Dote — Privacy Policy

Effective date: 18 August 2026 · Last updated: 18 August 2026

In this policy, "we" means the developer of Dote, reachable at hz138088@gmail.com. "Dote" means the Dote iOS app.

1. There is no account and no sign-up

Dote has no login screen, no email field, no password, no profile. You open the app and start typing. We never ask for your name, email address, phone number, or date of birth, and there is no code in the app that sends any of those to us.

Because there is no account, there is also nothing for us to look up. We could not find "your data" even if we wanted to — there is no key to look it up by.

2. What Dote stores

Dote is a private notebook about the people you care about. What ends up in it is entirely what you type:

• The person's name, nickname, and how they're related to you (partner, parent, friend…)
• Birthdays, anniversaries, and any other dates you add, plus how many days ahead you want to be reminded
• Clothing and shoe sizes
• Likes, dislikes, and allergies or things to avoid
• Wishlist items (title, link, price, priority, target date, notes)
• Gift history (what you gave, when, for what occasion, roughly what it cost, how it went down)
• Free-form notes and any custom sections you create
• Flags you set yourself: "sensitive" (keeps details out of the search index) and "hidden" (keeps the person out of lists, search, notifications, and the widget)

Alongside that, Dote keeps a few small technical preferences on your device: whether you've finished onboarding, your Face ID grace-period choice, and a monthly counter for AI usage. Nothing in that list identifies you.

3. Where it is stored

Two places, and both of them are yours:

On your device. A single database file inside Dote's own sandboxed app storage (Application Support/Dote/store.sqlite). It is protected by iOS app sandboxing and, when your iPhone is locked, by iOS file encryption. No other app can read it.

In your own iCloud. When your device has iCloud available, Dote uses Apple's CloudKit to keep that database in sync across your devices. It lives in the private database of the iCloud container iCloud.app.dote, inside your Apple Account, consuming your iCloud storage. A CloudKit private database is readable by the signed-in Apple Account only. We, as the developer, have no ability to read, list, export, or restore anything in it. If you have Advanced Data Protection turned on for your Apple Account, it is end-to-end encrypted as well.

Notes on how sync behaves in this version:

• This version of Dote has no in-app sync switch. Whether syncing happens depends on iCloud being available on the device.
• If iCloud isn't available — you're signed out, storage is full, the network is down — Dote starts in device-only mode. Every feature keeps working; you just don't get sync.
• You control this from iOS, not from inside Dote: Settings → [your name] → iCloud lets you turn iCloud off for Dote or sign out of iCloud entirely.

There is no Dote server holding your notes. We do not operate a database, a backup service, or an account directory. There is no copy of your vault anywhere we can reach.

4. What we can and cannot see

We cannot see: any person you've added, any name, birthday, size, preference, allergy, wishlist item, gift record, note, photo, or attachment. Not in aggregate, not anonymised, not "for improving the product". None of it is transmitted to us.

We can see: sales and subscription reports that Apple gives every developer — counts of purchases, refunds, and territories, with no identity attached. Apple generates those; we don't collect them from your device.

5. Reminders are local notifications

Dote's reminders are scheduled by your iPhone, for your iPhone. They use UNCalendarNotificationTrigger — the same mechanism as a local alarm.

• There is no push server, no push token, and no Apple Push Notification Service involvement. The app deliberately ships without a push entitlement.
• No reminder passes through us. We do not know that you have a reminder, who it's for, or when it fires.
• Reminder text never contains sensitive detail. By design, the code that writes notification copy can only see a stripped-down summary of a card: its id, its type, a display title, an emoji, and a "is sensitive" flag. Sizes, preferences, allergies, wishlist items, notes — the code physically cannot reach them. A notification reads like *"Mia's birthday is coming up — 14 days to go · open to see what you've noted"*, never *"Mia · size M"*. This is enforced by tests that block a release if they fail.
• For a person you marked hidden, even the name is replaced with •••.
• Wishlist reminders deliberately omit the item's title, because the item is the surprise.
• Dote asks iOS for permission before showing any notification. Decline it and everything else still works; you just won't be reminded.
• Dote uses iOS Background App Refresh to top up the next batch of scheduled reminders (iOS only allows 64 pending notifications at a time). That background work is purely local date arithmetic. It makes no network request.

6. Camera and photos

Dote asks for camera access for one purpose: reading text off a photo of a size label or a receipt so you don't have to type it.

If you use that, the text recognition runs entirely on your device, through Apple's Vision framework. The image is never uploaded, never sent to us, and never sent to any third party — only the text your device pulls out of it is used, and only inside the app. Dote does not request access to your photo library, and does not read your Contacts, your calendar, your location, your microphone, your health data, or any other app's data.

7. AI capture

Dote has one optional AI feature, "Just say it": you type a sentence like *"Mia wears EU 38 shoes, allergic to peanuts, birthday May 20, wants a wool scarf"* and the app pre-fills the fields for you to check and correct.

Its behaviour depends on a single build setting.

