English

Privacy Policy

Last updated: November 9, 2026

This policy explains what the Buttonly apps do with your data. It covers the Android apps Buttonly Translate and Buttonly Remember. The rules for using the apps are in our Terms of Use.

This policy is written in English and translated. If a translation is unclear or says something different from the English text, the meaning that is more favourable to you applies.

The short version

  • There are no accounts, no advertising, no analytics and no tracking. We do not sell your data.
  • The new versions of the apps work as described here. Until your app has updated, it sends our server your phone’s text, without sound.
  • While you speak, the speech recognition service on your phone, from Google, shows your words. For some languages this happens on the phone; for others, Google receives your voice under its own privacy policy (details).
  • When you finish speaking, the apps send the sound to our server. For most languages, our own speech model turns it into text (details). This happens with every phrase in Translate and, in Remember, with every question, your first 50 notes, and all notes if you subscribe. The sound is held only in working memory and is not saved.
  • Only text goes on from our server to an artificial intelligence: Claude, by Anthropic, in the United States. Our server does not save your words on disk (how long it holds them).
  • Remember notes are kept on your phone. Their text passes through our server when the app sends a recording, and they go to Claude only together with your question (details).
  • In Translate, the other person’s voice is handled the same way (what this means for them).
  • What you say may include information about your health or other sensitive matters, so both apps work only with your explicit consent. You can withdraw it at any time (Translate, Remember).
  • What the apps keep — the Translate history and your Remember notes — is stored on your phone. Remember notes and the number of free translations used in Translate are also included in your phone’s Google backup, if backup is turned on.
  • Claude processes your requests in the United States, under the EU standard contractual clauses (details).
  • The apps are for adults only (18+).
  • We check your region by your IP address (details). For Ukraine, see this section.

Who is responsible

The apps are made by Dmytro Liashko, trading as Buttonly, Sir Winston Churchilllaan 843A, 2286 AA Rijswijk, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 84903481.

We are responsible for your personal data in the apps (the “controller” under the EU General Data Protection Regulation, GDPR).

Questions about privacy: support@buttonly.app.

Words used in this policy

  • Our server — the Buttonly server. It runs on Google Cloud in the Netherlands. Both apps use it.
  • Our speech model — a speech recognition model that we run ourselves on Google Cloud in the Netherlands, in a closed service that only our server can reach. The model’s authors do not receive your voice.
  • Speech recognition service — the service on your phone that turns speech into text. On Android it is Google’s speech service (“Speech Services by Google”); the apps use Google’s service only, so phones without it cannot understand you. It is part of your phone, not of our apps.
  • Claude — an artificial intelligence model by Anthropic PBC (United States); we call it directly at Anthropic. Claude reads the text of what you said, translates it or understands what you want, and answers a question.
  • The AI — in this policy, Claude only. Our speech model is artificial intelligence too, but we always call it “our speech model”. Claude runs on Anthropic’s servers in the United States; Anthropic is our processor under a contract.
  • On your phone — in the app’s own storage on your phone. Other apps cannot read it.

What both apps have in common

The microphone and speech recognition

The apps listen only after you press the big button. They stop when you press the button again, after a long silence, or at the maximum length of a phrase. They never listen in the background. Before you speak to an app for the first time, it shows a short notice with a link to this policy. You give your consent in this notice (Translate, Remember).

  • You choose the language you speak in the app, from a list of 24 languages: Ukrainian, Russian, English, Dutch, German, French, Spanish, Polish, Italian, Portuguese, Bulgarian, Czech, Danish, Estonian, Greek, Croatian, Latvian, Lithuanian, Hungarian, Romanian, Slovak, Slovenian, Finnish and Swedish.
  • The app and the speech recognition service on your phone. While you speak, the app picks up the sound from the microphone and passes it straight to the speech recognition service, which shows your words. If this does not work, the service listens to the microphone itself. The app keeps the sound only in working memory, just long enough to pass it on, and never saves it.
  • Android 12 and older. A recording that goes to our speech model is made by the app itself, without Google’s service, so your words appear only after you finish; the sound stays in working memory until it is sent. For other recordings, and when there is no connection at the start, the service listens to the microphone itself.
  • On the phone or at Google. Some languages can be recognised on the phone itself (on Android 13 and newer), without sending your voice anywhere, if Google’s language pack for that language is downloaded on the phone. For the others, including Ukrainian and Dutch, and for any language without a downloaded pack, the service sends your voice to Google’s servers to be recognised.
  • Who is responsible. When your voice is recognised online, we and Google are jointly responsible for collecting your voice and passing it to Google. What Google does with it after that — how long it keeps it and where it processes it — Google decides on its own, as a separate controller (for the EEA: Google Ireland Limited), under the Google Privacy Policy. We cannot see or delete what Google keeps: ask Google about that, and ask us about anything else.
  • Without this service, the apps cannot understand you. On phones without Google’s services, the apps do not work.

Our speech model

The new versions of the apps work as described here. Until your app has updated, it sends our server your phone’s text, without sound.

After you finish speaking, the app sends the sound, with the text your phone heard, over an encrypted connection to our server. For most languages, our server passes the sound to our speech model, which turns it into text (which languages). The sound does not go to Anthropic or to anyone else, is not saved and is not used for training.

