EU AI Act Navigator · The Act · Web app · Terms · Support

Privacy Policy

EU AI Act Navigator · Last updated 2026-08-07

EU AI Act Navigator is built on a single principle: nobody but you can read your AI inventory — including us. An inventory of the AI systems an organisation uses is a map of its internal estate and its unmitigated legal exposure. Use the app without an account and nothing ever leaves your device. Turn on sync and your assessment is encrypted on your device first, with a key we never receive, so the copy we store is one we have no way to open.

What we collect

Without an account: nothing. The app works fully offline with no sign-up. In that mode there is no network traffic and no server involvement whatsoever.

With sync enabled we store, per account: your email address, an authentication credential derived from your passphrase, and one encrypted blob containing your assessment, plus the revision number and device identifier needed to sync it between your devices.

In neither mode do we collect, transmit, store, or have any access to the readable contents of:

the organisation, systems, or assessment facts you capture,
the classifications, registries, or action plans the app derives,
your voice or any audio from the guided interview,
the documents you export,
analytics, usage statistics, advertising identifiers, or crash telemetry.

How the encryption works

When you create an account, your passphrase is put through Argon2id on your own device and split into two independent keys:

an authentication key, which is sent to our authentication provider as your account password, and
an encryption key, which never leaves your device and is held in memory only for the duration of your session.

Your assessment is sealed with AES-256-GCM using the encryption key before it is uploaded. The two keys are computationally independent: learning the authentication key — which the server necessarily does — reveals nothing about the encryption key. The web app decrypts in your browser; the plaintext never exists on our infrastructure.

How two devices share a key without it ever being sent. The key is not transmitted or copied between your devices — it is re-derived independently on each one. Because the derivation is deterministic, entering the same passphrase on your iPhone and in your browser produces the identical key on both, without either device ever asking us for it. That is why the passphrase is the only thing that can open your vault, and why we cannot open it for you.

The consequence, stated plainly: we cannot reset your passphrase. There is no recovery process, no support override, and no back door. If you forget it, the synced copy of your assessment is permanently unreadable — by you, by us, and by anyone who compels us. That is the cost of the guarantee, and we would rather you knew it before you rely on it. Keep your passphrase in a password manager, and export your registry regularly.

Data processing and your rights

Where you use sync, we act as a data controller for your account email and as a processor of an opaque encrypted blob whose contents we cannot access. You can delete your account and that blob at any time from inside the app (Account › Delete account) or from the web app; deletion is immediate and permanent. Because the stored data is ciphertext we cannot decrypt, we are unable to produce its contents in response to any request — yours or a third party’s.

Our hosting and authentication provider is Supabase, with data stored in the EU. See Supabase’s privacy policy.

How the app works

Guided interview. Speech is transcribed using Apple’s on-device speech recognition. Where available, Apple’s on-device Foundation Models suggest structured facts from your description. Audio, transcripts, and suggestions all stay on your device.
Classification. Every classification is computed on your device from bundled methodology data. Nothing is sent to any server to be classified.
Storage. Everything you capture is stored locally in the operating system’s standard app storage. Without sync, deleting the app deletes it permanently and we hold no copy. With sync, we hold an encrypted copy that only your passphrase can open.
Export. Registry and action-plan documents are generated on your device and handed to the iOS share sheet. Where they go from there is entirely your choice.
Offline. The assessment works in airplane mode. No network connection is needed to capture, classify, or export — only to sync, if you have enabled it.

Subscriptions

Navigator Pro is an auto-renewing subscription sold through Apple’s App Store. Payment is handled by Apple and charged to your Apple ID.

Subscription status is managed by RevenueCat, Inc., which processes an anonymous, randomly generated identifier and your purchase receipt solely to determine whether your subscription is active. This identifier is not linked to your name, email, or anything you capture in the app. See RevenueCat’s privacy policy.

No assessment content is ever shared with RevenueCat, Apple, or anyone else. Your free-tier system count is stored only on your device.

Permissions

Microphone and Speech Recognition — used only while you hold the talk button in the guided interview, to transcribe your speech on device. Nothing is recorded to a file or uploaded.

Children

EU AI Act Navigator is a professional compliance-preparation tool intended for business use and is not directed at children under 13.

Changes

If this policy changes, the updated version will be published on this page with a new date.

Contact

Questions about privacy or this policy: magnus@oxenwaldt.com