Privacy Policy

ForLater is built to know as little about you as possible.

Who we are

ForLater is made by 128 Characters Software. For anything privacy-related, write to support@forlater.app.

Your account

You sign in with a passkey, a Google account, or an Apple account. We never store your full email address, phone number, or real name. An account is a randomly generated identifier plus the sign-in methods you add. For a passkey we keep its public half: the credential ID, its public key, a signature counter, the authenticator model identifier, and timestamps. The private key never leaves your device.

Each device you use gets a random identifier generated by the app — never a hardware or advertising identifier — along with its platform (Android, iOS, or desktop). Sign-in sessions expire after 30 days; logging out revokes the device's session.

For a Google or Apple account we keep an anonymous reference derived from that account, enough to recognize it when you return. If the provider shares a verified email address, we also keep a masked hint of it (such as a•••@gmail.com), so you can tell your sign-in methods apart in Settings, and a keyed hash of it, so that our support can find your account if you write to us from that address. We never keep the full address, your name, or your profile; the provider may send them with a sign-in, and we discard them at once. If you use Apple's Hide My Email, we only see the relay address. For Sign in with Apple we also keep a token Apple issues, used only to end ForLater's access to your Apple Account when you remove Apple as a sign-in method or delete your account. You can add or remove sign-in methods in Settings, as long as one is left.

What you save

When you share an article to ForLater we store the link, your tags and notes, whether you starred it, and the content we prepare from the article so the app can show it to you — such as its title, the summary our AI generates, and a link to its preview image. Our server fetches the page to produce these. Your bookmarks sync to the devices signed in to your account and to no one else.

AI processing

To generate summaries, the fetched page text and its link are sent to an external AI service provider. Nothing that identifies your account goes with them, and we do not use your content to train AI models.

Analytics, crashes, and notifications

We use Firebase Analytics (Google) with a small, fixed set of events — screen views, onboarding steps, and similar product signals. Analytics never receives your bookmarks, notes, or any content, we do not attach your account to it, and the advertising ID is not collected: it is disabled and removed from the app entirely. Crash reports (Firebase Crashlytics, Android only) are not linked to your account.

If you enable notifications, we store your device's push token and deliver notifications through Google and Apple's push services. The messages carry only a "something is ready" signal — never the content of what you saved.

Purchases

Subscriptions are handled by the App Store or Google Play — we never see your payment details. A purchase-verification provider processes subscriptions on our behalf and receives your account's random identifier and the store's transaction references, nothing more. If you redeem a promo code, we record the attempt with your IP address for abuse prevention and keep it for up to 90 days.

How long we keep things

Deleted bookmarks are removed from your devices immediately and purged from our server within 30 days (the delay lets your other devices learn about the deletion). Billing audit records and promo-code attempts are kept for up to 90 days. Internal housekeeping data lives at most a few days. These windows are enforced automatically.

Deleting your account

In the app, open Settings → Account → Delete Account. This permanently removes your account, every bookmark, summary, note, passkey record and sign-in method, and your billing entitlement — on our server and on your devices. It cannot be undone. If you have an active subscription, deleting your account does not cancel it: manage it in your app store's subscription settings.

To request deletion without using the app, write to support@forlater.app. We can only act on requests we can tie to an account: write from the email address of a Google or Apple account you sign in with, if that provider shared it with us, or, if you subscribe, send the order ID from your App Store or Google Play receipt. An account that only uses a passkey carries no personal identifier, so if its passkey is lost and it has no subscription, we cannot identify it, and we cannot delete or restore it.

Your bookmarks, summaries, notes, and passkey records are purged from our server within 30 days. Billing audit records and promo-code attempts are kept for up to 90 days, because we are required to retain them for accounting and abuse prevention.

Your rights

Depending on where you live (for example under the GDPR), you have the right to access, correct, export, and erase your data, and to complain to your data-protection authority. Most of this you can do yourself in the app; for the rest, contact support@forlater.app.

Children

ForLater is not directed at children and we do not knowingly collect data from them.

Changes to this policy

If this policy changes, the update appears on this page with a new effective date. Material changes will be called out in the app.

Effective 22 October 2026.