Dote — Privacy Policy

Effective date: 18 August 2026 · Last updated: 6 September 2026

In this policy, "we" means the developer of Dote, reachable at hz138088@gmail.com. "Dote" means the Dote iOS app.

1. There is no account and no sign-up

Dote has no login screen, no email field, no password, no profile. You open the app and start typing. We never ask for your name, email address, phone number, or date of birth, and there is no code in the app that sends any of those to us.

Because there is no account, there is also nothing for us to look up. We could not find "your data" even if we wanted to — there is no key to look it up by.

2. What Dote stores

Dote is a private notebook about the people you care about. What ends up in it is entirely what you type:

• The person's name, nickname, and how they're related to you (partner, parent, friend…)
• Birthdays, anniversaries, and any other dates you add, plus how many days ahead you want to be reminded
• Clothing and shoe sizes
• Likes, dislikes, and allergies or things to avoid
• Wishlist items (title, link, price, priority, target date, notes)
• Gift history (what you gave, when, for what occasion, roughly what it cost, how it went down)
• Free-form notes and any custom sections you create
• Flags you set yourself: "sensitive" (keeps details out of the search index) and "hidden" (keeps the person out of lists, search, notifications, and the widget)

Alongside that, Dote keeps a few small technical preferences on your device: whether you've finished onboarding, your Face ID grace-period choice, and a monthly counter for AI usage. Nothing in that list identifies you.

3. Where it is stored

Two places, and both of them are yours:

On your device. A single database file inside Dote's own sandboxed app storage (Application Support/Dote/store.sqlite). It is protected by iOS app sandboxing and, when your iPhone is locked, by iOS file encryption. No other app can read it.

In your own iCloud. When your device has iCloud available, Dote uses Apple's CloudKit to keep that database in sync across your devices. It lives in the private database of the iCloud container iCloud.app.dote, inside your Apple Account, consuming your iCloud storage. A CloudKit private database is readable by the signed-in Apple Account only. We, as the developer, have no ability to read, list, export, or restore anything in it. If you have Advanced Data Protection turned on for your Apple Account, it is end-to-end encrypted as well.

Notes on how sync behaves in this version:

• This version of Dote has no in-app sync switch. Whether syncing happens depends on iCloud being available on the device.
• If iCloud isn't available — you're signed out, storage is full, the network is down — Dote starts in device-only mode. Every feature keeps working; you just don't get sync.
• You control this from iOS, not from inside Dote: Settings → [your name] → iCloud lets you turn iCloud off for Dote or sign out of iCloud entirely.

There is no Dote server holding your notes. We do not operate a database, a backup service, or an account directory. There is no copy of your vault anywhere we can reach.

4. What we can and cannot see

We cannot see: any person you've added, any name, birthday, size, preference, allergy, wishlist item, gift record, note, photo, or attachment. Not in aggregate, not anonymised, not "for improving the product". None of it is transmitted to us.

We can see: sales and subscription reports that Apple gives every developer — counts of purchases, refunds, and territories, with no identity attached. Apple generates those; we don't collect them from your device.

5. Reminders are local notifications

Dote's reminders are scheduled by your iPhone, for your iPhone. They use UNCalendarNotificationTrigger — the same mechanism as a local alarm.

• There is no push server, no push token, and no Apple Push Notification Service involvement. The app deliberately ships without a push entitlement.
• No reminder passes through us. We do not know that you have a reminder, who it's for, or when it fires.
• Reminder text never contains sensitive detail. By design, the code that writes notification copy can only see a stripped-down summary of a card: its id, its type, a display title, an emoji, and a "is sensitive" flag. Sizes, preferences, allergies, wishlist items, notes — the code physically cannot reach them. A notification reads like *"Mia's birthday is coming up — 14 days to go · open to see what you've noted"*, never *"Mia · size M"*. This is enforced by tests that block a release if they fail.
• For a person you marked hidden, even the name is replaced with •••.
• Wishlist reminders deliberately omit the item's title, because the item is the surprise.
• Dote asks iOS for permission before showing any notification. Decline it and everything else still works; you just won't be reminded.
• Dote uses iOS Background App Refresh to top up the next batch of scheduled reminders (iOS only allows 64 pending notifications at a time). That background work is purely local date arithmetic. It makes no network request.