  • When. Translate: every phrase, yours or the other person’s. Remember: every question and “Forget…” command, your first 50 notes, and all your notes if you subscribe. Other notes do not go to our server, except in the languages below, and notes started without a connection never do: the phone’s text is saved.
  • Waking the model. After you have agreed to the app’s notice, and when what you say next would be sent to our server as sound, the app sends our server a short request as you open it or come back to it, at most once every few minutes. This lets our speech model get ready before you speak. The request carries no sound and no words; our server and Google Cloud log it like any other request (details).
  • Above the monthly limit, our speech model is not used for notes. The sound of the first note above the limit still reaches our server, which discards it without listening to it. After that, the app sends no sound of notes until the new month.
  • You can turn it off for notes, questions and “Forget…” with Only the phone’s text in My notes in Remember (details). The app then uses the text from your phone, and your voice does not go to our server.
  • If the model does not answer in time, the phone’s text is used instead. On Android 12 and older there is no phone text: the app tries once more after a moment, keeping the sound only in working memory. If that fails too, the sound is erased and the app tells you that the recording was not saved.
  • After an update, the app sends sound only after you have agreed to its notice.

Languages of our speech model

The consent screens in the apps describe how this works for most languages. The exception: on Android 13 and newer, for Swedish, Danish, Lithuanian, Latvian, Slovenian and Greek, our speech model is not used while your phone has its own text. The sound still reaches our server, which discards it without listening to it, and the app uses your phone’s text. In Remember this happens with every note in these languages, also after your first 50, unless Only the phone’s text is on. On Android 12 and older the model works in all these languages.

No accounts, ads, analytics or tracking

You do not sign in. The apps contain no advertising, no analytics and no crash-reporting tools, and they do not follow you across other apps or websites.

The apps use two Google Firebase services: App Check (see the next section) and a database that receives only the reports you choose to send.

Checking that the app is genuine

To protect our server from misuse, every request carries a token from Firebase App Check. To get it, the app asks Google Play services on your phone for a Play Integrity check.

For this check, Google receives information about the app (its name, version and signature), its Google Play licence status for the Google accounts on the phone, and checking data generated by your device. Google uses it to confirm that the request comes from the genuine app on a genuine, unmodified device. Google handles this check under the Google Play Terms of Service (what Google collects).

The token contains nothing that you said. Our server checks the token and does not store it. To stop one copy of an app from posing as many, it keeps a keyed hash of the token in its working memory until midnight Amsterdam time (monthly limit).

What our server keeps

  • Our server receives the sound of what you say when the app sends a recording (details), and otherwise only text.
  • Our server does not save what you said, translations, notes or questions on disk. It passes them on and sends the answer back to your phone.
  • The sound is held in working memory only while your request is processed, and then dropped; it is never written to disk, logs or the cache. If your phone loses the connection and sends the same request again, the server should not process it twice. So it holds each answer, including the words heard from your voice, in working memory (not on disk) and reuses it for up to 5 minutes. After that it is no longer used, and it is erased the next time that copy of the server handles a request, or when the copy stops. A copy with no requests is nearly stopped by Google Cloud and holds the answer until it wakes or ends, so we cannot promise an exact time.
  • For every request, the server writes a technical log line: the time, the app, the server address it called, the result (and the technical error, if there was one), how long it took, which AI model answered and how many “tokens” (units of text) were used. It writes one more line of the same kind for each call to the AI.
  • Google Cloud also records the request’s IP address and “user agent” — a short text the phone sends with every request, which names the Android version and the phone model. A request refused because of your region is not recorded in this way (details).
  • The logs never contain your voice or your words.
  • To check a subscription, our server keeps in our database at Google Cloud in the Netherlands a keyed hash of the purchase token, the app, the product, the state, the end of the right, whether it is a test purchase, and the time of the last check. It does not keep the full token, the order number, the amount or the country. If Google Play does not know a purchase token, the server keeps only its keyed hash in its working memory for up to 10 minutes, so as not to ask Google about it again. The token is never written to the logs.
  • The logs are kept at Google Cloud in the Netherlands for 30 days (log lines written before 17 October 2026 stay in Google’s global logging storage until they expire, at the latest on 16 November 2026) and then deleted automatically.

The monthly limit

To keep the service working and within its budget, each installation of an app can send our server up to 3,000 translations a month (Buttonly Translate) or, in Buttonly Remember, up to 2,000 questions a month and, counted separately, up to 2,000 recordings a month through our speech model. Above that limit a note is still saved, with your phone’s text. On Android 12 and older, the first recording above the limit is not saved: the app tells you so and asks you to say it again. The count starts again at 00:00 Amsterdam time on the 1st of each month.

  • To count them, the app sends a random installation number with each request. It is created on your phone, is not linked to your name, your Google account or your phone’s identifiers, and disappears when you clear the app’s data or uninstall the app, and in Remember also when you withdraw your consent. Older versions of the apps do not send it; for them, the server counts by IP address (for IPv6, by its /64 network).
  • The server keeps neither the number nor the address — only a scrambled form of it (a keyed hash) together with the count, in our database in the EU (at Google Cloud, the Netherlands). The key of the hash is kept separately from the database. The counter is deleted automatically after the month ends, usually within a day. It is never written to the logs. If the database cannot be reached, the server temporarily keeps this counter in its own working memory instead, also only until the end of the month.
  • We cannot link these counters to you, so we cannot find, show or delete your counter on request; it is deleted automatically after the month ends.
  • Against misuse, the server also counts requests per App Check token (above), as a keyed hash in its working memory only, until midnight Amsterdam time.

