Sepamo Privacy Policy

Effective date: 7 October 2026

Sepamo is a personal planning app for Android made by Eetu Halonen (“we”, “us”), an individual developer based in Finland and the data controller for the processing described here under the EU General Data Protection Regulation (GDPR). This policy explains what data Sepamo reads, what stays on your device, what is stored in your account, what is sent to third parties and why, and what control and rights you have. It applies to the Sepamo Android app distributed on Google Play.

Sepamo has no analytics, no ads, and no tracking. You can use Sepamo without an account. Creating one — with an email address and password, or your Google account — lets you back up and sync your plans and keep using the AI once this device’s free allowance is spent. Either way the app talks to a backend that we operate — the open-source Supabase server software, which we self-host on a virtual server we rent from UpCloud in the European Union (Finland). That backend signs you in, routes Sepamo’s AI, map, weather, and place requests to their providers (so third-party API keys are never shipped in the app), and, if you have an account, backs up and synchronises your plans across your devices. Nothing reaches it until you have chosen to use online features, and you can keep Sepamo fully local instead (see Choosing what leaves your device).

The short version

• You can use Sepamo without an account. Your plans then stay on this device only, and the backend knows the app only by a random guest identifier and a one-way hash of the device’s Android ID, which is used for one thing: giving each device its small free AI allowance once (see Using Sepamo without an account).
• If you create an account, you sign in with an email address and password, or with your Google account if you prefer.
• With an account, your plans, plan history, and planner conversations are stored on your device and backed up to your Sepamo account on our backend, so they sync across the devices where you sign in.
• When you use the AI planner, the text of your conversation — and any device data you have allowed the planner to read (calendar events, screen-time statistics, contact names, the list of apps and home-screen widgets you have installed, the names of your paired Bluetooth devices, approximate location for place search, your saved plans, clipboard text if you switch that on, attached photos) — is sent through our backend to Entrim, which runs the planner. Voice you dictate is transcribed by Mistral AI. You choose, item by item, which of these the AI may see.
• You can delete your account and all its data at any time (see Storage, retention, and deletion), and revoke any permission whenever you like.
• You decide what leaves your phone. The first time you open Sepamo you choose between online features and fully local mode, and nothing is sent before you choose. In fully local mode no data leaves your device at all. Each online service can also be switched off on its own in Settings › Online services.

Data Sepamo reads, and where it goes

Data that never leaves your device

Choosing what leaves your device

Nothing is sent anywhere until you have answered the first screen Sepamo shows: use online features, or keep Sepamo fully local. Fully local means no data leaves your device for any reason — no account, sync, AI, maps, weather or update checks — while your plans, cards and everything evaluated on the device keep working.

You can change your mind at any time in Settings › Online services, which has the same big switch (Keep everything on this phone) and one switch per online service, each naming who receives the data:

A switched-off service is blocked inside the app, not just hidden: its requests are refused before they leave the device. Plans that need a switched-off service pause and say which switch they need, and turning one on from there first shows who will receive the data. If you installed Sepamo before this choice existed, every service starts switched on, as before.

Using Sepamo without an account

Without an account, everything you make in Sepamo stays on your device; nothing is backed up or synced. To route map, weather, place, and AI requests, the app still needs to identify itself to our backend, so the first time it does, the backend creates an anonymous guest identifier (a random ID with no email, name, or password attached). It is used, like an account identifier, as the key for rate limits and the usage metadata described below.

Each device gets a small free AI allowance (worth about €0.50) to try the AI with before an account and a Basic or Pro plan are needed. So that this allowance is given once per device — and not again after every reinstall — the app sends a one-way hash of the device’s Android ID with its AI requests. The Android ID is a number Android gives each app on each device; the app salts and hashes it before sending, so the value we receive cannot be turned back into the Android ID or matched with identifiers other apps see. We store that hash with how much of the allowance has been used, and nothing else about the device.

If you later create an account on the same device, what you made as a guest is backed up to it, and whatever is left of the device’s allowance stays usable.