6. Camera and photos

Dote asks for camera access for one purpose: reading text off a photo of a size label or a receipt so you don't have to type it.

If you use that, the text recognition runs entirely on your device, through Apple's Vision framework. The image is never uploaded, never sent to us, and never sent to any third party — only the text your device pulls out of it is used, and only inside the app. Dote does not request access to your photo library, and does not read your Contacts, your calendar, your location, your microphone, your health data, or any other app's data.

7. AI features

Dote has four optional AI features. They share one pipeline, and all of them are off unless a single build setting names our relay:

• "Just say it" — you type a sentence and the app pre-fills the fields for you to check and correct.
• Gift ideas — from one person's card, three to five gift ideas, each with a one-sentence reason.
• Together — pick two to six people and ask whether they would enjoy an activity together.
• A match? — pick two people and get a playful matchmaker's one-sentence verdict.

Whether AI is on in your version

In any build where that setting is empty, no data leaves your device for AI processing — not one byte — and none of the entry points above is shown. Every feature of the app works without AI; the only difference is that you fill the fields in yourself.

When AI is on

A request happens when — and only when — you tap one of the AI buttons. We send:

For "Just say it": the one sentence you just typed.

For gift ideas, Together and A match?: the details you have saved about the chosen person or people — relationship, birthday or age, sizes, likes, dislikes, allergies and no-gos, wishlist, gifts you've given, your own sections and notes — without their names or nicknames. One person is described as "this person"; a group as "Person A", "Person B", and so on, and the app puts the real names back on your device before showing you the answer. For gift ideas, the upcoming occasion ("Birthday in 12 days") is included.

With every request: an identifier for the prompt, your device's locale code (e.g. en_US), and a description of the JSON shape we want back. That's the whole request.

What is not sent: anything else in your vault. No names, no other person, no card identifiers, no device identifier, no advertising identifier, no Apple Account, no contacts, no photos, no location.

Be clear-eyed about what that means: the details you saved about someone *are* what gets sent for that person. If a particular detail should never leave your phone, don't use the AI buttons for that person — everything else in the app works exactly the same.

Where it goes: over HTTPS to a small relay we run on Cloudflare Workers, which forwards the request to OpenAI's API and returns the structured answer. The relay exists so that an API key never has to be shipped inside the app. We send every request with the provider's "do not store" option; under the provider's API terms, inputs are not used to train their models, and their own data-handling terms apply for the time it takes to process the request.

What is kept: the relay does not store your text. It records only structural facts — which prompt, which model, how many milliseconds the call took, how many characters and tokens were involved — never the content. For rate limiting it keeps a numeric counter under an irreversible SHA-256 hash (of the request's authorisation token, or, when there is none, of the connecting IP address) in Cloudflare's key-value store; those counters expire after 40 days and contain no content of any kind.

Training: your text is not used to train any model — not by us, and not by the provider under the terms of the API we use.

Quota: free accounts get a small number of suggestion requests a month and Dote Pro more. "Just say it" does not count against that allowance. It has a separate, much larger monthly ceiling — the same on every plan — which exists only to stop the relay being scripted by someone who is not using the app, and which Dote shows you on the capture screen. Both counts are kept as plain numbers on your device and, for enforcement, as the hashed counters described above.

Failure is always survivable: offline, over quota, service down, or AI switched off — every case lands in a message and leaves the app fully usable. AI is an accelerator, never a gate.