Checking your region

Anthropic, which provides our AI, does not offer its service in some countries and regions, even to someone who is there for a short time. We have to keep to this, or the apps could lose the AI for everyone. So when an app sends our server a request for the AI, or asks whether the service works where you are, the server checks your region by your IP address.

  • How it works. Our server looks up the IP address in a list of closed address ranges, in its working memory. Nothing is sent to anyone else for this.
  • What is kept. Your region is not saved, and there is no separate record of this check. The ordinary technical log keeps the IP address of requests for 30 days (details). For a request refused because of the region, the address is left out of that log: only the refusal is recorded, without the address, country or region.
  • What a refusal means. The app cannot use the AI in that place. Nothing else happens (where the apps do not work).
  • It can be wrong. An IP address shows a place only roughly, and a VPN changes it. If you are refused somewhere the app should work, write to support@buttonly.app.
  • Source of the list. IP Geolocation by DB-IP, under the CC BY 4.0 licence. We have shortened it to the closed ranges.
  • Speech model. Speech model: Parakeet TDT 0.6B v3 by NVIDIA (huggingface.co/nvidia/parakeet-tdt-0.6b-v3), post-trained by moondream (huggingface.co/moondream/parakeet-ultra), ONNX export by Olicorne (huggingface.co/Olicorne/parakeet-tdt-0.6b-v3-ultra-onnx, int8, revision b27f93c), under the CC BY 4.0 licence (creativecommons.org/licenses/by/4.0/). We use it without changes; it is provided as is.
  • Your rights. This rests on our legitimate interests (details), and you can object (how).

Checking the internet connection

If an answer takes longer than usual, the app may send one empty request to connectivitycheck.gstatic.com. This is a Google address that Android itself uses to check internet access. It tells the app whether your internet or our service is slow. Like any internet request, it shows your IP address to Google, but nothing else about you.

The app’s texts in your language

The apps show their buttons and messages in your language. The translations are built into the app, so nothing is sent anywhere for this. Versions released before 23 October 2026 sent their interface texts and the name of your language through our server to Gemini to be translated; that request contained nothing you said.

Reading aloud

When you tap the speaker button, the app asks Google’s text-to-speech engine on your phone to read the text aloud; if it is not installed, the engine you chose in the Android settings reads it. Some voices may need the internet: then the engine sends the text to its maker (Google or your phone’s maker) under its own privacy policy. We receive nothing from it.

Without your consent, and after you withdraw it, the app uses only voices on your phone: if there is no such voice, the text is not read aloud and does not go to the maker of the speech engine. The maker of the engine chosen in your phone’s settings is responsible for that engine.

Reports of AI results

The AI can make mistakes. In each app you can report a result of the AI with a small flag. In Translate, tap the small flag on the result’s card; in Remember, tap the flag on the answer screen. A report is sent only if you tap the flag and confirm.

  • Reports go to our database at Google Cloud in the Netherlands.
  • The app can only add new reports; it cannot read, change or delete them. Only we can read them.
  • A report contains no name, account or device identifier. What exactly it contains is described in each app’s section below (Translate, Remember).
  • We use reports to find and fix wrong or harmful AI results.
  • We keep a report for 6 months. Then it is deleted automatically, usually within a day.

Buttonly Translate

What happens when you speak

  1. You choose two languages: yours and the other person’s.
  2. The big button has two halves: one for you and one for the other person. Whoever speaks presses their half, says a phrase and presses it again when they have finished. The speech recognition service on your phone shows the phrase as text (details).
  3. The phone sends the sound and this text over an encrypted connection (HTTPS) to our server, together with the two languages and the language of the app’s screens. For most languages, our speech model turns the sound into text; if it does not, the phone’s text is used (details).
  4. Our server sends the text and these languages to the AI (Claude). The AI returns the translation. Your phone shows it and saves it in the history (see below).
  5. When your phrase has been translated into the other person’s language, your phone then asks our server for its pronunciation, written in your alphabet. It sends what you said, the translation and the two languages. Our server passes only the translation and the languages to the AI. It uses what you said only to check that the answer is a pronunciation and not a retelling of your phrase.

No sound is saved. The sound stays on our server only while the request is processed. Until the phrase is translated, its text is kept only in the app’s working memory, so that the app can send it again if the connection fails. If it is not translated, it disappears when you say a new phrase, cancel it or close the app. A translated phrase is kept in the history.

If the pronunciation does not arrive, the app asks our server for it again later: when you open that translation in large letters, and once the next time you start the app. The same data is sent as the first time (step 5).

  • Before you speak for the first time, Translate shows a notice. What you say about your health or other sensitive matters is sent the same way as everything else. By tapping “Agree”, you give us your explicit consent to this.
  • The app sends no sound until you have agreed. If you agreed to an earlier notice, it asks again.
  • You can withdraw your consent at any time with Withdraw consent in the app’s menu. After that your voice and text are no longer sent, and the app shows the notice again. Your history is not deleted: that is a separate button (how). Withdrawing does not cancel your subscription (details).
  • Your phone keeps the version of the notice you agreed to, the time you agreed and the time you withdrew.

