Freehold AI — Privacy Policy

Operator: Neil Landers. Public brand: Plainwonder. Privacy enquiries: support@plainwonderapps.com. Effective date: 2026-10-30.

What this policy covers

This policy describes the Freehold AI iPhone app and its support and legal pages on plainwonderapps.com. It does not describe an Android version or a future cloud conversation feature. If we introduce different data handling, we will update the policy before it takes effect and obtain consent where required.

The current app runs supported chat, camera analysis and speech processing on your device. It has no Freehold account or conversation-upload service. We do not receive your conversations through ordinary app use, use them to train models, or sell them. This does not prevent a copy leaving your device when you choose to export it, use a synced folder or enable device backups.

Information used on your device

• Chats and assistants: questions, transcribed text, generated replies, assistant names and instructions, language and model preferences, and voice choices are stored locally to provide conversations and restore your setup.
• Microphone: live chat processes microphone audio for on-device transcription. That live-chat path does not save an audio recording. The separate diagnostics tools can save recordings locally for repeatable tests.
• Camera: camera mode processes snapshots you take. The model temporarily reads a protected image file; the app attempts to remove it after processing and cleans up abandoned temporary camera files on a later launch. Chat thumbnails are held in memory rather than saved with conversation history. Image descriptions, questions and timestamps may remain as text in saved conversations.
• Settings and files: the app stores preferences, downloaded model and voice assets, and a permission bookmark for an export folder you choose. It may keep local archives and recovery copies so interrupted work can be recovered.
• Diagnostics: local records include timings, model identity, memory and device-state measurements, errors and test results. Private diagnostic records can include test prompts, responses, transcripts and file details. A separate shareable measurement log removes designated private fields, but technical information can remain.

Downloads and other network connections

Downloading models, voices and related resources connects to third-party hosts, including Hugging Face, GitHub's file-hosting services and delivery services they use. Those providers receive connection information such as your IP address, requested file and request timing. The download is a request for model resources, not an upload of your conversation. Apple manages the downloading and availability of its own system assets.

Following a source or licence link opens the relevant external service. Those providers apply their own privacy practices and may process information outside Australia. Their locations, retention and handling are not controlled by this policy.

The current app has no developer-operated advertising or analytics service and does not automatically upload its local diagnostic logs to us. Apple may separately process App Store, purchase, crash or device diagnostic information according to its services and your settings. This policy does not claim that no network connection or third-party processing ever occurs.

Exporting, sharing and backups

When you save a note to a folder or complete sharing to another app, a copy leaves the app's private storage. Apple Notes sharing uses the iOS share sheet: you choose Notes and confirm the destination. Notes, iCloud Drive or another synced service may upload the copy according to your settings. Folder exports can also retain a local recovery copy. Conversation sharing includes text, not camera image files.

Copying a reply places its text on this iPhone's clipboard. Freehold requests a local-only clipboard write. Pasting it into another app creates a copy governed by that app's settings.

App data may be included in iCloud or computer backups under your device settings. Deleting a local item or removing the app does not necessarily delete an existing backup, exported note or copy another person holds. Manage those copies with the relevant provider.

Retention and deletion

Optional offline search processes saved conversation text on this iPhone using a separately downloaded model. Its private search cache stores numerical representations and content hashes, not a second copy of chat text or search queries. These representations can still encode information about content and receive the same file protection as saved chats. Editing or deleting conversations invalidates their cached representations; interrupted cleanup retries when Freehold reopens. Search does not read external folders, photos or recordings in this version.

Saved chats, assistant settings, archives, diagnostic material and recovery copies may remain in app storage until removed. There is no general automatic retention deadline in the current build. Starting a new conversation keeps the previous conversation in history; it should not be used as a way to erase it.

Conversation history lets you rename or delete a saved chat. Confirmed assistant deletion removes that assistant and its saved chats. These actions remove the associated history and linked older conversation copies from this installation; interrupted cleanup retries on launch. Unreadable legacy files, separate diagnostic material, exported notes and backups may remain. Deleting the last chat or assistant leaves a fresh empty conversation so the app stays usable.