Data stored in your Sepamo account (our backend)

To sign you in, back up your work, and keep it in sync across your devices, the following is stored on our backend — the self-hosted Supabase software running on our UpCloud server in the EU (Finland) — over encrypted connections (HTTPS):

• Your email address, and — if you sign in with a password — a salted hash of that password (we never store the password itself). Used to authenticate you.
• If you sign in with Google, the details your Google account releases to us when you do: your email address, your name, a link to your profile picture, and the identifier Google uses for you. Used to recognise you on each sign-in.
• Your account identifier (a random ID), used as the key for your data and for rate-limiting.
• Your plans and plan history — the plans you create, edit, and archive.
• Your planner conversations — your saved chats with the AI planner.
• A little app state — for example which cards you have minimised on your home screen, so your devices agree on how the app looks.
• Usage metadata — a per-request record of which backend service was called (AI, maps, weather) and when, and for AI calls which model answered, how many tokens it used, what that cost, how long it took and whether it succeeded. Used only to enforce fair-use rate limits and the AI cost budget and to keep the service healthy. No content is stored in this log, and it is tied to your account for three days only (see Retention).
• Reports you file — if you use the Report action on an AI response, the text you reported and any note you wrote are stored so we can look at them.
• Feedback you send — if you use Send feedback in Settings, your message, the reply address you gave, and your app version and device model are stored so we can reproduce what you described. Feedback is also emailed to us so we act on it.
• Your subscription record — if you subscribe to Basic or Pro through Google Play, we store which plan you are on, the Play product name, when it expires or renews, whether it auto-renews, and the opaque purchase token Google issues for the purchase. The token is what lets us ask Google whether the purchase is still valid; it contains no payment details. We never see your payment method, card number, billing address, or invoice — Google holds those as the seller (see Subscriptions and Google Play below).

This data stays in your account until you delete it or delete your account (see below). It is not sold, not used for advertising, and not shared except with the processors named below when a feature you use requires it.

Signing in with Google

Signing in with Google is optional — the email-and-password route needs no Google account at all. If you do choose it, your device asks Google (Google Ireland Limited for users in the EEA, Google LLC elsewhere) to confirm who you are, so Google learns that you signed in to Sepamo and when. Google hands us a signed token containing the details listed above, which we exchange for a Sepamo session; we never see your Google password, and we ask Google for nothing beyond your basic profile. Google’s own handling of that sign-in is covered by the Google Privacy Policy. If you would rather Google not know you use Sepamo, sign up with an email address and password instead.

Subscriptions and Google Play

Paid plans are sold through Google Play (Google Ireland Limited for users in the EEA, Google LLC elsewhere). Google is the seller of record and an independent controller for the purchase: it collects your payment, issues the receipt, applies its refund policy, and handles the purchase data under the Google Privacy Policy. What Google shares with us is limited to the purchase token and the state of the subscription (active, cancelled, expired, in grace period, and its expiry date), which our backend fetches from Google’s Play Developer API to confirm a purchase and to re-check it when the app opens. We use it for nothing else. The Free plan involves no purchase and sends nothing to Google beyond what the Play Store itself does to distribute the app.

Data sent to our AI providers when you use AI features

Sepamo’s AI features are handled by two processors, both established in the EU, each over encrypted connections (HTTPS/WSS) and only when you use the feature:

• Entrim (E3M d.o.o., Slovenia) runs every text-generating AI feature on servers it operates itself in Slovenia: the AI planner — the model that reads your request and writes your plan — the app’s occasional suggestions, flashcard decks, and the background checks a plan can wait on (“tell me when X happens”). The model is GLM-5.3 Flash by Z.ai, an openly released model that Entrim hosts itself, so nothing is sent to Z.ai. Entrim does not store this content beyond a short-lived cache that expires automatically, and does not use it to train models.
• Mistral AI (Mistral AI SAS, France) transcribes your voice dictation, extracts text from photos you attach (OCR), and runs the web searches the planner, flashcard decks and background checks make.

The following is sent, to the provider noted, so each feature can work:

• Your planner conversations — the messages you type or dictate, and attached photos — go to Entrim to generate your plan. Attached photos are also sent to Mistral AI to extract their text (OCR).
• Voice audio — while you dictate, audio is streamed to Mistral AI for transcription; the resulting text goes to the planner.
• Your saved plans (names and steps) — to Entrim, when the planner looks up a plan you already have, so it can change that plan or avoid making a duplicate of it.
• Calendar events (titles, times, locations) — to Entrim, only when the planner needs your schedule for a request and you have granted calendar access.
• Screen-time statistics (top apps and duration) — to Entrim, only for screen-time related requests, with app-usage access granted.
• Contact names — to Entrim, when you ask for a plan involving a person. Phone numbers and email addresses are replaced with anonymous tokens and are not sent.
• Approximate location — to Entrim, when the planner searches for places near you.
• The list of apps you have installed (label, package name, category) — to Entrim, so a plan can reference an app that is really on your phone rather than one the model guessed at.
• The names of your home-screen widgets and of your paired Bluetooth devices — to Entrim, only when a plan needs to embed a widget or react to a device connecting, so it uses a name that really exists rather than a guess.
• Clipboard text — to Entrim, only when you refer to something you copied, and only if you have turned clipboard access on. This is off by default; the switch is in Settings › Online services › What the AI can see. With it off, Sepamo never reads your clipboard.
• Web search queries derived from your request — run by Mistral AI’s web search when the planner searches the web.
• The topic of a flashcard deck you ask the planner to make (“I want to learn X”) — to Entrim, which writes the deck, grounded with a web search.
• A short description of a pattern the app noticed (for example a plan name you keep following through on) — to Entrim, used to word the occasional suggestion, and only while suggestions are switched on.
• The question a waiting step is watching for (the text you wrote, for example “when the tickets go on sale”) — to Entrim, which re-checks it with a web search on a schedule until it comes true, and only while such a step is active.