What stays on your phone

  • Translation history: the text of your last 50 translations, both directions together: your phrases translated into the other person’s language and the other person’s replies translated into yours. Each one keeps what was said, the translation, the pronunciation (for your phrases), the languages, the time, whether you reported it, and whether its pronunciation is still to be asked for. When there are more than 50, the oldest is deleted automatically. No sound is stored.
  • The history is kept only on your phone, in a part of its storage that Android does not copy to backups. Nothing from it leaves your phone, except a report you choose to send and a request for a missing pronunciation (above).
  • The other person’s words. The history includes what the other person said to you. We cannot see it. If you were the other person in such a conversation and want your words removed, ask the person who used the app to clear the history.
  • Other app data — the two languages you chose — may be included in your phone’s Google backup and in a direct transfer to a new phone, if backup is turned on. The app also keeps a record that you accepted the notice: its version and language, when you accepted it, and a fingerprint (hash) of the exact text. This record is not copied to backups, so on a new phone the app shows the notice again.
  • The number of free translations used — a single number, with nothing you said — is included in your phone’s Google backup and in a direct transfer to a new phone, if backup is turned on, so that the free part is given once. This is necessary to provide the free part and the subscription as described in our Terms of Use (GDPR Article 6(1)(b)).
  • The app remembers on your phone when Google Play last confirmed your subscription, so that it keeps working during a short Google Play outage. This is not included in backups, is erased when you clear the app’s data or remove the app, and no purchase tokens are stored.

Deleting

  • Clear the history: tap Clear history at the top of the history, above the oldest translation, and confirm. This deletes all translations, yours and the other person’s, from your phone. It does not change your languages, the number of free translations used, your subscription or the note that you accepted the notice.
  • Reports you have already sent are not deleted with the history. They are deleted after 6 months, or earlier if you ask us (how).
  • To erase everything the app stores: open the Android Settings → Apps → Buttonly Translate → Storage → Clear data, or uninstall the app. The copy of the free-part counter in your Google backup stays until the next backup replaces it or Google deletes it (details). Menu names differ between phones.

Reports

If you report a translation, the report contains: what the app heard (your phrase or the other person’s reply, as text), the translation, the pronunciation, the language of the translation, your language and the other person’s language, the app version, and the time the report arrived.

Buttonly Remember

Remember keeps what you dictate as text notes, answers your questions about them and forgets them when you ask. It is an AI assistant: the speech recognition service on your phone and our speech model turn your voice into text, and Claude understands only your questions and “Forget…” commands and writes the answers; your notes are kept on your phone.

What happens when you speak

  • You choose the language of your notes. When you speak, the speech recognition service on your phone turns your voice into text in that language (details). If your phone recognises speech over the internet, your voice goes to Google’s speech recognition service. No sound is saved. For your first 50 notes, all notes if you subscribe, and every question, the app also sends the sound to our server and, for most languages, to our speech model (details).
  • When you save a note, its text is kept on your phone. When the app sends a recording, the sound and the text pass through our server, which saves neither on disk; nothing goes to Claude. The number of notes is not limited.
  • When you ask a question (the “Ask” button), the phone sends the question and your notes (which ones is explained below) to Anthropic’s Claude through our server. A “Forget…” command is sent the same way. It is first saved on your phone as text and then sent automatically as soon as there is internet, even if the app is closed.
  • With each question, the phone sends to our server, and our server to the AI:
    • the text of what you said;
    • the date, time and time zone when you spoke;
    • the language of your notes and your phone’s language;
    • your last question and its answer, if you asked it less than two minutes ago;
    • your last note (its text), even when you have more than 50 notes;
    • if you have more than 50 notes or they total more than 60,000 characters, a list of the names of people in your notes (at most 60, names only), so that the AI hears a name correctly;
    • if the app is waiting for your “yes” or “no” to a “forget” question, a short description of what it is about to forget.
  • Which of your notes are sent (questions only). While you have 50 notes or fewer (together no longer than 60,000 characters), all your notes are sent with a question. When you have more, only the notes that are needed are sent: for a question or a “forget” command, the phone picks up to 30 notes that fit best (the ones your last answer quoted, the ones that contain the words of your question, the ones from the dates you mention, the most recent ones and their corrections) and sends them as text. Notes are never sent to Claude when you only save them.
  • What the AI returns: what you wanted: to ask or to forget. For a question, it returns an answer with short quotes from your notes and the words to find notes by. Our server checks that each quote really is in your note. For “Forget…”, it returns which notes match, and the app asks you before deleting them. If two notes disagree, the newer one counts as a correction, and the answer may say so.
  • Safety. If your question, or the notes that the answer quotes, suggest you may be in danger or thinking of harming yourself, the AI marks it, and the app shows a gentle suggestion on the answer screen to talk to someone close to you or to call 112. There is no such check when you save a note.
  • Finding notes. When you have more than 50 notes, the app finds the ones a question needs on your phone, by words and dates. The words to look for come from Claude together with its answer to your question. Your notes are not sent anywhere for this search.
  • A question that is waiting to be sent stays on your phone as text, in storage that is not copied to backups, until the AI has understood it, or until the app gives up on it. Then it is deleted. A question you ask after your 50 free questions are used up stays on your phone in the same storage until you subscribe or delete it. Nothing is sent until then, unless Google Play has not yet confirmed that you have no subscription: then the question goes to the AI as usual, and its answer waits on your phone for a subscription. If our server finds that your subscription has ended, it refuses the request and passes nothing on to the AI. If you cancel a question that is waiting, it is deleted too.
  • Things the app tries not to keep. Remember tries to spot bank card numbers, IBANs and numbers said next to words like “PIN” or “password”. The phone checks what it heard. When your voice goes to our server, our server checks the phone’s text and our model’s text, if the model was used. If a check finds such a number, the note or question is not saved, the words are not sent to the AI, our server does not return or keep them, and you see a message. These checks use rules and can miss a number, especially a misheard one; what they miss is saved and can go to the AI with a question. They can also refuse something harmless. By the time a check runs, your voice may already have gone to Google, if it is recognized online, and to our server, which does not keep it. On Android 12 and older the phone has no text of its own, so only the server and the final check on the phone run. Please do not dictate card numbers, PINs or passwords. A door code is saved.
  • Health and other sensitive matters. Remember also saves notes about your health, how you feel or other sensitive matters, if you dictate them. They are kept on your phone. Your voice and their text pass through our server when the app sends a recording, and they go to Claude only together with a question or a “Forget…” command (all your notes while you have up to 50, then only the matching ones). Such information is sensitive, so Remember processes it only with your explicit consent (details). You decide what to tell the app. If your voice is recognised at Google (details), Google also receives what you say. Remember prefers recognition on the phone when it is available.
  • Before you speak to it for the first time, Remember shows a notice: what goes to our server and our speech model, what is sent to Claude, where your notes are kept, that what you say about your health or other sensitive matters is saved and sent too, and that for some languages your voice goes to Google to be recognised. By tapping “Agree”, you give us your explicit consent to process this information in this way.
  • Without this consent, Remember cannot be used: anything you dictate may be about your health, and the app cannot tell in advance. If you tap “Not now”, the app does not listen. If Remember is restored on a new phone from your Google backup, it asks for your consent again and sends nothing until you agree; if you do not agree, the restored notes stay on that phone until you clear the app’s data in Android settings or uninstall the app.
  • On your phone, Remember keeps a record of your consent: the version and language of the notice, when you agreed, and a fingerprint (a “hash”) of the exact text you saw. It shows what you agreed to.
  • Only the phone’s text. This switch in My notes covers notes, questions and “Forget…”: your voice then does not go to our server, and the app uses the text from your phone. If your voice is recognised online, Google still receives it, and the text of your questions and “Forget…” commands, with the notes they need, still goes through our server to Claude. The switch deletes nothing and does not withdraw your consent.
  • You can withdraw your consent at any time. Say “I withdraw my consent” with the Ask button, or tap Withdraw consent in My notes. Remember first offers to send you a copy of all your notes (details) and asks you to confirm. Then it deletes from your phone all your notes, questions that are waiting, your last question and answer, the copy files, your settings and the record of your consent, and starts again with the notice. It keeps only what contains nothing you said: how many questions you have used and how many notes went through our speech model, so that the free part is given once, the Only the phone’s text switch, and the month in which the limit on recordings was reached. To remove these too, clear the app’s data or uninstall the app; the copy in your Google backup stays until the next backup replaces it or Google deletes it (details). Withdrawing does not undo what the app did before. Withdrawing does not cancel your subscription (details).
  • After your free questions are used up, what you say with the Ask button, including “Forget…”, “I withdraw my consent” and “Send me all my notes”, waits for a subscription too. The buttons in My notes (Delete, Send file, Erase all, Withdraw consent) stay free and always work, and getting a copy is always free.

