Localia Privacy Policy

Effective Date: November 3, 2026 · Application: Localia (me.localia.app) · Data Controller: Bruno Sánchez-Andrade Nuño (support@localia.me)

1. Data Controller, Zero-Account Architecture & Infrastructure Processors

• Data Controller (GDPR Art. 13(1)(a)): Localia (published at https://localia.me under Android package identifier me.localia.app) is published as free, non-commercial software by Bruno Sánchez-Andrade Nuño (independent developer, European Union), reachable for all privacy and data-protection requests at support@localia.me.
• Zero Accounts & Zero Tracking Cookies: Localia requires no registration, sign-in, email address, or phone number. Our website localia.me sets 0 cookies and loads zero external scripts or fonts; only if you explicitly choose a language in the 🌐 language switcher does your browser store localStorage["localia_lang"] (one of the 9 supported 2-letter codes: en, es, ca, fr, de, it, pt, nl, pl) to remember your chosen interface language (strictly necessary user-requested UI preference under ePrivacy Directive Art. 5(3)).
• Infrastructure Processors & Verified Hosting Boundaries (GDPR Art. 28):
  • Cloudflare, Inc. (governed by Cloudflare’s GDPR Data Processing Addendum, EU-U.S. Data Privacy Framework, and Standard Contractual Clauses) serves static assets and executes localia.me/api/* against Cloudflare D1 database localia_zero_pii. Verified read-only D1 metadata records running_in_region = "WEUR" (Western Europe primary location hint), jurisdiction = null (no explicit Cloudflare jurisdictional lock), and read_replication = "disabled". Our Worker code disables Worker invocation logs (observability.enabled = false) and never reads or stores CF-Connecting-IP; standard Cloudflare edge transport/security handling (TLS termination and standard network error reporting headers) remains governed by Cloudflare’s DPA.
  • GitHub, Inc. (Voluntary Feedback Issue Mirror Only): When you explicitly submit a voluntary 👎 Feedback or web support report, our Worker also mirrors the scrubbed report into a private engineering issue on Localia-me/localia hosted by GitHub, Inc. (governed by GitHub’s GDPR Data Protection Agreement, EU-U.S. Data Privacy Framework, and Standard Contractual Clauses) solely for bug triage. An optional custom webhook capability exists in Worker code (FEEDBACK_WEBHOOK_URL) and is not configured in production. Opt-in daily usage counters are never sent to GitHub.

2. On-Device Personal Data & Android Permissions

All personal context features are 100% opt-in, disabled by default, and preceded by an explicit in-app Prominent Disclosure dialog before Android requests any runtime or special permission:

3. Network Traffic & The In-App Airlock

Every HTTP socket in Localia passes through a single auditable AirlockController using your phone’s system DNS resolver (Dns.SYSTEM) with cleartext HTTP disabled (cleartextTrafficPermitted="false"):

1. Offline by Default (Search online OFF): Out of the box, Search online is disabled, blocking 100% of outbound web search and URL sockets even while Wi-Fi or 5G is active.
2. Open-Weight AI Model Downloads (HTTPS GET Only): When you confirm downloading a .gguf model (and optional mmproj vision projector), your phone downloads the weights directly over HTTPS from Hugging Face CDN (huggingface.co / cdn-lfs.huggingface.co), verified by 64-character SHA-256 checksum. Standard HTTP headers (IP address, User-Agent) are visible to Hugging Face CDN during download.
3. Opt-In Search online & 1-Tap Web Lookup: Only when you enable Search online, tap a 1-tap web lookup action for a single prompt, or share/paste an https:// link while enabled, Localia sends a cookie-less (CookieJar.NO_COOKIES), credential-free HTTPS GET query identifying honestly as Localia/1.1 (+https://localia.me) to allowlisted public APIs/feeds — Wikipedia MediaWiki API (*.wikipedia.org), DuckDuckGo Instant Answer JSON API (api.duckduckgo.com), and Google News RSS (news.google.com) — or to the target https:// webpage (protected by SSRF private-IP guards). Your me.md memory, files, photos, and Connected Apps are never attached to web search queries.

