IDFA) or Android's advertising ID
• We do not use third-party advertising or marketing SDKs. The third-party software that receives data from the apps is Sentry (crash diagnostics) and, on Android, Google's ML Kit and Google Play services (QR reading, sign-in and purchases), as described above
• We do not collect your location, contacts, photos, or browsing history
• We do not use your conversations, questions, manuals, or usage data to train or fine-tune AI models, and our AI provider does not train its models on what we send it

13. Children's privacy

Fixby is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the app or by email, and if a change needs your consent we will ask for it again. Continued use of Fixby after a change you have been told about constitutes acceptance of the updated policy.

15. Contact

If you have questions about this privacy policy or your data, or want to exercise any right above, contact us at support@fixby.app, or our grievance officer as described in section 1.