Privacy policy

Last updated: 24 October 2026

then i said is operated by Ehsaan Qadir, c/o POSTFLEX PFX-287-309, Emsdettener Straße 10, 48268 Greven, Germany. Ehsaan Qadir is the controller responsible for the personal information described in this policy.

For privacy questions or requests, email support@thenisaid.com. Please do not email passwords, sign-in links or private recordings.

This policy covers the then i said app and its support website. The app helps you record, organize and privately share voice memories.

Information you provide

Your account. We process your email address, account identifier, display name and username to sign you in and maintain your account. Email sign-in uses a link rather than an app password. If you choose Apple or Google sign-in, that provider supplies the identity information authorized through its sign-in flow.

Your memories and people albums. We store the audio you save, together with its title, notes, tags, question, duration, timestamps and the person it is about. People albums can contain names, relationship labels and an optional avatar photo, emoji or color. Selecting an avatar uploads that selected image, not your whole photo library. The app does not import your phone's contacts.

Memories can include information about other people. Only record and share content you are entitled to use, including other people's voices and information. Do not use the service to disclose someone's sensitive information without an appropriate lawful basis.

Sharing. Memories start private. When you choose to share, we process the selected recipient, sharing permissions, requests and history needed to deliver the memory. Recipients can see the memory and the sender details shown in the sharing interface. We also store the recipient's person-album attachment, read state and any blocking or reporting information. Information about you may also come from another user who records or shares a memory involving you.

Removing someone's access prevents further access through the app. It cannot erase a copy made outside the service or information someone has already heard. Deleting a memory or account can leave an unavailable entry in a recipient's Inbox history.

Feedback and support. If you send feedback in the app, your message, app version, build and operating-system version go through our backend to Linear, our support-ticket service. Your account email is attached only when you select the checkbox allowing us to contact you. Audio, screenshots, profile names and usernames are not automatically attached. Any personal information you type into the message is included. Email sent to support is processed by our email provider, Namecheap Private Email.

Device information and app activity

If you enable notifications, we process an installation identifier, notification token, permission status, reminder preferences, time zone and delivery/open status to send the question reminders and shared-memory alerts you request. You can change these preferences in the app or turn off notifications in iPhone Settings.

The app records account-linked events such as creating, opening, sharing or revoking a memory and failures during sign-in, recording or sharing. These events can contain a memory identifier, a timestamp and limited technical context. We use them to understand whether the app works and investigate problems. Supporting services can process IP addresses, request logs, device/operating-system details and SDK diagnostics. Expo's update service can process update and crash/error-recovery information.

Firebase App Check and Apple's App Attest process app-integrity information to help distinguish legitimate app requests from abuse. This does not mean that your recordings are end-to-end encrypted.

The share dialog can keep up to ten recent recipients' usernames and display names locally on your device, separately for each signed-in account. This list is not synchronized across devices. You can remove individual entries or clear it in the share dialog.

Our static website has no account-registration form, advertising scripts or analytics cookies. Hosting can still process ordinary technical request information, such as an IP address, requested page, browser information and access time, to deliver and protect the website. If you follow an external link, that destination has its own privacy practices.

Why we use information

We use information to provide the account, recording, storage, playback, organization and selected-recipient sharing features you request. Where the GDPR applies, processing necessary to provide these services is based on Article 6(1)(b).

We use limited operational information to protect accounts, prevent abuse, troubleshoot failures, respond to support requests and improve reliability. This is based on our legitimate interests in operating a safe, functioning service under Article 6(1)(f). You can object to processing based on legitimate interests; see Your rights below.

Optional notification choices and inclusion of your email for feedback follow-up are based on your consent under Article 6(1)(a). You can withdraw those choices at any time by changing the relevant setting or contacting us. Withdrawal does not affect processing that was lawful before withdrawal. We may also process or retain information where necessary to meet a legal obligation under Article 6(1)(c) or establish, exercise or defend legal claims.

Account information needed for sign-in is necessary to provide the service. Optional notifications, avatars and feedback are not required to record and organize memories. We do not sell personal information, use your memories for targeted advertising, or make decisions producing legal or similarly significant effects about you solely through automated processing.

Services that process information

We use Google Firebase and Google Cloud for authentication, app data, audio/avatar storage, server functions and app-integrity checks; Expo for app updates and notification delivery; Apple for Apple sign-in, app attestation and iPhone notifications; and Google sign-in if you choose it. Linear processes feedback tickets. Namecheap Private Email processes support email. People you explicitly share with receive the shared content.

We may disclose information when required by law, to respond to a valid legal request, or where necessary to protect users and the service. We do not make memories publicly available as a social feed.

Providers may process information outside your country, including in the United States. The app database and recording storage are configured in European regions, but this does not mean that every authentication, notification, support or diagnostic service processes information only in Europe. International transfers require applicable safeguards; depending on the provider and service, these can include an applicable adequacy decision or standard contractual clauses. Contact us for information about the safeguards relevant to your data.

You can read more about the providers' practices in the Firebase data-processing terms, Expo privacy policy, Apple privacy policy, Google privacy policy, Linear privacy policy and Namecheap privacy policy.

Retention and deletion

Your account, saved memories and people albums remain until you delete them or your account, subject to necessary security and legal retention. You can delete an owned memory in the app. This removes its sharing access and starts cleanup of related audio and app records. You can initiate account deletion from Settings; sign-in verification and a final confirmation protect against accidental or unauthorized deletion.

Cleanup can involve asynchronous retries. A deleted recording can remain recoverable within the storage provider's seven-day soft-delete period even after it is unavailable through the normal app. The configured application-log retention is 30 days; the provider's required audit-log retention is 400 days. Completed account-deletion operation markers become eligible for automatic removal after 24 hours; removal is asynchronous.

Recipient Inbox history can retain an unavailable entry after a memory is deleted. Account deletion replaces the sender identity in retained recipient history with a deleted-account entry rather than deleting someone else's entire history.

Feedback tickets, support correspondence and safety reports can remain after account deletion and are not automatically erased from every support system. We retain these records according to the need to handle the request, investigate abuse, maintain security or resolve a legal matter. There is no fixed automatic expiry for all such records. You can ask us to review and delete support information that is no longer needed. Technical retry and rate-limit records are retained for their operational purpose; an expiry field does not necessarily mean immediate physical removal.

We do not promise that deletion immediately removes all provider backups, recovery copies or legally required records. Where retention is required, information is kept for that purpose rather than made available as an active memory in the app.

Your choices and rights

You can choose what to record and share, remove recipients' access, change optional notifications, remove avatar images, clear recent recipients and delete memories or your account. If information in a memory concerns you even though you do not have an account, you can contact us too.

Where applicable law provides these rights, you may request access to your personal information, correction, erasure, restriction of processing or a portable copy. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. These rights can have legal limits, including protecting other people's rights and information we must retain by law.

Send requests to support@thenisaid.com. We may need to verify that you are entitled to make the request, but do not send us a password or sign-in link. We respond within the time limits required by applicable law.

You can complain to your local data-protection authority. In Germany, you may contact the State Commissioner for Data Protection of Lower Saxony.

Changes to this policy

We update this policy when the service or its data practices change. The current version and update date are available on this page. Where the law requires additional notice or a new consent, we will provide it.