Privacy Policy

ToText Privacy Policy

Effective date: 2026-08-28 · Version: 2.8

עברית

ToText is a personal voice-note app for iPhone. It records your voice, turns it into text, writes a short summary, and lets you chat with that text. We built it to be as private as we could make it: there is no account, no sign-in, and almost nothing about you ever leaves your phone.

This document tells you, in plain English, what happens to your data. If you have questions, write to company@lovelaceloom.com.

The short version

• You don't create an account. We don't know your name, email, or phone number.
• Your recordings, transcripts, summaries, and chat history live on your iPhone. There is no permanent copy on our side - no archive, no backup, no search index of your transcripts.
• We briefly send the audio to a speech-to-text provider to turn it into text. The audio is deleted shortly after the transcription finishes.
• A finished transcript and summary sit on our server just long enough for your phone to download them - normally seconds. If your phone never picks them up, they expire on their own within about a day.
• When you ask follow-up questions about a recording, we hold that transcript for up to 30 minutes so each question doesn't have to re-upload it. Then it expires. The questions and answers themselves are never stored.
• A counter that tracks how many minutes you've used this month lives on our server, attached to a random ID - not to you.
• To stop abuse, our server also keeps small counters that just count requests. One of them is keyed to a one-way hash of the IP address your request arrives from. They hold no content. The service stops using them within minutes to two days, and AWS removes the expired rows asynchronously afterwards.
• Payments go through Apple. We never see your credit card or your Apple ID.

If you'd rather skip the rest, that's the whole story.

What we collect about you

Almost nothing. Specifically:

• An anonymous device ID. When you first open the app, your iPhone creates a random identifier and stores it in the iOS Keychain. Your phone sends that identifier with service requests; we do not store the raw value. We store a one-way form produced with a server secret and use it to scope processing jobs, quotas and short-lived service controls. We can't trace that stored form back to you, and it isn't linked to your Apple ID, email or name.
• A short-lived rate-limiting counter derived from your IP address. Our service is anonymous and free to start, which makes it an easy target for automated abuse. To keep the lights on, the server takes the IP address your request arrives from, runs it through a one-way hash, and increments a plain request counter stored under that hash. To be precise about what this is and is not:
  • The address itself is never written down. Only the hash is stored - we do not keep the IP address in our database, and we do not enable request logs that would record it.
  • The row holds a number. No audio, no transcript, no summary, no question, no filename - no content of any kind. To be complete: the row's key also records which kind of request was counted (an upload, a question) and the minute or day it falls in, because that is what makes it a rate limit rather than a single total.
  • It is not joined to anything. It sits under its own key, separate from your anonymous device ID and from everything else. We do not build a profile from it and cannot use it to look you up.
  • It expires automatically. The service stops using per-minute counters after 15 minutes and per-day counters after two days. AWS removes the expired rows asynchronously afterwards; they contain only the counter and never content.

We do not collect:

• Your name
• Your email address
• Your phone number
• Your location (precise or coarse)
• Your contacts
• Your photo library
• Health, financial, or browsing data
• Advertising identifiers

There is no account to sign in to. There is no "sign up" screen. Installing the app is the only step.

What we process on our servers (and for how long)

When you finish a recording, your content passes through our service so we can do the work. Here is every place it sits on our side, and for how long:

• Your audio is uploaded to our storage and sent to a speech-to-text provider to be turned into a transcript. It is deleted within about a minute of the job ending - whether it succeeded or failed. A storage rule sweeps up anything left behind about a day later.
• The finished transcript and summary are written to a single file on our storage so your phone can download them. Your phone deletes that file as soon as it has saved the recording locally, which is normally within seconds of the recording appearing in the app. If your phone never confirms - it went offline, you closed the app - the file is still not kept: the database record expires after 24 hours and the file itself about a day later.
• The AI provider's raw output is held the same way while the job assembles the final result, and is deleted the moment that result is written - a matter of seconds.
• Follow-up questions. When you ask a question about a recording, your phone sends the transcript along with it. We hold that transcript for up to 30 minutes, tied to your device's anonymous ID, so your next question doesn't have to upload it again. It then expires on its own. Your questions and the answers to them are never stored.
• Re-summarising an existing recording stores nothing at all: the transcript goes to the AI provider and the result comes straight back to your phone.

The 30-minute and 24-hour windows above are enforced as access limits, not as a claim that AWS has physically erased every storage byte at the exact second. Once a row reaches its deadline, ToText's API refuses to read or return it even if asynchronous cloud cleanup has not removed the expired row yet. An expired row encountered during a request is also deleted best-effort, and the database TTL and storage lifecycle remain cleanup backstops. This distinction does not extend the period in which ToText can serve or process the content.