What stays on your phone

  • Your notes: your words as text; the date, time and time zone when you spoke; and the language. Notes the AI saved from what you said with the Ask button, and notes saved by earlier versions, can also keep their title, type, topics, people and dates, a link to the earlier note a correction refers to, and the example question. They stay until you delete them.
  • Settings and counters: the language of your notes, which functions you have used, how often hints were shown, how many times the app was opened, how many questions you have used, how many notes went through our speech model, the Only the phone’s text switch, and the month in which the limit on recordings was reached.
  • The record of your consent (details). It is not copied to backups: on a new phone, Remember asks for your consent again.
  • The copy of your notes: the two files stay in the app’s private cache, which is not copied to backups, so that the app you chose can read them. They are deleted the next time you make a copy, when you withdraw your consent, or the first time you open Remember more than a day later.
  • While a note is on its way: while a note goes to our server, the phone keeps a mark with no words or sound: only that a note or question is on its way. If the app closes, it can then tell you the note was not saved. The mark is deleted as soon as the note is saved or you have seen this message.
  • Working data: questions that are waiting, your last answer (with its AI label), which you can open again in My notes until the next answer arrives, the note it relies on is deleted, or you use Erase all or withdraw your consent, your last question and answer (used for a follow-up question within about two minutes) and an unanswered “forget” question. This data is not copied to backups.

Your Google backup

Your notes and settings are included in Android’s own backup to your Google account, if you have turned backup on, and in a direct transfer to a new phone.

According to Google, on Android 9 and newer this backup is end-to-end encrypted with your phone’s screen lock (PIN, pattern or password), it is usually made about once a day, and only the latest backup is kept. We cannot read your backup. A note you delete, one at a time or with Erase all, stays in your Google backup until the next backup is made.

Forgetting and deleting

  • To delete one note, open My notes and tap Delete under it. My notes also has Send file and Erase all.
  • Say “Forget what I said about…” with the Ask button — the app finds the matching notes and asks you before deleting them.
  • To delete all your notes, tap Erase all in My notes, or say “I withdraw my consent” (details). Erase all in My notes also withdraws your consent, just as Withdraw consent does. To erase everything the app stores, open the Android Settings → Apps → Buttonly Remember → Storage → Clear data, or uninstall the app. “Forget everything” leads to the same offer and the same confirmation, so that one misheard phrase cannot delete all your notes.
  • To remove the copy in your Google backup as well, turn off backup or delete the backup in your Google account.