See Entrim’s privacy policy and Mistral AI’s privacy policy for their handling. We do not send health data, passwords, phone numbers, email addresses, or files from your device.

Place search and travel times additionally send the place text you asked about (and, for nearby search or a route, the coordinates involved) to Geoapify to look up locations and routes; see Geoapify’s privacy policy. Map tiles come from our own backend, from OpenStreetMap-based map data we host on UpCloud in Finland, so viewing a map reaches no third party. Weather lookups send approximate coordinates to Open-Meteo. Nearby-place lookups (a plan step “near a café”) and the train/boat detection behind the activity condition are answered by our own backend from a copy of the open Overture Maps dataset that we host ourselves; those coordinates never leave our infrastructure.

Legal bases (EU GDPR)

We process your data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and authenticating your account; backing up and syncing your plans, plan history, and planner conversations; fulfilling the AI, map, weather, and place requests you make in the app; and recording and verifying your subscription so the plan you paid for is the plan you get.
• Consent (Art. 6(1)(a)): sending device data (calendar events, contact names, screen-time statistics, installed apps and widgets, paired Bluetooth device names, location, saved plans, clipboard text, photos, voice audio) to the AI. Consent is asked in the app, via a disclosure shown before your first use of the AI — nothing in these categories is transmitted before you accept it. The disclosure lists each kind of data with what it is for and who receives it, each with its own checkbox, so you can agree to some and not others; anything you untick is never read for the AI. Most categories also sit behind an Android permission you grant and can revoke at any time. Clipboard access has no Android permission of its own, so it is off until you tick it. You can withdraw consent at any time, for any category, by unticking it in Settings › Online services › What the AI can see, by turning suggestions off, or by revoking the relevant permission; withdrawal does not affect processing that already took place.
• Legitimate interests (Art. 6(1)(f)): the usage-metadata log described above, kept solely to enforce fair-use rate limits and the AI cost budget, prevent abuse of our backend, and notice when the service is unhealthy. No content is stored in it. The same basis covers the guest identifier and the hashed device ID described under Using Sepamo without an account: they let you use Sepamo without giving us any contact details, while keeping the free AI allowance to one per device so it can be offered at all.

Your rights (EU GDPR)

You have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data (delete individual items in the app, or delete your account and everything in it; without an account, see Storage, retention, and deletion);
• Receive a copy of the data you have provided in a machine-readable format (data portability) — you can do this yourself at any time, without asking us, from Settings → Export my data;
• Restrict or object to processing based on legitimate interests;
• Withdraw consent at any time (see Legal bases above).

To exercise any of these rights, email help@sepamo.com; we will respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority — in Finland, the Data Protection Ombudsman (tietosuoja.fi) — or with the authority of your own EU/EEA country.

Where your data is processed (international transfers)

Your account and synced data live on our backend, which we self-host on an UpCloud virtual server in Finland (European Union). UpCloud Ltd (Helsinki, Finland) operates that infrastructure as our hosting provider; the Supabase software running on it is operated by us, not by Supabase, Inc., which receives none of your data. Entrim (E3M d.o.o.) is established in Slovenia and runs the AI on its own servers there; Mistral AI SAS is established in France. Your account data, backups, and all AI processing therefore stay within the EU/EEA.

Maps stay in the EU too: place search and travel times go to Geoapify GmbH, established in Germany, and map tiles come from map data we host on UpCloud in Finland. Weather (Open-Meteo) lookups receive only approximate coordinates, with no account identifier attached. Nearby-place and transport-context lookups are served from map data we host on UpCloud in Finland and reach no third party.

A website preview you add is loaded directly from that website, which may be hosted anywhere in the world; that is a normal web request between your device and the site, as in a browser, and involves us not at all. In fully local mode, or with Website previews switched off, no such request is made.

If you sign in with Google, that sign-in is handled by Google Ireland Limited (Dublin, Ireland) for users in the EEA, under the European Commission’s Standard Contractual Clauses where Google moves data to the United States. Choosing the email-and-password route avoids that transfer entirely.