As shipped today, AI is off

In the version we publish, that setting is empty. No data leaves your device for AI processing — not one byte. The "Just say it" screen simply hands your sentence to the manual editor. Every feature of the app works without AI; the only difference is that you fill the fields in yourself.

If AI is turned on in a future version

We would only do this by publishing an app update, and we will update this policy and the date at the top before such a version ships. In that case, when — and only when — you tap Organize on the "Just say it" screen:

What is sent: the one sentence you just typed, an identifier for the prompt being used, the model name, your device's locale code (e.g. en_US), and a description of the JSON shape we want back. That's the whole request.

What is not sent: anything else in your vault. No other person, no other note, no card identifiers, no device identifier, no advertising identifier, no Apple Account, no contacts, no photos, no location. One request carries one sentence.

Be clear-eyed about what that means: whatever you typed *is* what gets sent. If your sentence contains a name, an allergy, or a size, those words are in the request — that is how the feature works. If you would rather a particular detail never leave your phone, type it into the editor directly instead of using "Just say it".

Where it goes: over HTTPS to a small relay we run on Cloudflare Workers, which forwards the sentence to Anthropic's Claude API and returns the extracted fields. The relay exists so that an API key never has to be shipped inside the app.

What is kept: the relay does not store your text. It records only structural facts — which prompt, which model, how many milliseconds the call took, and how many characters the input was — never the content. For rate limiting it keeps a numeric counter under an irreversible SHA-256 hash (of the request's authorisation token, or, when there is none, of the connecting IP address) in Cloudflare's key-value store; those counters expire after 40 days and contain no content of any kind.

Training: your text is not used to train any model — not by us, and the API terms of the provider we use state that inputs submitted through their API are not used for model training.

Failure is always survivable: offline, over quota, service down, or AI switched off — all four land in the same place, a message telling you to fill it in manually. AI is an accelerator at the entrance, never a gate.

8. The home-screen widget

Dote's widget runs in a separate process that cannot read your vault. The app writes it a deliberately narrow snapshot: at most three upcoming people, each with a name, emoji, relationship, colour, next date, and *counts* (how many likes, how many wishes, whether sizes exist). Not one word of the actual content is included, by design and by test. The widget also defaults to an anonymous style that shows the relationship instead of the name; you have to switch names on yourself. That snapshot lives in Dote's own shared app-group storage on your device and goes nowhere else.

9. Purchases

Dote offers three in-app purchases: app.dote.pro.monthly, app.dote.pro.yearly, and app.dote.lifetime.

Payment is handled entirely by Apple through StoreKit. Dote never sees and never receives your card number, billing address, Apple Account email, or any other payment detail. All the app learns from Apple is which product you own and whether it's still valid — and it learns that on your device, from Apple's frameworks. Nothing about your purchase is sent to us; Apple's aggregate sales reports are the only thing we see, and Apple produces those, not the app.

Refunds and subscription management are handled by Apple. "Restore purchases" asks Apple, not us.

10. Face ID and passcode

If you turn on the app lock, Dote asks iOS to authenticate you using Apple's LocalAuthentication framework, which accepts Face ID, Touch ID, or your device passcode.

Your face, fingerprint, and passcode are handled by iOS and the Secure Enclave and never reach Dote. The app receives one thing: a yes or a no. We never receive anything at all. Your grace-period preference is stored on your device only and deliberately does not sync.

11. Export and import

Export is available in the full version. When you tap it, Dote writes a file — JSON (everything) or CSV (one row per person) — and hands it to the standard iOS share sheet. You choose where it goes: Files, AirDrop, Mail, another app. Dote does not upload it, does not keep a copy anywhere but the temporary file it just wrote, and does not know where you sent it.

Once a file leaves Dote, it is an ordinary unencrypted file under your control, with all your notes in it. Treat it like any other sensitive document.

Import reads a JSON file you pick yourself and only ever adds — it never overwrites what's already there, and re-importing the same backup skips duplicates.

The export format is deliberately plain and documented in the file itself, so your data is readable without us.

12. Diagnostics and logs

Dote writes technical log lines through Apple's unified logging (os_log) — things like "rescheduled 34 reminders" or "save to disk failed". The rule in the code is that log lines never contain your content: only counts, durations, and status. Those logs stay in your device's system log. We do not collect them, and there is no crash reporter, no diagnostics uploader, and no "send feedback with logs" pipe in the app. If you choose to share an iOS diagnostic report with Apple, that is between you and Apple.

13. No analytics, no tracking, no ads, no third-party SDKs

This is worth stating flatly, because it is unusual:

• No analytics or telemetry of any kind. No Firebase, no Google services, no Amplitude, Mixpanel, PostHog, or Segment.
• No crash reporter. No Sentry, Crashlytics, or Bugsnag.
• No subscription analytics SDK. Purchases use Apple's StoreKit directly; there is no RevenueCat or equivalent.
• No advertising, no ad network, no ad identifier. Dote does not use the IDFA and never asks for it.
• No third-party code at all. Dote is built from Apple's frameworks plus its own modules. It has zero external dependencies.
• No social logins, no share-to-social SDKs, no attribution or install-tracking SDKs.