4. Optional User Feedback & Strictly Opt-In Zero-ID Usage Stats

4.1 User-Initiated Feedback (👎 Feedback — Diagnostics Only by Default)

Nothing is sent unless you explicitly tap 👎 on a reply, in the Trust sheet, or in Settings → Feedback and confirm submission. Raw unredacted chat sending is disabled. Under GDPR Article 25 (Data Protection by Design and by Default), Localia defaults to Diagnostics only:

• Diagnostics only (Default): Sends 0 chat text—only your optional scrubbed note (<= 500 chars), issue category (wrong_answer, too_slow, cut_off_or_format, search_online, unsafe_or_offensive, app_or_ui, other), app version, coarse OEM bucket (12 closed values such as "Google", "Samsung", "OnePlus", or "Other"), SoC tier, RAM bucket, Android SDK, 2-letter UI language, catalog model ID (custom files are masked as "custom_gguf"), Search online state, and token speed.
• Anonymize & send (Optional user selection): If you actively switch to include the conversation turn, our on-device scrubber (LocalFeedbackAnonymizer) redacts email addresses, phone numbers, URLs with private paths/tokens, IBANs/payment cards, 2FA/OTP codes, API keys, @handles, and personal names listed in your local me.md (Identity & Key People), and truncates each snippet to <= 800 characters. Because automated scrubbing is best-effort, we display a sensitive-data warning and place the scrubbed text in editable text boxes so you can inspect or edit every word before sending, then run a second scrubbing pass before HTTPS transmission (capped at <= 4 KB).
• 30-Day Auto-Purge & Synchronized Deletion Receipt (fb_...): Every accepted report returns a random one-time deletion receipt token (fb_..., stored only on your phone inside your local Privacy Ledger; only its SHA-256 hash is stored in D1) so you can erase that submission immediately at localia.me/delete-data without an account. Redeeming your receipt or reaching the 30-day automatic retention limit deletes the D1 row and synchronously redacts and closes any mirrored private GitHub triage issue via a durable retry outbox (feedback_mirror_outbox).

4.2 Strictly Opt-In Daily Usage Rollups (OFF by Default · Cohort-Suppressed)

In compliance with GDPR Article 6(1)(a), Recital 26, and ePrivacy Directive Article 5(3), Anonymous usage stats is disabled (false) by default on both the Welcome screen and Settings → Advanced. Zero telemetry packets are ever sent unless you actively toggle it ON.

• Zero Persistent Device IDs, Ephemeral Hardware Attestation & Cohort Suppression: Localia never reads Android ID, Google Advertising ID (GAID), IMEI, MAC address, exact phone model name, or GPS location, and sends zero persistent device or cohort hashes. On devices supporting Android Keystore attestation, pings attach a single-request ephemeral key certificate chain (deleted from Android Keystore before transmission; 0 certificate bytes stored, with a Replay-deduped submission_id) to distinguish hardware-verified builds (approved_hw) from software/unverified builds (unverified_fallback) across "play" vs "sideload" channels. Opted-in phones flush at most once per UTC calendar day (<= 2,048 bytes). Our Worker atomically increments a daily aggregate row (telemetry_daily_rollup) and discards the individual request. Because rare combinations of version, OEM, SoC, RAM, SDK, language, and model could otherwise form small cohorts (GDPR Recital 26), reporting endpoints enforce a k >= 5 minimum-ping threshold (merging cells with fewer than 5 pings into a suppressed bucket) and treat un-suppressed cells conservatively under a 90-day retention cap rather than claiming absolute mathematical anonymity from absent IDs alone.
• Instant Withdrawal: Toggling Anonymous usage stats OFF in Settings → Advanced immediately halts all pings and wipes local daily counters.

5. 100% Free Non-Commercial Software (0 €)

Every feature in Localia is 100% free (0 €) with no Pro tier, no subscriptions, no in-app purchases, no Google Play Billing SDK in the app binary, and zero financial or billing data collected.

6. Data Retention, Instant Deletion & Your Privacy Rights

• Instant Local Deletion: Delete individual chats, Saved notes, or me.md facts in 1 tap, disconnect any Connected App in Settings → Connected Apps, or uninstall Localia to erase all AES-256-GCM keys and local data permanently.
• Self-Service Feedback Erasure & Short Retention: Erase any voluntary Feedback report instantly using your fb_... receipt token at localia.me/delete-data (or email support@localia.me), which deletes the D1 record and redacts/closes any mirrored private GitHub triage issue. Unclaimed feedback rows auto-purge after 30 days; cohort-suppressed daily aggregate rollups auto-purge after 90 days.
• GDPR, LOPDGDD & CCPA Rights: Depending on your jurisdiction, you have the right to access, rectify, erase, restrict, or port personal data, withdraw consent at any time without affecting prior lawful processing, confirm that we never “sell” or “share” personal information for cross-context behavioral advertising, and lodge a complaint with your national data protection supervisory authority in the European Union (such as the Spanish Data Protection Agency, AEPD, at aepd.es, or your local EU supervisory authority).

7. Children’s Privacy & Policy Updates

Localia is not directed to children under 13 (or the minimum digital consent age in your country, such as 14 in Spain or 16 where applicable in the EU). Material updates to this Privacy Policy will be posted at https://localia.me/privacy/ with an updated Effective Date. Questions: support@localia.me.