Privacy Policy
Remi · Last updated 1 September 2026
Remi is built around one promise: we never upload your photos. They are encrypted on your phone, and the only copies that ever leave the app are ones you deliberately send yourself.
The short version. Your selfies are encrypted and stored on your device. We run no server that receives them. Remi sends us no analytics, crash reports, advertising identifiers or ads. You can use the whole app without an account; if you choose to sign in, we hold your email, a display name, your subscription status and your streak — and nothing else. Uninstalling the app permanently deletes everything stored on your phone. This website has no forms and runs no analytics. If you buy Remi Plus, Google Play handles the payment and keeps its own record of it — see Payments.
Your photos
- Daily photos are captured inside the app and encrypted with AES-256-GCM. The key is generated on your device and held in your phone's secure hardware (iOS Keychain / Android Keystore). It is never synced and never leaves your device — which is also why photos cannot be recovered on a different phone.
- Encrypted photos live in the app's own private storage. They are excluded from iCloud and Google cloud backups, and they are not added to your camera roll.
- The app performs no face detection, analysis, measurement, or scoring of any kind. The camera alignment guide is a static overlay — nothing is tracked or detected.
- We never read your existing photo library. The app has no permission to.
The two ways a photo can leave, both yours to choose
Sharing a before & after card. The card is composed on your phone from your own photos and handed to your phone's share menu only when you tap Share. You pick where it goes. Nothing is ever posted or sent automatically.
Saving a copy to your photos. If you tap Save to my photos, the app writes a plain, unencrypted copy into your phone's own photo library. That library sits outside the app, so if your phone backs your photos up to iCloud Photos or Google Photos, that copy goes with them. Your encrypted original stays inside Remi either way, and you can delete the saved copy from your photos whenever you like.
What the app sends us
If you have not signed in: nothing. Your settings, photos, streaks, calendar and routine history live only on your device, and the app sends us no analytics, usage data, crash reports, advertising identifiers or personal information at all. You can use every part of the first fourteen days this way, and you never have to sign in.
If you have signed in, the app sends the small amount listed under Signing in — an account identifier, your email, a display name, whether Plus is active, and your streak and day count — so that your subscription and your progress can follow you to a new phone. It still sends no analytics, no crash reports, no advertising identifiers, and no photos or anything derived from them, ever.
This website
This website is separate from the app. It has no forms, no email box, no tracking cookies, and no advertising or analytics scripts of any kind — so it collects nothing from you. (An email waitlist ran here until 30 August 2026; it closed when Remi launched. If you joined it and want your address removed rather than simply retired with the list, write to [email protected].)
Cloudflare, as the host, processes the usual request data (such as your IP address) to serve and protect the site. We do not build profiles from it, and we do not use analytics on this website.
Your streak and routine history
The app records which calendar days you finished a routine and which days you took a photo, so it can show your streak and your calendar. This is stored in an encrypted database on your device alongside your photos, and is never transmitted. It is deleted with the app.
Notifications
Remi can send two local reminders, both optional and both scheduled entirely on your phone. No server is involved, and no photo or personal information is sent anywhere.
- Your daily reminder, at a time you choose.
- An evening nudge, later the same day, only if you haven't finished your ritual yet. Whether the day is done is checked on your device only. You can turn this off on its own, and on Android it has its own notification channel so you can silence it without silencing the daily reminder.
Permissions we ask for
- Camera — to take your daily photo inside the app.
- Notifications — for the optional reminders above.
- Adding to your photo library — requested only if you tap Save to my photos, and it is add-only: the app can place a photo you chose into your library and still cannot read what is already there. On Android 11 and newer, no permission is needed at all.
The app does not request access to your contacts, location, microphone, or your existing photos.
Signing in, and what an account holds
Remi has an optional account. You can sign in with Google, or with an email address and a password. Its purpose is narrow: so that Plus follows you to a new phone, and so your setup and streak come back after a reinstall.
Signing in is never required. The whole first fourteen days — the daily photo, the compare, the Day 14 reveal — works without an account, and that is not going to change.
If you do sign in, we hold:
- Your email address — or, if you use Sign in with Apple and choose to hide it, Apple's private relay address instead of your real one.
- A display name, if you set one. It does not have to be your real name.
- An account identifier, and the link between your sign-in and that account.
- Your subscription status — whether Plus is active, so it can be restored on another device.
- Your onboarding answers — the preferences you chose during setup, such as your focus and how long you want to practise, so they return when you sign in on a new phone.
- Your streak and day count, and invite or challenge codes, if you join a challenge.
That list never includes photos, or anything derived from them — no thumbnail, no measurement, no descriptor. The photo promise at the top of this page is not conditional on whether you have an account. Your photos are encrypted to the phone that took them and cannot be moved, which is why signing in on a new phone brings back your streak but not your pictures.
If you create an account with an email address, we ask Firebase (Google) to send you a verification email and, if you request one, a password reset link. Sign-in itself is handled by Firebase Authentication; the rest is held on Cloudflare. Neither ever receives a photo.
None of this is used for advertising or tracking, and it is not shared with anyone. It is sent over an encrypted connection.
Payments
Subscriptions and the lifetime unlock are handled entirely by Google Play (and by Apple, if Remi is later sold on the App Store). We never see or receive your payment details, and there is no server of ours involved in a purchase.
Google does keep its own record of what you bought, under Google's privacy policy — that is what lets you restore Plus on a new phone. Remi asks Google whether your purchase is active and gets back yes or no; it receives no payment details and no other information about you. Restoring goes through your Google Play account, which is why keeping what you paid for does not depend on you signing in to Remi.
Deleting your data
On your phone. Everything the app stores on the device — photos, history, streaks and settings — is deleted permanently when you uninstall it. We never held a copy of any of it.
Your account. If you signed in, open You → Your account → Delete your account in the app. That removes your email, display name, saved setup and saved streak from our server. It does not cancel a subscription and does not touch anything on your phone — your photos and streak stay exactly where they are. There is more at Delete your account.
Your Google Play purchase history is held by Google, not by us, so we cannot delete it — manage or cancel a subscription in Google Play.
The one exception is anything you chose to send out yourself: a card you shared, or a copy you saved into your phone's photo library. Those sit outside the app and survive uninstalling it, so delete them where they live.
Children
Remi is not directed at children under 13 (or the equivalent minimum age in your region), and we do not knowingly collect any information from them — this version of the app sends us no information about anyone.
Changes to this policy
If we change this policy, we'll update this page and the "last updated" date above. Material changes — enabling community features, or anything that would alter what leaves your device — will be highlighted in the app's release notes before they ship.
Contact
zeepje.co · [email protected]