Removing a downloaded model does not delete chats made with it. Deleting the app through iOS removes its local app data; offloading the app preserves documents and data. Exported files and device backups are separate. Temporary-file cleanup is designed to remove working files, but is not a promise of secure erasure from storage or backups.

We do not hold a server copy of your local conversations to retrieve or erase on your behalf.

Security and permissions

Freehold uses iOS permission controls for the microphone, camera and selected folders. You can change permissions in iOS Settings. Saved conversations and designated private files use iOS file protection. A passcode, updated operating system and care when exporting remain important; no system can guarantee absolute security.

Visiting our website

The Plainwonder website uses Cloudflare Pages for hosting and delivery. Visiting a page sends technical information to Cloudflare, including your IP address, requested page, request time and browser information. Cloudflare processes traffic and security information to deliver the website and protect it from abuse. This is separate from the conversations stored locally in the Freehold app.

These pages contain no advertising, optional analytics, contact forms or AI chat service. Email links open your chosen email service; you decide whether to send a message. The page files do not set cookies themselves. Cloudflare may use security cookies or checks depending on the protections it applies; we do not promise that visiting the hosted site creates no cookies. Cloudflare describes these in its cookie documentation.

Provider processing can occur outside Australia. Cloudflare's handling and retention of technical traffic records are described in its privacy policy. We have not set a fixed retention period for provider-managed traffic records. Our 12-month support-email rule does not apply to those records. The website does not require a ChatGPT account or use OpenAI to process visitors' messages.

Contact, access and complaints

If you contact us, you choose what information to send. Support email and attachments are received and kept in Google's Gmail / Google Workspace service. Neil Landers is the sole human operator of the support mailbox. Avoid sending private conversations or recordings unless needed to explain the issue.

Google processes support email to provide its service and uses affiliated companies and service providers. Processing can occur outside Australia, including in the United States and other locations in Google's Workspace provider list. Our current Business Starter service does not provide a selected data-region policy; we do not promise Australian-only storage. Google's Workspace service terms and Cloud Data Processing Addendum describe its processing arrangements.

To manage retention, we keep a minimal private case register and review list on the operator's computer. These may contain email subjects, message references and dates, case status, confirmed resolution dates and necessary exception notes. They do not contain email bodies or attachment files. When used, retention-checking software runs locally and communicates directly with Gmail; it does not send customer email details to an AI service. Any notification from that process contains only aggregate counts. The operator reviews the actual messages in Gmail before approving deletion. These local records need the same access controls and cleanup as the corresponding support case.

We retain routine support correspondence for 12 months after the issue is resolved, then delete it after review. If the issue is reopened, the period starts again when it is resolved. We remove sensitive troubleshooting attachments, such as conversation exports or personal screenshots, when they are no longer needed to resolve the issue. We may retain relevant records longer where necessary to handle an unresolved complaint or dispute, or to meet a legal retention requirement; we review that need periodically. Identifying entries in the local register and review files are included in the case cleanup.

Deletion from the active mailbox is not immediate erasure of all Google copies. Gmail normally keeps deleted messages in Trash for 30 days, and Google Workspace provides a further administrator recovery period of 25 days. Google's processing terms govern deletion from its remaining systems, including applicable legal exceptions. These are different stages, not a promise that data is erased everywhere on the day of mailbox deletion. See Google's email recovery guidance.

Use support@plainwonderapps.com to ask about information we actually hold about you, request access, correction or deletion where available, or raise a privacy complaint. We will explain what information we hold and respond in accordance with applicable law. For an unresolved Australian privacy matter, the Office of the Australian Information Commissioner explains available complaint routes and eligibility.

Updates

We will identify the effective date of this policy and explain material changes through appropriate app or publication notices. Any future feature that sends conversation content to a service must be described accurately before release.