Privacy Policy

ForLater is built to know as little about you as possible.

Who we are

ForLater is made by 128 Characters Software. For anything privacy-related, write to support@forlater.app.

Your account

You sign in with a passkey. We never ask for — and cannot store — your email address, phone number, or real name. An account is a randomly generated identifier plus the public half of your passkey: the credential ID, its public key, a signature counter, the authenticator model identifier, and timestamps. The private key never leaves your device.

Each device you use gets a random identifier generated by the app — never a hardware or advertising identifier — along with its platform (Android, iOS, or desktop). Sign-in sessions expire after 30 days; logging out revokes the device's session.

Optionally, you can link a sign-in from another provider (such as a Google account) as a way to recover access to your account. If you do, we keep only an anonymous reference derived from that provider account — enough to recognize it when you return, but not your email address, name, or profile. Recovery linking is entirely optional; passkeys alone always work.

What you save

When you share an article to ForLater we store the link, your tags and notes, whether you starred it, and the content we prepare from the article so the app can show it to you — such as its title, the summary our AI generates, and a link to its preview image. Our server fetches the page to produce these. Your bookmarks sync to the devices signed in to your account and to no one else.

AI processing

To generate summaries, the fetched page text and its link are sent to an external AI service provider. Nothing that identifies your account goes with them, and we do not use your content to train AI models.

Analytics, crashes, and notifications

We use Firebase Analytics (Google) with a small, fixed set of events — screen views, onboarding steps, and similar product signals. Analytics never receives your bookmarks, notes, or any content, we do not attach your account to it, and the advertising ID is not collected: it is disabled and removed from the app entirely. Crash reports (Firebase Crashlytics, Android only) are not linked to your account.

If you enable notifications, we store your device's push token and deliver notifications through Google and Apple's push services. The messages carry only a "something is ready" signal — never the content of what you saved.

Purchases

Subscriptions are handled by the App Store or Google Play — we never see your payment details. A purchase-verification provider processes subscriptions on our behalf and receives your account's random identifier and the store's transaction references, nothing more. If you redeem a promo code, we record the attempt with your IP address for abuse prevention and keep it for up to 90 days.

How long we keep things

Deleted bookmarks are removed from your devices immediately and purged from our server within 30 days (the delay lets your other devices learn about the deletion). Billing audit records and promo-code attempts are kept for up to 90 days. Internal housekeeping data lives at most a few days. These windows are enforced automatically.

Deleting your account

In the app, open Settings → Account → Delete Account. This permanently removes your account, every bookmark, summary, note, and passkey record, and your billing entitlement — on our server and on your devices. It cannot be undone. If you have an active subscription, deleting your account does not cancel it: manage it in your app store's subscription settings.

To request deletion without using the app, write to support@forlater.app. We can only act on requests we can tie to an account: if you subscribe, send the order ID from your App Store or Google Play receipt. Because ForLater accounts are secured by a passkey and we store no email address or other personal identifier, an account whose passkey is lost and which has no subscription cannot be identified by us, and we cannot delete or restore it.

Your bookmarks, summaries, notes, and passkey records are purged from our server within 30 days. Billing audit records and promo-code attempts are kept for up to 90 days, because we are required to retain them for accounting and abuse prevention.

Your rights

Depending on where you live (for example under the GDPR), you have the right to access, correct, export, and erase your data, and to complain to your data-protection authority. Most of this you can do yourself in the app; for the rest, contact support@forlater.app.

Children

ForLater is not directed at children and we do not knowingly collect data from them.

Changes to this policy

If this policy changes, the update appears on this page with a new effective date. Material changes will be called out in the app.

Effective 1 September 2026.