A copy of your notes

In My notes, tap Send file. Or say, for example, “Send me all my notes”, and Remember opens a screen with a button to tap. Android’s Share window then opens with two files: a text file you can read and a JSON file that other programs can read. You choose where to send them, for example to your email or to Google Drive. Remember never sends the files by itself.

The files contain everything you have said, including about your health, so send them only to people you trust. Getting a copy is always free.

Reports

If you report an answer, the report contains: your question, the answer, the quotes from your notes that the answer is based on, the language of the answer, your language, a technical mark that the answer was created by AI (which AI model created it and when), the app version, and the time the report arrived.

The quotes may contain information about your health. So before sending, the app asks for your explicit consent: by tapping “Report” in that question, you agree to send them to us. You can withdraw this consent by writing to us: send us the text of the report and its approximate time, and we will delete it. Otherwise it is deleted after 6 months (details).

Where your data is processed

  • Our server and our speech model: Google Cloud, the Netherlands.
  • Region check: on our server, the Netherlands.
  • Claude (Anthropic): on Anthropic’s servers in the United States. The transfer is protected by the EU standard contractual clauses in Anthropic’s Data Processing Addendum, and Anthropic may not use your data to train its models.
  • Reports: Google Cloud, the Netherlands.
  • Monthly limit counters: Google Cloud, the Netherlands.
  • Technical logs: Google Cloud, the Netherlands.
  • App Check and Play Integrity: Google services that may process data outside the European Economic Area (EEA).
  • Speech recognition at Google (when your voice is not recognised on the phone): Google decides where, and may process your voice outside the European Economic Area (EEA); Google is responsible for protecting such transfers, under the Google Privacy Policy.
  • Reading aloud with a voice that needs the internet: the engine’s maker decides where, and may process the text outside the European Economic Area (EEA).
  • Emails to us: Proton AG, Switzerland. The European Commission has decided that Switzerland protects personal data adequately.

When data leaves the EEA (the EU, Norway, Iceland and Liechtenstein), the transfer is protected by the EU Standard Contractual Clauses: for Claude, in Anthropic’s Data Processing Addendum; for Google’s services, in the Cloud Data Processing Addendum. You can read the clauses in these addendums or ask us for a copy.

Who processes your data for us

We share your data with these service providers, which process it on our behalf (as “processors”):

  • Google Cloud runs our server, our speech model, the technical logs and the database of monthly limit counters.
  • Anthropic PBC (United States) provides the Claude model; we call it directly at Anthropic. It processes the text we send only on our behalf, under its Data Processing Addendum.
    • Anthropic’s terms do not allow it to train its models on this data.
    • Anthropic deletes the requests and answers within 30 days. If its automated checks flag a request as breaking Anthropic’s Usage Policy, Anthropic may keep that request and its answer for up to 2 years, and the results of those safety checks for up to 7 years (Anthropic).
  • Google Firebase provides App Check and the database for reports.
  • Proton AG (Switzerland) provides our email. It stores the emails you send us and our replies.

Google provides its services under the Google Cloud Platform Terms of Service, which include the Cloud Data Processing Addendum.

These services are not our processors; each handles the data under its own terms and privacy policy:

  • The speech recognition service on your phone, when it sends your voice to Google to be recognised (details); we are jointly responsible only for collecting your voice and passing it to it. Google handles it under the Google Privacy Policy.
  • Google Play services perform the Play Integrity check, under the Google Play Terms of Service.
  • Google Play sells the subscription (Google Commerce Limited). In Ukraine, the seller is Buttonly, and Google Play only processes the payment (details). In both cases, Google is an independent recipient of your payment data: the payment, your card and your purchase history are handled by Google under the Google Privacy Policy and the Google Play Terms of Service. The app on your phone asks Google Play whether a subscription is active. With paid requests, the app also sends our server the Google Play purchase token. Our server checks it with Google Play (the Play Developer API), and learns about refunds and cancellations from Google’s notifications, which arrive through Google Cloud Pub/Sub (a processor, in the EU, up to 1 day) (what the server keeps).
  • Android backup to your Google account, if you have turned it on.
  • The internet connection check (connectivitycheck.gstatic.com) receives your IP address, like any Google address on the internet (details).
  • The text-to-speech engine on your phone (Google’s, or your phone maker’s if Google’s is not installed), when a voice needs the internet.

More about Google: Google Cloud Privacy Notice, Google Privacy Policy.

We disclose data to authorities only if the law requires us to.