8. The home-screen widget

Dote's widget runs in a separate process that cannot read your vault. The app writes it a deliberately narrow snapshot: at most three upcoming people, each with a name, emoji, relationship, colour, next date, and *counts* (how many likes, how many wishes, whether sizes exist). Not one word of the actual content is included, by design and by test. The widget also defaults to an anonymous style that shows the relationship instead of the name; you have to switch names on yourself. That snapshot lives in Dote's own shared app-group storage on your device and goes nowhere else.

9. Purchases

Dote offers three in-app purchases: app.dote.pro.monthly, app.dote.pro.yearly, and app.dote.lifetime.

Payment is handled entirely by Apple through StoreKit. Dote never sees and never receives your card number, billing address, Apple Account email, or any other payment detail. All the app learns from Apple is which product you own and whether it's still valid — and it learns that on your device, from Apple's frameworks. Nothing about your purchase is sent to us; Apple's aggregate sales reports are the only thing we see, and Apple produces those, not the app.

Refunds and subscription management are handled by Apple. "Restore purchases" asks Apple, not us.

10. Face ID and passcode

If you turn on the app lock, Dote asks iOS to authenticate you using Apple's LocalAuthentication framework, which accepts Face ID, Touch ID, or your device passcode.

Your face, fingerprint, and passcode are handled by iOS and the Secure Enclave and never reach Dote. The app receives one thing: a yes or a no. We never receive anything at all. Your grace-period preference is stored on your device only and deliberately does not sync.

11. Export and import

Export is available in the full version. When you tap it, Dote writes a file — JSON (everything) or CSV (one row per person) — and hands it to the standard iOS share sheet. You choose where it goes: Files, AirDrop, Mail, another app. Dote does not upload it, does not keep a copy anywhere but the temporary file it just wrote, and does not know where you sent it.

Once a file leaves Dote, it is an ordinary unencrypted file under your control, with all your notes in it. Treat it like any other sensitive document.

Import reads a JSON file you pick yourself and only ever adds — it never overwrites what's already there, and re-importing the same backup skips duplicates.

The export format is deliberately plain and documented in the file itself, so your data is readable without us.

12. Diagnostics and logs

Dote writes technical log lines through Apple's unified logging (os_log) — things like "rescheduled 34 reminders" or "save to disk failed". The rule in the code is that log lines never contain your content: only counts, durations, and status. Those logs stay in your device's system log. We do not collect them, and there is no crash reporter, no diagnostics uploader, and no "send feedback with logs" pipe in the app. If you choose to share an iOS diagnostic report with Apple, that is between you and Apple.

13. No analytics, no tracking, no ads, no third-party SDKs

This is worth stating flatly, because it is unusual:

• No analytics or telemetry of any kind. No Firebase, no Google services, no Amplitude, Mixpanel, PostHog, or Segment.
• No crash reporter. No Sentry, Crashlytics, or Bugsnag.
• No subscription analytics SDK. Purchases use Apple's StoreKit directly; there is no RevenueCat or equivalent.
• No advertising, no ad network, no ad identifier. Dote does not use the IDFA and never asks for it.
• No third-party code at all. Dote is built from Apple's frameworks plus its own modules. It has zero external dependencies.
• No social logins, no share-to-social SDKs, no attribution or install-tracking SDKs.

The only network requests the app itself can ever make are the optional AI requests in section 7, and only in builds where AI is on. Everything else that touches the network (iCloud sync, App Store purchases) is Apple's own machinery, running under your Apple Account.

14. Children

Dote is not directed at children. It is a general-audience app rated 4+ because it contains nothing objectionable — not because it is designed for kids.

We do not knowingly collect personal information from anyone, of any age, because we do not collect personal information at all. There is no sign-up, no profile, no content sharing, no messaging, no user-to-user contact, no open web browsing, and no advertising. If a child uses a family device that has Dote on it, nothing they type is transmitted to us.

If a purchase requires parental approval (Apple's Ask to Buy), that flow is handled entirely by Apple.

