Effective date: 9 October 2026
Last updated: 9 October 2026
Applies to: the Clarta iOS app (bundle identifier com.sdx.Clarta)
store: false, Zero Data Retention) and does not use it for training.The rest of this document is the detail.
Clarta is published by Pavel Koval (the “controller” under the GDPR).
Contact: evoke-support@proton.me
You choose what Clarta sees: a page you scan with the camera, a photo you pick, or a PDF/image you open in Clarta. Clarta asks for camera access only to scan. It does not need access to your photo library — the system photo picker hands over only the images you select.
To write the explanation, Clarta sends the redacted text and redacted, reduced-resolution page images (longest edge 1024 px, up to six pages) to OpenAI through our proxy (§2.5). The same applies to the free follow-up features you choose to use: questions about a letter, a full translation, re-explaining in another language or style, drafting a reply, a form-filling guide, a case summary and a general renewal guide for a document type (which contains only the document type and country).
Cloud explanations need your consent, asked in onboarding or before your first explanation. You can withdraw it at any time in Settings › Privacy & security › How your letters are processed; letters already explained stay on your iPhone.
OpenAI processes the redacted request to generate the answer, in an OpenAI project with EU data
residency and Zero Data Retention. Requests are sent with store: false. OpenAI does not use
API data to train its models.
Requests pass through a small proxy we run on Cloudflare Workers so that no API key is shipped in the app. The proxy verifies that a request comes from a genuine copy of Clarta (Apple App Attest), counts requests per device per day to prevent abuse, and forwards the request to OpenAI. It does not store request contents and does not log them.
The cloud answer contains placeholders such as ⟦IBAN_1⟧. Clarta replaces them with the real values on your iPhone — for example to show the account to pay, or your name and address in a reply letter.
On your device (and in your private iCloud database if iCloud sync is on): page images, recognised text, explanations, deadlines, cases, notes, replies and their PDFs, form answers, Wallet documents and their photos, vocabulary, household members, your details and your signature. We cannot access any of it. You can export it (Settings › Privacy & security › Export my data) or delete it (Delete all data). Turning iCloud sync off keeps the data on this iPhone only.
Your purchased letter balance is stored in your iCloud Keychain so it survives a new phone; it is not deleted by “Delete all data”.
Purchases are handled by Apple. We never see your payment details. The app records which product was bought, its price and currency, and the App Store country, to keep your balance correct and to report revenue in analytics (§5).
Clarta uses Google Firebase (Analytics, Crashlytics, Performance, Remote Config), Amplitude (EU data centre) and Meta’s Facebook SDK (App Events) to understand how the app is used and to fix crashes. Events describe actions and their outcome — for example that a letter was explained, how many pages it had (as a band), how long it took, whether a deadline was found, and which plan is active. Your country, region, app language and explanation language are sent as settings.
No letter text or images, no authority names, no amounts, no reference numbers, no deadlines or dates from letters, no scam notes, no glossary words, no reply text, no names or contact details, and no record identifiers. Numbers are sent as ranges (“2–3 pages”), never as raw values from a letter.
Clarta asks once whether you allow tracking. If you allow it, Firebase and Facebook may receive your device’s advertising identifier to measure which ads bring people to Clarta. You can change this at any time in iOS Settings › Privacy & Security › Tracking.
| Provider | Purpose | Data |
|---|---|---|
| OpenAI (EU, ZDR) | Writing explanations and the other cloud features | Redacted letter text and redacted images |
| Cloudflare | Proxy between the app and OpenAI | The same redacted request, in transit only |
| Apple | Purchases, iCloud sync, App Attest | As per Apple’s privacy policy |
| Google Firebase | Analytics, crash reports, performance, remote settings | Usage events, crash data, device identifiers |
| Amplitude (EU) | Product analytics | Usage events |
| Meta (Facebook SDK) | Measuring ad campaigns | Usage events; advertising identifier only if you allow tracking |
Letters and everything derived from them stay on your devices until you delete them. OpenAI and our proxy keep no copy. Analytics data is kept by the providers for their standard retention periods (Firebase and Amplitude: up to 14 months for event data).
You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent at any time. Because your letters and details are stored only on your devices, you can exercise most of these rights directly in the app (export and delete). For analytics data, contact us (§1). You can also lodge a complaint with your data protection authority.
California residents (CCPA/CPRA): we do not sell personal information. If you allow tracking, the advertising identifier may be shared with Meta and Google for ad measurement; you can refuse in iOS.
OpenAI processing takes place in the EU. Analytics providers may process data outside your country, including in the United States, under the EU Standard Contractual Clauses or equivalent safeguards.
Clarta is not directed at children under 16.
Personal details are hidden before any upload; outgoing requests are checked again before sending; the proxy accepts only requests from genuine copies of Clarta; all traffic is encrypted (TLS). You can protect the app or the Wallet with Face ID (Settings › Privacy & security › Face ID lock).
Clarta explains letters. It does not give legal advice.
We will update this page when the app changes how it handles data, and bump the dates above.
Pavel Koval — evoke-support@proton.me