Facet Privacy Policy

Effective: July 17, 2026

Facet turns your data into Home Screen and Lock Screen widgets. Privacy is the product's design constraint, not an afterthought.

The short version

Your widget definitions and calendar/reminder contents live on your device.
Facet has no accounts and keeps no server-side database of your personal data.
When a widget needs fresh data or AI text, the app sends the minimum necessary fields to the Facet service, which processes them in memory and returns the result. Request content is not stored. For abuse prevention, a one-way-hashed quota subject and daily count are retained for up to 48 hours.
AI text is generated only from data you connected. We never sell data. Facet itself never trains models on your data — see the AI processing disclosure below for how the model providers handle requests.

What the app accesses, and why

Data	Where it's processed	Why
Calendar events (EventKit)	On device; event fields your widget uses are sent to the Facet service only when a widget requests an AI summary or server-assembled snapshot	To fill widgets like "Morning Brief"
Reminders (EventKit)	Same as calendar	Task widgets
Location (while using the app, kilometer accuracy)	Coordinates only are sent to the weather service (Open-Meteo); the last fix is cached on device	Local weather widgets, automatically — you can decline and weather uses the last-known area
Health (steps, active energy, exercise minutes, distance — HealthKit)	Read on device; today's totals are sent to the Facet service only to fill a health widget's numbers, processed in memory, never stored. Health data is never included in AI text generation and never shared with AI providers.	Step/activity widgets you create
Connected apps (Gmail, Google Calendar, Notion and others, via Composio)	You sign in through the provider's own page; the connection is managed by Composio and identified by an anonymous ID. Fields your widget uses are fetched at refresh time, processed in memory, never stored by Facet.	Widgets that show your email, events, or docs
Bank data (Plaid, read-only)	You connect through Plaid's own flow; balances/spending summaries are fetched read-only at refresh time, processed in memory, never stored by Facet.	Balance and spending widgets
Anonymous install ID and crash summaries	A random ID (not tied to you or your device identity) accompanies requests for abuse prevention; anonymized crash summaries help fix bugs.	Service protection and reliability
Widget prompts and layouts	Sent to the Facet service and its AI provider	To generate/revise your widget design
Manual values, RSS/JSON URLs you add	Fetched/processed to fill your widgets	Custom widgets
Crash and hang diagnostics (Apple MetricKit)	A count-and-signal summary (no content, no identifiers beyond a random install id) is sent to the Facet service and kept in rotating logs	To find and fix crashes
Random install id	Sent with service requests; one-way hashed before the quota counter is stored, and the raw id is not persisted	To meter fair daily AI usage per install; not linked to you
Signed StoreKit entitlement proof (product, expiration/revocation status, and anonymous Apple transaction identifiers)	Sent to the Facet service, cryptographically verified against Apple's certificates, processed in memory, and not stored. Its anonymous quota subject is one-way hashed before metering.	To grant the paid plan's service quota and reject forged plan claims

AI processing disclosure

Widget generation and AI summaries use third-party large language models. A provider receives: your widget prompt, the widget's layout JSON, and the specific data fields the widget declares — never your credentials, never your whole calendar or inbox, never health data.

Widget creation and revision (your prompts and layouts) run on established AI providers whose API terms exclude using requests for model training.

Per-refresh AI-written widget text (the short summaries an AI widget regenerates from its data) may be processed by open-model endpoints routed through OpenRouter (currently NVIDIA Nemotron). Free open-model endpoints may retain inputs and use them to improve their models, per their own terms. Only the data fields that widget declares are included; you can avoid this path entirely by leaving AI writing off on a widget.

Style reference photos you attach when creating a widget are sent to the Facet service and its AI provider once, to style that widget, processed in memory and not stored.

Storage and retention

Widget specs and snapshots: stored in the app's private App Group container on your device. Deleted when you delete the widget or the app.
Server request content and signed StoreKit proofs are processed in memory and not persisted. A one-way-hashed install or entitlement subject plus its daily quota count is retained for up to 48 hours for abuse prevention. Transient logs (error metadata, no personal content) rotate within 7 days.

Lock Screen privacy

Each widget has a Lock Screen mode: show, redact (values become ••••), or hide.

Subscriptions

Facet Pro and Power are auto-renewing subscriptions billed through your Apple ID. Apple processes the payment; Facet never sees your payment details. Facet sends Apple's signed entitlement proof to its service to verify the paid plan and meter its service quota; the proof is not stored. Manage or cancel in iOS Settings → Apple ID → Subscriptions.

Your controls

Delete any widget and its snapshots in-app; revoke calendar, reminders, or location access in iOS Settings; all app data is removed when you delete the app.

Children

Facet is not directed at children under 13 and does not knowingly collect their data.

Contact

facetwidgets@gmail.com

We will update this policy as the product adds accounts, sync, or new connectors, and note material changes in the App Store release notes.