Storage, retention, and deletion

Your Sepamo data lives in two places: on your device, and in your account on our backend (for the categories listed above). Both are retained until you delete them:

• Deleting a plan or conversation in the app removes it from your device and marks it deleted in your account, so the deletion propagates to your other devices.
• Deleting your account removes your account and all data associated with it from our backend (your sign-in details, plans, plan history, conversations, app state, any reports or feedback you sent, and usage metadata). Deleting it in the app also asks whether the plans, plan history and conversations on that device stay there (without an account) or are removed too; neither answer is preselected. Deletion is immediate and permanent. You can delete your account in any of three ways:
  • In the app: open Settings → Delete account.
  • On the web: sign in at sepamo.com/delete-account — no need to have the app installed.
  • By email: write to help@sepamo.com from the address you registered with, and we will delete it within one month (usually much sooner).
• Uninstalling Sepamo removes all data stored locally on that device, but does not by itself delete your account; use one of the deletion options above to remove the backend copy.
• Without an account, your plans and conversations exist only on your device, so deleting them in the app, clearing Sepamo’s storage, or uninstalling it removes them for good. The guest identifier and hashed device ID are deleted automatically as described below. They carry no name or contact details, so we usually cannot tell from an email which ones are yours (Article 11 GDPR); if you want them deleted sooner, write to help@sepamo.com and we will tell you what we need to find them.
• Usage metadata has its own clock: it is tied to your account for three days, after which the account identifier is removed from it; the anonymised per-call records (model, tokens, cost, latency, outcome) are kept for thirty days and then deleted.
• Guest identifiers that have not been used for 90 days are deleted, together with everything keyed to them. One that turns into an account when you sign up is replaced by your account.
• The hashed device ID and the record of how much of the free AI allowance that device has used are deleted 12 months after the allowance was last used. They are deliberately not deleted with an account: the point of the record is that the allowance belongs to the device.

Data sent to Entrim, Mistral AI, Geoapify, or Open-Meteo is retained by those providers under their own policies; deleting your Sepamo account does not delete data already processed by them.

Your controls

• Every device permission (calendar, location, contacts, microphone, app usage, notifications, physical activity, phone state, nearby devices, Do Not Disturb access, display over other apps, exact alarms) is optional and requested only when a feature needs it. Denying a permission disables only that feature.
• What the AI can see: each kind of data the AI can be given has its own switch under Settings › Online services › What the AI can see. Anything switched off there is never read for the AI, whatever Android permissions you have granted.
• Online services: every online service has its own switch under Settings › Online services, and Keep everything on this phone stops all of them at once (see Choosing what leaves your device).
• Suggestions can be disabled in Sepamo’s settings; with them off, nothing derived from your app usage is sent anywhere.
• You can delete your account and all its data at any time — in the app (Settings → Delete account), on the web, or by email (see Storage, retention, and deletion above) — and exercise any of the rights listed under Your rights by email.

Children

Sepamo is for people aged 16 and over. Creating an account requires confirming that you are at least 16 — and so does using the AI without an account, at the point you agree to what it sends — and we do not knowingly collect data from anyone younger.

Why 16 and not 13: Sepamo relies on your consent to send device data to the AI planner, and under Article 8 GDPR a child’s consent to an online service is only valid from the age of digital consent, which each EU country sets somewhere between 13 and 16. Rather than apply a different rule in each country, Sepamo uses the highest of them everywhere.

If you believe a child under 16 has created an account, email help@sepamo.com and we will delete it.

Changes

If this policy changes, the updated version will be posted at this address and the effective date updated. Material changes will be highlighted in the app.

Automated processing and AI

Sepamo uses an AI model to write plans, flashcard decks you ask for, to word its occasional suggestions, and to run background checks. Two things follow that you should know:

• We make no automated decisions with legal or similarly significant effects about you (Art. 22 GDPR). Nothing Sepamo generates is applied without you choosing to accept it.
• AI-written text is marked as such — visibly, wherever it is not obvious from the context that a model wrote it, and as a machine-readable marker in the data you export. This is our transparency obligation under Article 50 of the EU AI Act.

The suggestions feature looks for patterns in how you use your phone in order to offer a plan. That is profiling in the GDPR’s sense, so it is optional: turn Suggestions off in Settings and nothing derived from your usage is computed or sent. You may also object to it, or to any processing we base on legitimate interests, by emailing us.

Terms

Your use of Sepamo is also governed by our Terms of Service, which cover what Sepamo is, what you may not use it for, how to report AI-generated content, and your rights as a consumer.

Contact

Questions or requests about your data, including account deletion: help@sepamo.com

That address is also our point of contact under Articles 11 and 12 of the EU Digital Services Act. Our full trader details, including postal address, are in the imprint.