  • To do what you ask — translate, remember, answer, forget and show the app in your language. This is necessary to provide the app you use, as described in our Terms of Use (GDPR Article 6(1)(b)).
  • The subscription: checking on your phone whether a subscription is active, so that the app can give you what you bought, and counting the free translations and questions used. This is necessary to perform the contract with you (GDPR Article 6(1)(b)).
  • Checking the purchase on the server: our legitimate interest is not to give the paid part without payment and to take a refund or a cancellation into account at once (GDPR Article 6(1)(f)). You can object (how).
  • Speech recognition: the app picking up your voice and, when it is not recognised on the phone, passing it to Google’s service is necessary to understand you (GDPR Article 6(1)(b)). What you say about your health may be in that voice; this is covered by your explicit consent (GDPR Article 9(2)(a)).
  • Our speech model: sending your voice to it has the same basis as what the app does with your words: to do what you ask (GDPR Article 6(1)(b)). What you say about your health or other sensitive matters is covered by your explicit consent (GDPR Article 9(2)(a)). The other person’s voice rests on our legitimate interests (below).
  • Health and other sensitive information belongs to a special category of data. We process it only with your explicit consent, which you give by tapping “Agree” in the notice before you first speak to the app (GDPR Article 9(2)(a)). You can withdraw it at any time (Translate, Remember).
  • To give you a copy of your notes when you ask: this is our legal obligation (GDPR Articles 15, 20 and 6(1)(c)).
  • Reports in Remember may contain quotes about your health. We receive such a report only with your explicit consent, which you give in the question before sending it (GDPR Articles 6(1)(a) and 9(2)(a)). You can withdraw it by writing to us (how).
  • Emails about refunds and claims: we use them to handle your request, because this is needed for our contract with you (GDPR Article 6(1)(b)). After that we keep them because Dutch law requires it (GDPR Article 6(1)(c)), and we can use them if we need to establish, exercise or defend legal claims (GDPR Article 6(1)(f)).
  • Our legitimate interests (GDPR Article 6(1)(f)). For each of them, we have checked that we need the data for it and that your interests do not outweigh it:
    • technical logs with IP address and user agent: to find and fix faults and to notice misuse of our server;
    • App Check and Play Integrity: to protect our server from fake apps and automated misuse, because every request to the AI costs us money;
    • the monthly limit: to protect our service from misuse and overspending, because every request to the AI costs us money;
    • the region check: to keep to the conditions of our AI provider, because otherwise the apps could lose the AI for everyone. Your Google Play country does not show where you are now, and it does not show your region (details);
    • the answer memory: so that a request sent again after a lost connection is not processed and paid for twice;
    • the internet connection check: to tell you whether your internet or our service is slow;
    • reports in Translate: to find and fix wrong or harmful translations. Google Play also requires apps with AI-generated content to let people report it. You decide whether to send a report.
    • the other person’s words in Translate: so that you can understand the person you are talking to and see the whole conversation again. Their voice goes to our server, to our speech model (which languages) and, for some languages, to Google; only text goes on to the AI, and the sound is not saved. To protect the other person, the app shows them a line in their language while it listens, their replies stay only on your phone, at most 50 translations in all, are not copied to backups, and you can clear them at any time (details).

You are not required by law or by contract to give us any data. But the apps cannot work without what you say: if you do not speak to the app, nothing is sent.

If you were the other person in a conversation

Someone used Buttonly Translate to talk with you, and the phone showed a line saying that it is listening.

  • Who we are. Dmytro Liashko, trading as Buttonly, the Netherlands. Email: support@buttonly.app.
  • Why. To translate what you say for the person holding the phone.
  • What happens to your voice. It goes to our server in the Netherlands (Google Cloud), where, for most languages, our speech model turns it into text (which languages), and it may also go to Google’s speech recognition service. The text goes to Claude, by Anthropic, in the United States, to be translated.
  • Legal basis. Our legitimate interest, and that of the person holding the phone, in two people without a common language understanding each other (GDPR Article 6(1)(f)).
  • How long. We do not save the sound: it is held in working memory only while it is processed. The answer stays in working memory as described here. Anthropic deletes the text within 30 days, with the exceptions described here. Your words stay in the app’s history on that person’s phone, at most 50 translations, until they clear it.
  • Your rights. If you would rather not, tell the person holding the phone. You can object at any time by writing to us. You can complain to the Autoriteit Persoonsgegevens in the Netherlands or to the data protection authority where you live.

Your right to object

You can object at any time to our use of your data based on our legitimate interests (listed above), for reasons that relate to your particular situation. Write to support@buttonly.app. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

  • Our technical logs and reports are not linked to your name. To find your log lines, we need your IP address and the approximate time; to find your report, its text and the approximate time.
  • App Check and the technical logs come with every request, because our server cannot work safely without them. While you use an app, we may therefore not be able to stop them; you can stop them at once by not using the app.
  • The region check comes with every request to the AI, because we may not offer the service in closed regions. While you use an app, we may therefore not be able to stop it; you can stop it at once by not using the app.
  • The Translate history, including the other person’s replies, is only on the phone of the person who uses the app, and we have no access to it. It is deleted with Clear history in the app (how).

