Attimo Privacy Policy

Effective date: 25 September 2026

Attimo is a private voice inbox operated by Giovanni Piller Cottrer, an individual developer established in Italy (the Developer or I).

Privacy contact: support@helloattimo.com

Information Attimo processes

To provide the features you choose, Attimo may process:

• your audio recording and basic recording details;
• its transcript, language, generated title, summary, Notes, action indication, and the source/model information stored with generated content;
• edits you make to Notes;
• dates, lifecycle state, and identifiers needed for storage and synchronisation;
• Tags, Tag descriptions, assignments, profiles, and suggestions;
• if you use Shortcut Automations, the exact name of the Shortcut you select, its opaque assignment identifier, and short-lived opaque identifiers needed to select or run it;
• if you create or share a Moment link, the opaque Moment identifier contained in that link; and
• if you allow Location Services and use a feature that supports location enrichment, one location requested after a Moment is saved, including its coordinates, accuracy, time, and a place or point-of-interest name returned by Apple Maps.

You decide what to say and which Tags to create. Attimo does not ask for health, political, religious, sexual-orientation, or other special-category information, although a free-form recording may contain it.

Attimo uses this information to record, transcribe, analyse, organise, search, play, synchronise, restore, delete, create or edit Notes, and run the Shortcut Automations you request for Moments.

Legal bases

Under the GDPR, Attimo relies on:

• performance of the service you request (Article 6(1)(b)) for Attimo’s core features;
• your consent (Article 6(1)(a)) for optional location, which you may withdraw in Settings without affecting earlier lawful processing;
• the Developer’s legitimate interests (Article 6(1)(f)) in testing, securing, diagnosing, and improving Attimo with limited beta and diagnostic information; and
• compliance with legal obligations (Article 6(1)(c)) where applicable.

Storage and iCloud synchronisation

Attimo stores its library and audio in private app storage. Information may move privately between paired Apple devices when needed. Apple may include local Attimo data in a device backup according to your settings; this is separate from Attimo synchronisation. See What does iCloud back up?.

When your current system iCloud account is available, Attimo automatically synchronises metadata and stores immutable media under exact identifiers for on-demand retrieval in your CloudKit Private Database, not a public or shared database. Attimo does not offer a separate account picker or manual synchronisation control. The Developer operates no Attimo account, backend, or content server and cannot browse users’ private databases.

Sensitive Moment, location, and Tag content, plus the selected Shortcut name, are stored in CloudKit fields configured as encrypted; audio is stored as an encrypted CloudKit asset. Apple necessarily processes service metadata to operate CloudKit.

iCloud data is encrypted in transit and on Apple’s servers. With Advanced Data Protection, CloudKit encrypted fields and assets are end-to-end encrypted; without it, Apple manages the relevant recovery keys. Not all iCloud data is always end-to-end encrypted. See Apple’s iCloud data security overview.

Attimo remains usable locally when iCloud is unavailable. If you change the system iCloud account, Apple’s frameworks determine how the local managed store changes. Attimo does not identify accounts, migrate a library between accounts, or promise that locally retained data will remain available across an account change.

Audio, transcription, and AI

Attimo records only after you start a capture and grant microphone access. Cancelling does not create a Moment. Saved audio remains with the Moment until permanent deletion.

Transcription uses Apple’s on-device Speech framework. Apple may download speech-model assets, but Attimo does not send recordings to a transcription server. Eligible devices use Apple’s language models for generated content. Tag matching stays on device.

Private Cloud Compute is the default model for eligible AI-assisted generation and analysis features. For example, Attimo may perform these features while processing a new Moment or when you explicitly request them. It sends only the bounded Moment text needed for the result, its language context and Attimo’s generation instructions to Apple’s Private Cloud Compute service. It does not send the audio recording, location, Tags, Moment identifier or account credentials with that request. Attimo will update this policy before PCC receives additional categories of personal data or is used for a materially different purpose.

You can choose On-Device in Settings → Intelligence to keep all model processing for these features on your iPhone. This preference is saved only on that iPhone. It does not turn off the separate private iCloud synchronisation described above. Network, service or account limits may cause an on-device fallback even when Private Cloud Compute is selected. Stored generated content identifies the model provider actually used.

Apple states that the content of Private Cloud Compute requests and responses is used only to fulfil the request, is not retained or made accessible to Apple, and is removed after the response is returned. Apple may collect limited non-content operational information, such as approximate request and response size, the feature used and request duration; Apple states that this information is not identifiable or linked to your Apple Account. Apple controls service availability and usage limits. See Apple Intelligence and privacy and Apple’s Private Cloud Compute security guide.

Generated content, edits you make to Notes, and associated source/model information are saved with the Moment and synchronised through your private iCloud library. Private Cloud Compute processing and CloudKit storage are different services with their respective Apple protections. Editing a transcript does not automatically request another analysis. You can choose Re-analyze; previous generated results and separate human overrides are preserved until a replacement succeeds. Permanent Moment deletion also removes its stored Notes and generated content. Attimo has no separate AI server or third-party model provider.

Search and system indexing

Search matches words and, when supported by the iPhone’s index and available Apple Intelligence features, meaning in active and archived transcripts.