The only network request the app itself can ever make is the optional AI request in section 7 — and in the shipped version, even that is switched off. Everything else that touches the network (iCloud sync, App Store purchases) is Apple's own machinery, running under your Apple Account.

14. Children

Dote is not directed at children. It is a general-audience app rated 4+ because it contains nothing objectionable — not because it is designed for kids.

We do not knowingly collect personal information from anyone, of any age, because we do not collect personal information at all. There is no sign-up, no profile, no content sharing, no messaging, no user-to-user contact, no open web browsing, and no advertising. If a child uses a family device that has Dote on it, nothing they type is transmitted to us.

If a purchase requires parental approval (Apple's Ask to Buy), that flow is handled entirely by Apple.

15. Keeping and deleting your data

We hold nothing, so there is nothing for us to keep or delete. You control all of it:

Remove one person. Swipe to delete in the people list. In this version, that marks the person as removed and immediately takes them out of every list, every search result, every reminder, and the widget. Be aware of the honest limitation: the underlying record still exists in the store (and therefore in your iCloud copy if you're syncing) — this version has no "empty the trash" screen. If you need a record gone for good, use the two steps below.

Hide someone without deleting them. Marking a person "hidden" keeps them out of lists, search, notifications, and the widget; their name is replaced with ••• even in notifications. There's a Settings switch to reveal hidden people temporarily, and it turns itself back off when you leave the app.

Delete everything on the device. Delete the Dote app from your iPhone. That removes the local database and all local files.

Delete the iCloud copy. Because those records live in your Apple Account, only you can remove them: Settings → [your name] → iCloud → Manage Account Storage, then remove Dote's data. We cannot do this for you — we have no access to it, which is the whole point.

Take a copy with you first. Export to JSON before deleting, if you want a backup.

Deleting the app also cancels nothing on the billing side — manage subscriptions in Settings → [your name] → Subscriptions.

16. International transfers

As shipped, no data crosses any border because no data leaves your device except through your own iCloud, which Apple operates in the region tied to your Apple Account.

If AI is ever enabled (section 7), the single sentence you typed would be transmitted to Cloudflare and Anthropic, whose infrastructure is operated from the United States, and would therefore leave your country of residence for the seconds it takes to process. Nothing else would.

17. Security, stated honestly

• Your data sits in Dote's sandboxed storage, protected by iOS app sandboxing and device encryption while your phone is locked.
• The iCloud copy sits in a CloudKit private database, encrypted by Apple and readable only by your Apple Account; with Advanced Data Protection enabled, end-to-end encrypted.
• The app lock (Face ID / Touch ID / passcode) is the defence against the threat that actually matters here: someone picking up your unlocked phone. It re-locks when the app goes to the background, after a grace period you choose.
• Sensitive cards keep their details out of the search index. Notifications carry no details. The widget carries no details. Logs carry no details.
• What Dote does not do: it does not add its own layer of encryption on top of what iOS and iCloud provide. Nothing is encrypted with a key only you hold, and there is no separate Dote password. We chose it that way deliberately — a lost key would destroy your data permanently, and encryption would not have stopped any of the real threats above. So the accurate statement is: *your data never passes through our servers and we cannot see it*, not *we encrypt it ourselves*.
• Any file you export is unencrypted. That's on you once it leaves the app.

18. Your rights

Privacy laws such as the GDPR and the CCPA/CPRA give you rights to access, correct, export, and delete the personal data a company holds about you, and to know whether it's sold or shared.

We hold none of your personal data, so there is nothing for us to disclose, correct, or delete on request — and nothing to sell or share. We do not sell or share personal information, and we never have. In practice you exercise these rights directly inside the app and iOS: your data is already in your hands (section 2), you can correct it by editing it, export it (section 11), and delete it (section 15).

If you believe we hold something about you and want to ask, write to hz138088@gmail.com.

19. Changes to this policy

If Dote changes in a way that affects your privacy — most plausibly, enabling the AI capture feature described in section 7 — we will update this policy and change the "Last updated" date at the top before or with the app update that makes the change. Material changes will be summarised in the App Store release notes for that version. The current version of this policy is always the one published at Dote's privacy policy link on the App Store. This policy has no earlier versions: Dote 1.0 is the first public release.

20. Contact

Questions, corrections, or anything that reads wrong to you:

hz138088@gmail.com

We'd rather fix a sentence in this document than have you guess at what it means.

A closing note on tracking

Dote does not track you. It never asks for permission to track you — the App Tracking Transparency prompt does not exist in this app, because there is nothing to ask for. It does not read or use the IDFA (Identifier for Advertisers), does not build a profile of you, does not link anything to your identity, does not use any advertising or attribution SDK, and does not share anything with data brokers. There is no advertising in Dote and no plan for any.

中文版