How long data is kept

  • Your voice: the apps keep sound only in working memory while passing it on to the speech recognition service or to our server, and never save it. On our server, the sound is held in working memory only while your request is processed. If the speech recognition service sends your voice to Google, Google decides how long to keep it, under the Google Privacy Policy.
  • Translate, the text of a phrase: in the app’s memory until it is translated (then it is kept in the history), until your next phrase, until you cancel it or until the app is closed.
  • Remember, a phrase that is waiting: on your phone until the AI has understood it, then deleted.
  • A question waiting for a subscription: on your phone until you subscribe or delete it.
  • On our server: sound and texts only while the request is processed. An answer, including the words heard from your voice, is reused from working memory for up to 5 minutes and erased when that copy of the server next handles a request or stops (details).
  • At Anthropic (Claude): not used for training; deleted within 30 days; if a request is flagged as breaking Anthropic’s Usage Policy, the request and its answer may be kept for up to 2 years, and the safety check results for up to 7 years.
  • Translate history: the last 50 translations, yours and the other person’s, on your phone; older ones are deleted automatically, and all of them when you clear the history, clear the app’s data or uninstall the app.
  • The number of free translations used in Translate: on your phone until you clear the app’s data or uninstall the app; in your Google backup until the next backup replaces it or Google deletes it (it can outlive the app, so that the free part is given once).
  • Remember notes: on your phone until you forget them, withdraw your consent, clear the app’s data or uninstall the app; in your Google backup until the next backup after that.
  • The record of your consent in Remember: on your phone, until you withdraw your consent, clear the app’s data or uninstall the app.
  • The record of your consent in Translate: on your phone, until you clear the app’s data or uninstall the app; it stays when you withdraw your consent, together with the time you withdrew.
  • The copy of your notes: the two files, in the app’s private cache, until the next copy, until you withdraw your consent, or until the first time you open Remember more than a day later.
  • The date Google Play last confirmed your subscription: on your phone until you clear the app’s data or uninstall the app; not in backups.
  • Counter of questions used in Remember: on your phone until you clear the app’s data or uninstall the app; in your Google backup until the next backup replaces it or Google deletes it; it is kept when you withdraw your consent.
  • Counter of notes through our speech model in Remember: kept in the same way as the counter of questions.
  • The Only the phone’s text switch and the month in which the limit on recordings was reached: kept in the same way as the counter of questions.
  • The record of your purchase on our server (a keyed hash of the purchase token, the app, the product, the state, the end of the right, the test mark and the time of the last check): 90 days after the right ends or after the last check, then deleted automatically. A purchase token that Google Play does not know: a keyed hash in the server’s working memory, up to 10 minutes.
  • Technical logs, with IP address and user agent: 30 days, then deleted automatically.
  • The region check: the result is not kept. The IP address is used only while the request is processed, apart from the technical log (details).
  • Monthly limit counters (a keyed hash of the installation number or IP address, with the count): in our database in the EU until the end of the calendar month (Amsterdam time), or, if the database cannot be reached, temporarily in the server’s working memory; then deleted automatically, usually within a day.
  • A keyed hash of the App Check token: in our server’s memory until midnight, Amsterdam time.
  • Reports: 6 months, then deleted automatically, usually within a day.
  • Emails about refunds and claims (your name, email address, order number and what you wrote): while we handle your request, and then for 7 years after the end of the year in which we closed it, because Dutch law requires us to keep our business records for that long. Then we delete them.
  • Other emails to us: until your question is answered, and then up to 1 year.
  • Play Integrity data: Google deletes it after a fixed period that Google sets.

No selling, no ads, no tracking

We do not sell or rent your data. We do not show ads, and we do not use your data for advertising or profiling. We do not combine it with data from other sources, apart from the list of address ranges used for the region check.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22). The AI only interprets and answers what you ask.

Children

The apps are intended only for adults, 18 years and older. Please do not let children use the apps. If a child has used one, you can delete everything it stored on the phone as described above; for anything else, contact us.

Your rights

Under the GDPR you have the right to:

  • see the personal data we hold about you and get a copy of it;
  • have it corrected or deleted;
  • limit how we use it, or object to our use based on legitimate interests (details);
  • receive the data you have given us in a format you can take elsewhere;
  • withdraw your consent at any time, where we rely on it (Translate, Remember);
  • complain to a data protection authority.

How to use these rights:

  • Most of your data is only on your phone. You can see, correct and delete it there, as described above. Remember also gives you a copy of all your notes, as a text file and a JSON file (how). We have no access to this data.
  • Our server keeps no copy of your words on disk. The technical logs and reports are not linked to your name or account, so we usually cannot tell which of them are yours. If you want us to find and delete your report, send us its text and the approximate time. To find your log lines, we need your IP address and the approximate time. The logs are deleted automatically after 30 days.
  • Write to support@buttonly.app. We will answer within one month. We may ask for the information we need to find your data.
  • You can complain to a data protection authority:

If you live in Ukraine

This policy applies to you in the same way as to everyone else. The GDPR protects you too, because we are established in the EU.

  • Your rights are those listed above, and you use them in the same way: write to support@buttonly.app.
  • Complaints. You can complain to us, to the Dutch authority and to the Ukrainian Parliament Commissioner for Human Rights (details).
  • Payment. In Ukraine the seller is Buttonly, and you pay through Google Play (details). We do not see your card. If you ask for a refund or make a claim, we use your name, email address and order number, and we look up the order in our Google Play account. How long we keep this is here, and why is here.
  • Closed regions. The apps do not work in some regions of Ukraine (details).

Security

  • All connections between the apps and our server, and between our server and the AI service, are encrypted (HTTPS).
  • Our server holds your voice only in working memory, during a request; our speech model has no way out to the internet.
  • Our server accepts requests only from the genuine apps (App Check).
  • Our server keeps no user content on disk, and its logs contain none.
  • The apps can only add reports; they cannot read them.
  • Access to our Google Cloud and Firebase projects is restricted.
  • On your phone, the data is in the app’s private storage, which other apps cannot read. Please use a screen lock: it protects your phone and, on Android 9 and newer, encrypts your Google backup.

Changes to this policy

When the apps change how they handle data, we update this page and the date at the top. If a change is important, we will also announce it in the apps or on their Google Play pages.

Contact

  • Dmytro Liashko, trading as Buttonly

  • Sir Winston Churchilllaan 843A, 2286 AA Rijswijk, the Netherlands

  • KvK: 84903481

  • Email: support@buttonly.app

  • Phone: +31 6 19889302

  • VAT ID (btw-id): NL004034336B89