15. Keeping and deleting your data

We hold nothing, so there is nothing for us to keep or delete. You control all of it:

Remove one person. Swipe to delete in the people list. In this version, that marks the person as removed and immediately takes them out of every list, every search result, every reminder, and the widget. Be aware of the honest limitation: the underlying record still exists in the store (and therefore in your iCloud copy if you're syncing) — this version has no "empty the trash" screen. If you need a record gone for good, use the two steps below.

Hide someone without deleting them. Marking a person "hidden" keeps them out of lists, search, notifications, and the widget; their name is replaced with ••• even in notifications. There's a Settings switch to reveal hidden people temporarily, and it turns itself back off when you leave the app.

Delete everything on the device. Delete the Dote app from your iPhone. That removes the local database and all local files.

Delete the iCloud copy. Because those records live in your Apple Account, only you can remove them: Settings → [your name] → iCloud → Manage Account Storage, then remove Dote's data. We cannot do this for you — we have no access to it, which is the whole point.

Take a copy with you first. Export to JSON before deleting, if you want a backup.

Deleting the app also cancels nothing on the billing side — manage subscriptions in Settings → [your name] → Subscriptions.

16. International transfers

As shipped, no data crosses any border because no data leaves your device except through your own iCloud, which Apple operates in the region tied to your Apple Account.

In builds where AI is on (section 7), the request described there is transmitted to Cloudflare and OpenAI, whose infrastructure is operated from the United States, and therefore leaves your country of residence for the seconds it takes to process. Nothing else does.

17. Security, stated honestly

• Your data sits in Dote's sandboxed storage, protected by iOS app sandboxing and device encryption while your phone is locked.
• The iCloud copy sits in a CloudKit private database, encrypted by Apple and readable only by your Apple Account; with Advanced Data Protection enabled, end-to-end encrypted.
• The app lock (Face ID / Touch ID / passcode) is the defence against the threat that actually matters here: someone picking up your unlocked phone. It re-locks when the app goes to the background, after a grace period you choose.
• Sensitive cards keep their details out of the search index. Notifications carry no details. The widget carries no details. Logs carry no details.
• What Dote does not do: it does not add its own layer of encryption on top of what iOS and iCloud provide. Nothing is encrypted with a key only you hold, and there is no separate Dote password. We chose it that way deliberately — a lost key would destroy your data permanently, and encryption would not have stopped any of the real threats above. So the accurate statement is: *your data never passes through our servers and we cannot see it*, not *we encrypt it ourselves*.
• Any file you export is unencrypted. That's on you once it leaves the app.

18. Your rights

Privacy laws such as the GDPR and the CCPA/CPRA give you rights to access, correct, export, and delete the personal data a company holds about you, and to know whether it's sold or shared.

We hold none of your personal data, so there is nothing for us to disclose, correct, or delete on request — and nothing to sell or share. We do not sell or share personal information, and we never have. In practice you exercise these rights directly inside the app and iOS: your data is already in your hands (section 2), you can correct it by editing it, export it (section 11), and delete it (section 15).

If you believe we hold something about you and want to ask, write to hz138088@gmail.com.

19. Changes to this policy

If Dote changes in a way that affects your privacy — for example, changing what the AI features in section 7 send — we will update this policy and change the "Last updated" date at the top before or with the app update that makes the change. Material changes will be summarised in the App Store release notes for that version. The current version of this policy is always the one published at Dote's privacy policy link on the App Store. The 18 August 2026 version, published with Dote 1.0, is the only earlier version; it described AI as switched off.

20. Contact

Questions, corrections, or anything that reads wrong to you:

hz138088@gmail.com

We'd rather fix a sentence in this document than have you guess at what it means.

A closing note on tracking

Dote does not track you. It never asks for permission to track you — the App Tracking Transparency prompt does not exist in this app, because there is nothing to ask for. It does not read or use the IDFA (Identifier for Advertisers), does not build a profile of you, does not link anything to your identity, does not use any advertising or attribution SDK, and does not share anything with data brokers. There is no advertising in Dote and no plan for any.

中文版