How Phialia handles your data

Short version: we collect only what the app needs to work. Your tasks are yours. The text you give the AI is used to create your tasks and for nothing else. No ads, no tracking cookies, no selling data.

Last updated: 2 October 2026

1. Who is responsible

The controller under the GDPR (Art. 4(7)) is:

Milad Yeganehfar
c/o MDC#1537
Welserstraße 3
87463 Dietmannsried
Germany
Email: hello@phialia.com

This policy covers the website phialia.com, the beta waitlist and the Phialia app for Android and iOS.

Part A: Website and waitlist

2. What we collect when you join the waitlist

Your email address (required).
Which phone you use: Android, iPhone or both (optional). We never ask for your phone number.
Where you came from, for example "tiktok", if you followed a link that says so.
When you gave and confirmed your consent, so we can prove it.

We do not store your IP address with your sign-up.

We use your email address to invite you to the beta and to tell you when the app is available. The legal basis is your consent (Art. 6(1)(a) GDPR). We keep the timestamps of your consent to be able to prove it (Art. 6(1)(f) GDPR). After you sign up, we send one email with a confirmation link (double opt-in). You are only on the list once you click it.

3. Visiting this website

When you open phialia.com or send the form, your browser transmits technical data such as your IP address, the time of the request and your browser type. Our hosting provider needs this data to deliver the site and to protect it against abuse. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Server logs are deleted after 7 days.

This site does not use cookies, analytics or any tracking tools.

Part B: The Phialia app

4. Your account

To use the app you create an account. We store your email address, your name and, if you sign in with Google, your Google account ID and profile picture. If you sign in with a password, we store it only as a secure hash, never in plain text.

If you choose "Sign in with Google", Google learns that you signed in to Phialia. Google processes this as its own controller under its own privacy policy.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

5. Your tasks

We store the tasks you create: titles, notes, due dates, reminders, categories and whether a task is done. This is the core of the app; we need it to show and sync your tasks across devices.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

6. AI features

When you use an AI feature (turning text into tasks, breaking a task into steps, sorting or categorizing), the text you entered is sent to an AI provider together with your current time and time zone, so that dates like "tomorrow evening" come out right. We do not send your name or email address.

The provider uses the text only to generate the result for you.
Under our contracts, the providers do not use this data to train their models.
Providers may keep requests for a limited time (for OpenAI up to 30 days) to detect abuse, and then delete them.

Voice input. If you add tasks by voice, the app records what you say and sends the recording to an AI provider (OpenAI, or Google Gemini as a fallback) to turn it into text. If neither is reachable, the speech recognition built into your phone is used instead, which may be processed by Google (Android) or Apple (iOS). We do not keep the recording on our server after it has been transcribed. The microphone is only active while you are recording, and you can refuse or revoke microphone access in your phone's settings.

Please don't enter or say anything in the app that you would not want processed this way, for example health details or passwords.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

7. Notifications

To send you reminders, the app registers your device with Firebase Cloud Messaging (Google) and we store the resulting device token. It identifies the app on your device, not you as a person. You can turn notifications off at any time in your phone's settings.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

8. Usage counts

We count how often you use the AI features, for example the number of requests per month. We need this to apply the limits of the free plan and to understand which features are useful. We do not use third-party analytics or advertising SDKs.

Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legitimate interest in improving the app (Art. 6(1)(f) GDPR).

9. Deleting your account

You can delete your account in the app's settings, or by writing to hello@phialia.com from the email address of your account. We then delete your account and all your tasks. Copies in our backups are overwritten within 30 days.

Part C: For everything above

10. Who receives your data

We only share your data with service providers who process it on our behalf under a data processing agreement (Art. 28 GDPR):

Hosting and database: IONOS SE, Germany
Sending emails: Heinlein Hosting GmbH (mailbox.org), Germany
AI processing: OpenAI (USA)
AI processing: Google (Gemini API)
Push notifications: Google (Firebase Cloud Messaging)

Your account and your tasks are stored on our server in Germany. We never sell your data or share it for advertising.

11. Transfers outside the EU

OpenAI and Google may process data in the USA. These transfers are protected by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, by the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

12. How long we keep it

Account and tasks: until you delete them or your account.
Waitlist entries: until you unsubscribe; unconfirmed sign-ups after 30 days; the whole waitlist at the latest 12 months after the public launch.
Server logs: 7 days.
AI requests at the provider: as described in section 6.

13. Your rights

You have the right to access your data (Art. 15), to correct it (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interest (Art. 21).

Where we rely on your consent, you can withdraw it at any time, with effect for the future (Art. 7(3)), for example with the unsubscribe link in our emails or by writing to hello@phialia.com.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority of the German state where you live.

14. Children

Phialia is not meant for children under 16. We do not knowingly collect data from them.

15. Security

All connections to our servers are encrypted (HTTPS). Passwords are stored only as hashes, and access to the server is restricted to us.

16. Changes

If we change how we handle your data, we will update this page and the date at the top. If a change affects you significantly, we will tell you in the app or by email.