Privacy Policy

1. Scope and contact

This policy explains how the developer of Cactus ("Cactus," "we," "us," or "our") handles information when you use the Cactus iPhone application, website, and supporting AI service. For privacy questions or requests, email henrysong1205@gmail.com.

2. Information handled by Cactus

3. Local storage and backups

• Your Cactus archive is stored in the App's private Application Support directory on your iPhone and protected with Apple Data Protection while the device is locked.
• Cactus does not synchronize that archive to a developer-controlled account or database.
• Your archive remains until you delete it in Cactus, replace it by importing another archive, or delete the App.
• If you export a backup, you choose where it is shared or stored. The privacy and security of that exported copy depend on the destination you select.

4. AI and voice processing

AI features require network processing. Depending on what you ask, Cactus may send your current message, up to 20 recent chat messages, relevant saved task and memory summaries, your optional display name, locale, language, and date or time-zone context through our backend to OpenAI. Cactus sends a voice recording and language code when you request transcription.

• The Cactus backend runs on Vercel and is designed as a stateless proxy; it does not write request bodies to a Cactus application database.
• Temporary voice files are deleted from the App after transcription finishes or fails.
• OpenAI states that API inputs and outputs are not used to train its models by default unless the API account holder opts in.
• OpenAI may retain prompts, responses, audio, and related metadata in abuse-monitoring logs for up to 30 days, unless longer retention is legally required or needed to protect its services or others.

Learn more in OpenAI's API data controls.

5. How we use information

• Provide transcription, AI conversation, memory retrieval, task organization, and smart follow-up suggestions.
• Import and synchronize calendar items when you request it.
• Display your subscription status and restore eligible purchases.
• Secure, debug, and prevent abuse of the AI service.
• Comply with law and enforce our Terms of Use.

6. Service providers and disclosures

We disclose information only as needed to operate Cactus:

• OpenAI processes text and audio to produce transcriptions and AI responses.
• Vercel hosts the Cactus backend and may process network, security, and infrastructure logs under its own privacy terms.
• Apple provides App Store distribution, StoreKit subscriptions, device permissions, and Apple Calendar integration.
• We may disclose information if required by law, to protect rights or safety, or in connection with a business transfer where permitted by law.

We do not sell personal information, share it for cross-context behavioral advertising, or provide it to data brokers. Cactus does not include third-party advertising SDKs or behavioral analytics SDKs.

7. Retention and security

• Local archive data is retained on your iPhone as described in Section 3.
• Backend rate-limit counters are held temporarily in memory. Infrastructure providers may retain operational logs under their own policies.
• AI-provider retention is described in Section 4.
• We use HTTPS, ephemeral App networking sessions, request-size limits, rate limits, and local file protection. No system can be guaranteed completely secure.

8. Your choices and rights

• View, edit, export, or delete your local archive from the App.
• Turn microphone or calendar permission off in iOS Settings.
• Manage or cancel subscriptions in your Apple Account settings.
• Contact us to exercise privacy rights available in your jurisdiction. We may need to verify your request.

Because most Cactus data is stored only on your device and there is no Cactus account, we may not possess or be able to identify a server-side copy of your local archive.

9. International processing

OpenAI, Vercel, and Apple may process information in the United States and other countries where they operate. Those countries may have different data-protection laws than your location. Their processing is governed by their applicable contractual and legal safeguards.

10. Children

Cactus is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information through the online service, contact us so we can review the request.

11. Changes to this policy

We may update this policy when Cactus, our providers, or legal requirements change. We will post the revised policy with a new effective date and provide additional notice in the App when a material change requires it.