Effective 28 September 2026
fatto. is made by ClearVista, a small software studio in California. The app is built to keep your photographs on your device. That choice makes this page short: in almost every case we cannot see your information, because it never reaches us.
Version 1.2 added an account, for sending moments to people nearby and finding friends who use the app, and from version 1.3 the app asks you to sign in when it opens. The account puts a few things in a directory. The sections on signing in, contacts and nearby say exactly what, and why.
Photographs are made in the app and kept on the device. There are no servers of ours, and no analytics or advertising code in the app.
Backing up to iCloud is on by default. It writes to the private database of your own iCloud account, which we have no access to. Turning the switch off stops new copies going up. What has already reached your iCloud stays there, in your own account, until you remove it.
If you allow location, it is read only while the camera is open, and it is written into the photograph's own metadata the way any camera records it. If you add a place where you want to be discoverable, the app also checks, while it is open, whether you are at that place. Places are kept on the device and are not sent anywhere. Declining location changes nothing else about how the app works.
Nothing is written to your photo library unless you ask for it, either by saving a single photograph or by turning on the switch that keeps originals in Photos.
A photo you choose for yourself, under Account in Settings, is kept on the device. It is not sent to anyone, it is not part of the directory, and it is not part of the app's own iCloud backup; a backup of the phone restores it like any file of the app's.
From version 1.3 the app asks you to sign in with Apple when it opens, before the ledger. Version 1.2 asked only when you turned on nearby sharing or looked for friends. Signing in is what lets the people you send moments to know they are from you, and lets friends find you.
You sign in with Apple. From Apple the app receives an identifier for your account and, if you choose to share them, your name and your email address. You can also type a phone number. These are kept on your device.
So that friends can find you, the app writes an entry to a directory in the public database of the app's own iCloud container, which Apple runs. The entry holds the name you give; an identifier derived from your Apple account, not the account itself; a key your phone uses to prove it is you when you send a moment; and a scrambled form (a hash) of your email address, if Apple shared a real one, and of your phone number, if you typed one.
Anyone using fatto. can ask the directory about a hash they already hold and learn the name and key that go with it. The directory cannot be listed or searched. A hash of a phone number can be reversed by someone who tries every possible number, so treat a number you add as findable by people who use the app.
After you sign in, and whenever you look for friends, iPhone asks whether the app may read your contacts; on iOS 18 and later you choose which ones, and you can skip the question. The app reads names, phone numbers and email addresses, and nothing else on a card. The cards stay on your device. To find out who has fatto., the app turns each number and email into a hash on your device and asks the directory about those hashes. The directory answers and keeps nothing about the question. Your contacts are not uploaded, not stored by us, and not used for anything else, and nothing is sent to anyone in them unless you choose names and send each message yourself in Messages, one at a time.
If you turn on "Be discoverable", phones near you with fatto. open can see your name while the app is open on yours. You choose who: everyone, or only contacts who can be matched to you through the email address Apple verified. A place you add turns this on while you are there.
A moment you send goes directly from your phone to the other phone, over Bluetooth and Wi-Fi, encrypted. It does not pass through us or through any server. The photograph is sent without its location. The other person has to accept it first, and then it is theirs, in their own ledger.
If someone sends you something you do not want, you can decline it, block them, or report them. A report opens an email to us carrying their identifier, so that we can look into it.
The app's own network activity is Apple's, plus one direct connection between phones. CloudKit carries your moments to the private database of your iCloud account and back and, if you signed in, carries your directory entry and your friends lookups to and from the app's public database. StoreKit asks the App Store, at each launch, for the prices and for whether a subscription is active on this device, and carries a purchase when you make one. A moment sent nearby goes phone to phone. There is no server of ours anywhere in it.
A purchase is handled by Apple end to end. We receive no card number and no identity from it, only the fact that a subscription is active on the device.
Face ID, where the lock or a private moment uses it, is the device's own authentication. The app asks iPhone whether it was you and receives yes or no. No biometric data reaches the app, and none reaches us.
A reminder, and an anniversary note, is a local notification. It is scheduled on the device, it arrives from the device, and it never travels. An anniversary note for a private moment carries the moment's number and nothing else.
A private moment is hidden on the device by blur and Face ID. It is not encrypted differently from any other moment, and it is backed up like any other.
Settings, under Account, has "Delete account". It removes your directory entry and forgets the account on your device, and the app asks you to sign in again before the ledger opens. Every moment stays in your ledger; it was never the account's. To stop Apple sharing your sign in with the app as well, remove fatto. under Sign in with Apple in your Apple Account settings.
Downloads and subscriptions run through Apple, under Apple's own privacy policy. Apple shows us aggregate numbers about our apps. It does not show us who you are.
If you write to us at founder@clearvista.ai, we receive your address and whatever you send, and we use them to reply. We do not keep mailing lists.
When this page changes, the date at the top changes with it.