Attimo builds a protected search index on this iPhone from active and archived Moment transcripts, capture dates, and user-owned Tag text. Audio recordings, media paths, generated Moment titles and summaries are not indexed. Typed queries go directly to Apple’s Core Spotlight search; Attimo does not use a language model to rewrite them and does not save query or result history.

The index is unavailable before the first unlock after a restart and remains available during later locked periods. Apple controls how indexed content is presented in system features. If you use Siri or Apple Intelligence with that content, Apple controls whether processing takes place on the device or through Private Cloud Compute under its applicable privacy terms. Attimo has no separate intelligence backend or third-party model provider.

Each iPhone builds its own index; results depend on that device’s library, indexing progress and available system features. Trash and permanently deleted Moments are excluded from in-app search immediately. Attimo requests system index updates for corrections and removals as it processes library changes; interrupted or failed updates are retried from the local library. This is not an immediate erasure guarantee across all devices or system surfaces.

Shortcut Automations

If you choose Shortcut Automations, Attimo associates a Tag and an opaque assignment identifier with the exact name of a user-owned Shortcut. That name and assignment may synchronise as private configuration in your CloudKit database; the name is stored as an encrypted field. A user-installed Attimo Shortcuts Helper selects and runs the Shortcut on the device.

Attimo launches the Helper with short-lived opaque capabilities. During selection, the capability and exact selected Shortcut name return to Attimo in an on-device callback URL handled between Shortcuts and Attimo. Those launch and callback URLs contain no Moment, Tag, transcript, or other Moment content, and a callback cannot itself record a successful automation run.

The Shortcut you control may request the scoped Moment information needed for that run. Actions you add to it may send that information to services you choose, subject to those services’ terms and privacy practices.

Attimo's Gallery offers optional example templates. Each becomes a user-owned Shortcut only after you add it. Before adding or running a template, review its actions, the Moment information it requests, and every destination in Shortcuts.

If a Shortcut sends information to an app or service you choose, that recipient independently determines how it collects, stores, retains, secures, uses, and shares the information under your account, settings, and its terms and privacy policy. Attimo does not control those practices and cannot retrieve or delete information held by the recipient. Attimo does not send that content to a Developer-operated service.

Moment links

Attimo can create a helloattimo.com link containing an opaque Moment identifier. The link contains no title, transcript, Tag, location, date, or audio and does not grant access to the Moment. An installed Attimo app resolves it only against that person’s available library and does not download Moment content from the website. If you share the link, its recipient or receiving service can see the identifier. If the link opens in a browser, ordinary website hosting infrastructure may receive the URL path and standard request metadata, but the website cannot retrieve the private Moment content.

Location

Where location enrichment is available, Attimo requests one location after saving a Moment only with When In Use permission. Location is optional and never prevents audio capture. Apple Maps receives the coordinate to return a place or point-of-interest name. The result is stored with the Moment and, if synchronised, in encrypted CloudKit content.

You may revoke permission in device Settings to stop future requests. This does not remove locations already saved with existing Moments; delete those Moments to remove that information.

Diagnostics, TestFlight, and the App Store

Attimo has no advertising, tracking, third-party analytics, or Developer-operated telemetry or crash-reporting service. Production logging uses fixed local messages and bounded counts; Attimo does not keep a user-facing diagnostic history or automatically upload logs or reports.

Apple separately operates TestFlight and the App Store. During TestFlight, Apple gives the Developer limited installation, session, device, operating-system, crash, and usage information. Email invitations may disclose the invited name and email; public-link testers appear anonymously. Submitted feedback includes your comment, chosen screenshot, and technical details. I use it only to test and improve Attimo and keep separate copies only while needed. Apple states that beta feedback is retained for one year and crash or usage data may remain until related bugs are resolved. See TestFlight & Privacy.

For App Store releases, Apple may provide crash and performance information under its services and your analytics choices.

Apple services and international processing

Attimo uses Apple services for CloudKit, Private Cloud Compute, Maps, Speech and on-device model assets, paired-device transfer, distribution, and platform diagnostics. Attimo does not sell your information or share Moment content for advertising.

Apple may process information outside the EEA and describes safeguards, including Standard Contractual Clauses, in its Privacy Policy. iCloud data remains subject to your Apple Account, settings, and Apple’s terms.

Retention and deletion

Moments remain until deleted; Archive is not deletion. A Moment in Trash remains recoverable for 30 days, then is permanently deleted at Attimo’s next safe opportunity. You may instead use Delete Now or Empty Trash.

Permanent deletion removes the Moment and its local media. Removal from your private CloudKit database requires connectivity and time for Apple-managed metadata deletion and Attimo’s exact-media deletion protection to complete, so it may not be immediate while a device is offline.

Deleting Attimo from one device does not itself delete synchronised copies. Use Attimo’s deletion controls first. Device-backup copies follow Apple’s controls.

Your GDPR rights

Where the GDPR applies, you may have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal data, and to withdraw location consent. Each right depends on the circumstances and legal basis.

Attimo’s controls are normally the direct way to view and delete Moment data. Because the Developer has no Attimo account database and cannot browse private CloudKit libraries, I may be unable to identify or retrieve a particular library from an email request. You may still contact support@helloattimo.com; I will explain the available options and respond as required by law.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante) or the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Changes

I will update this policy before materially changing how Attimo processes personal data. The effective date above identifies the current version.