Your information.
Your choices.

Who is responsible

ishumilin is responsible for the app processing described in this notice. For privacy questions or requests about your information, contact bliss@shumil.in.

Your assistant mode

In Private mode, speech recognition, the assistant, voice generation and supported timer functions run on your device. You do not need an account. Conversation text stays in the current session rather than being saved to cloud history. Required models must be downloaded first. A missing model or unsupported device or language does not send the request to a cloud assistant instead.

Private mode blocks ordinary assistant and account connections, connected services, cloud history, photo analysis and ambient uploads. Downloads you start still contact the model host, which receives the request and network information such as your IP address. A download already started can finish after a mode change. Separately enabled diagnostics and message sharing are described below.

Online mode requires sign-in and the necessary provider configuration. Requests go through the Bliss server to the selected services. They can include your question, conversation context, tool results and, when you use those features, audio or a photo. Online features can save history and settings to your account.

Custom mode lets you configure assistant, speech and voice providers separately. Choosing an on-device assistant in Custom does not turn off every account or connected feature. Local transcription also does not keep a cloud conversation local: recognised text still goes to the selected assistant. Server transcription after a local recognition failure requires the separate Allow server transcription fallback setting, which defaults off and is unavailable in Private.

Information used by connected features

Bliss processes information to answer requests, carry out the actions you choose, keep your saved information available and operate the service. The information depends on the features you use.

• Account and preferences: sign-in identifiers, saved settings, language choices and paired-device records.
• Conversations and memory: messages, answers, facts you save, reminders, lists and information used to retrieve relevant context.
• Connected services: calendar events, contacts, email and other tool inputs or results needed for the requested connection. Content retrieved by a tool can become part of the context sent to your selected AI provider.
• Voice and images: microphone audio for voice features and photos you choose or take for a request. The processing route depends on the selected mode and providers.
• Optional context: location and device-context information when those features and the required operating-system permissions are enabled. Location tracking, device-context collection and ambient capture default off.
• Delivery and operation: device and push identifiers needed for notifications, plus technical records used to authenticate requests, protect the service and diagnose failures. Apple or Google handles notification delivery for its platform.

Listening, paired devices and phone calls

Microphone access is controlled by the operating system and the listening settings you choose. Optional ambient capture can send speech for processing and retain transcripts and derived memory on the server. It is separate from an ordinary voice request and is blocked in Private mode. On-device speaker matching supplies speaker or owner hints rather than uploading the stored voice template.

Paired wall devices have their own controls. A wall camera defaults off and, when enabled, supplies a still image only for a request that invokes the camera. Turning off a listening light does not mute a microphone.

If you use the connected phone-answering service, it keeps call messages and transcripts for the line's account. Audio recording defaults off. When recording is enabled, callers are offered a recording choice before audio is saved. Declining recording can still leave a transcript.

Credentials and saved information

Current mobile versions keep provider keys and calendar, contacts and email credentials in the device's protected storage. Online and Custom connections supply credentials to the authenticated server session when needed. Removing a connection or ending that session stops its temporary use. Account settings and indexed content are separate from the credentials used to obtain them.

Older versions stored encrypted integration credentials on the server. Those older copies are removed when the connection is migrated or removed; changing modes alone does not remove them. The phone-answering gateway has its own server-managed credentials.

Cloud features can keep history, memory, lists, reminders, settings and enabled integration or context records under your account. Closing the app or selecting Private does not erase previously saved cloud information. Downloaded models and device preferences also remain until removed through the relevant controls.

Optional error reports and performance sharing

Mobile error reporting is off unless you enable it. When configured and enabled, Sentry and an optional GlitchTip mirror receive filtered JavaScript error reports. These include classified errors, app and device versions, event codes and bounded diagnostic measurements. Conversation text, audio, provider credentials, request addresses and raw log messages are excluded. This switch does not enable automatic native crash reporting, session tracking or performance profiling.

Performance diagnostics have a separate choice that also defaults off. They can send timings, model identifiers, token counts, tool outcomes and account or session identifiers through the Bliss server to Langfuse. This requires a previously signed-in account and can operate in Private mode without enabling ordinary cloud assistant features.

Share messages and replies is a further, separate choice, off by default. It requires performance sharing and permits new local user messages and final assistant replies to be shared to improve on-device answers. These can contain personal information. Each field is limited to 4,000 characters. Recordings, system prompts, tool arguments and intermediate output are excluded, and previous history is not uploaded retrospectively.

Turning sharing off discards pending reports and stops new reports under that consent. It cannot recall information already received. Changing assistant mode does not change your diagnostic choices. Wall-device performance sharing has its own consent. The mobile app does not initialise PostHog product analytics.

The connected server also produces operational error and tracing records. These are separate from the mobile switches. Server trace content is controlled separately, and deleting account data starts a separate process for removing associated remote telemetry.

External services and your choices

Depending on your configuration, AI and voice requests can reach OpenAI, Anthropic, Google Gemini, xAI or ElevenLabs. A locally configured service or your operating system's speech engine may handle other requests. Provider setup and model-list requests can also contact a provider without sending a conversation.

Your chosen service's account, API terms and settings govern its processing and retention. They can differ between products and account types. Bliss does not promise that every provider deletes requests immediately, excludes every use for training or processes information only in Switzerland. Review the terms for the service you actually configure. Connections to hosted services can also pass through network and CDN providers.

• OpenAI API data controls
• Anthropic commercial terms
• Google Gemini API terms
• xAI API and enterprise information
• ElevenLabs privacy policy

Keeping and deleting data

Saved cloud information remains separate from your current conversation session. You can review or remove supported items in the app. Removing an ambient session from its list hides that session; it is not the same operation as erasing all account data.

The account settings offer deletion of account data while keeping the sign-in account, or deletion of the account itself. Account deletion first removes associated service data and then the sign-in record. If part of that process fails, the app keeps a retry path. Remote diagnostic deletion can remain pending after the account-data request succeeds.

Deletion from the current service does not instantly erase copies already in backups or services that received a request. Their retention and deletion processes apply separately. This policy does not set one retention period for all data types or for providers you select. Contact us if you need details about a particular record or deletion request.

Your controls

You can change assistant mode, remove configured connections or keys, turn off optional collection and sharing, and change operating-system permissions. These choices affect future processing; they do not undo actions already completed by a connected service.

Visiting this privacy page

This page uses no analytics, tracking cookies, forms, external fonts or third-party scripts. Its app icon and stylesheet are served with the page.

AWS Amplify hosts the static site in the Ireland region and delivers it through a global content delivery network. Serving and protecting the page involves ordinary connection information such as your IP address, requested URL, browser information and request time. Hosting and security providers can process this information where their infrastructure operates, including outside Switzerland. It is separate from the information you enter in the app.

• AWS privacy notice

Questions and privacy requests

Contact bliss@shumil.in to ask about this notice or request access, correction or deletion of information under our control. Include the app name and enough information to locate the relevant account or record. Do not send passwords, API keys or unrelated sensitive information.

We may ask for proportionate information to verify that a request concerns your data. Rights and available remedies depend on the applicable law. You can also raise a concern with the relevant data protection authority, including the Swiss Federal Data Protection and Information Commissioner.

This notice is updated when the app’s data handling changes. The date at the top identifies this version.

• Swiss data protection authority