Beyond those short windows we keep no transcripts, summaries, action items, tags, or chat history. There is no permanent copy on our servers - no archive, no backup, and no search index of your content. The app on your phone is the only place your library lives.

What stays on your device and in your own iCloud

These things live in ToText on your phone - and, when iCloud Drive sync is on, in your personal iCloud. We keep no copy of them once the short handover described above is over:

• Your recording history
• Your audio files (with iCloud sync on, the audio is stored in your iCloud Drive so your devices share one copy)
• Your transcripts and summaries
• Your action items and tags
• Your Q&A chat history
• Your in-app preferences (device-only)

If you delete a recording in ToText, it is removed from your phone and, where it applies, from your iCloud Drive - and because devices share that iCloud copy, deleting on one device can remove shared content, including audio, for your other devices too. If you uninstall ToText from a device, that device's local content goes with it; anything in your iCloud Drive stays until you delete it there.

What goes to your personal iCloud Drive

If you have iCloud Drive turned on for ToText (this is on by default, but you control it), the app saves two things to your own iCloud Drive:

• The audio file of each recording, in iCloud Drive > ToText > Recordings
• A small JSON sidecar with the recording's transcript, summary, tags, and metadata, in the same folder

This is your iCloud Drive, under your Apple ID, governed by Apple's privacy policy - not ours. We can't see those files. To stop the sync, open iOS Settings → your name → iCloud → Saved to iCloud → ToText, and turn it off. To delete the synced files, open the Files app and remove them, the same way you would for Voice Memos.

The ToText Keyboard

ToText includes an optional system-wide keyboard ("ToText Keyboard") that works in any app - Messages, Mail, Notes, anything with a text field - not just ToText itself. It is a real keyboard: it has number, punctuation and symbol keys, a space bar, a return key and a delete key, so you can type with it. It also has a dictation pill, which is what lets you speak instead of type.

Full Access. iOS asks you to grant the keyboard "Full Access" before dictation works. We need it for one thing: the handoff to the ToText app. The keyboard itself can't record audio - Apple doesn't allow that. Full Access is what lets the keyboard use a small shared area on your phone (an "App Group") and open the ToText app, so it can tell the app to start or stop recording and read back the finished transcript. The recording, the transcription, and any network request all happen in the ToText app - never in the keyboard.

The keyboard has no network access of its own. There is no networking code anywhere in the keyboard: it does not connect to our servers, to Apple's, or to anyone else's. It has no way to send your typing - or anything else - off your phone.

What Full Access does not do: the ToText Keyboard never reads what is already sitting in the field you're typing into. It writes into that field - the characters you tap, a space, a new line, a deleted character when you tap delete, and the words you dictate - but it never reads any of that back, and it does not log, store, or transmit your keystrokes. The single thing it ever reads from the field is whether that field wants a light or a dark keyboard, so it can match your appearance.

Without Full Access, the keyboard still types normally. Only the dictation pill is disabled; it shows "Full Access needed" instead of starting a recording.

Two ways to finish a dictation:

• Finish (insert only) - the default. Your words are inserted as text into whatever field you're using. This transcription is done by Apple's speech recognition, not ours. On iOS 26 and later it runs on your iPhone using Apple's on-device model; if that model is unavailable for your language, it falls back to Apple's speech service, which means the audio may leave your phone - to Apple, under Apple's privacy policy, never to us. Either way the audio is deleted afterwards and no copy of it reaches ToText's servers.
• Finish & Save - inserts the text the same way, and additionally keeps the audio as a normal ToText recording (with its own transcript and summary in the app), exactly as if you'd recorded it from inside ToText.

On-device handoff storage. Between the moment a dictation finishes and the moment the keyboard inserts it, the transcript is held briefly in shared storage on your iPhone - not visible outside the app and keyboard. It's deleted as soon as it's inserted, and if it's ever left behind (for example, if you switch away before the keyboard reopens), the app purges it automatically a short time later.

Third parties we rely on

To run the app, a small number of service providers briefly handle your data on our behalf, under contract and only to provide the service:

• A speech-to-text provider - receives the audio only to turn it into text, whose published terms commit it not to retain audio for model training, and whose copy of each transcription we delete through its API as soon as we fetch the result.
• An AI provider - receives the transcript only to write the summary and answer your follow-up questions, and does not retain the content after the request completes.
• A cloud hosting platform - runs the temporary processing described above. Your data may be processed outside your country, including in the European Union and the United States, under appropriate legal safeguards.
• Apple - handles all payments and subscription state. We never see your credit card, Apple ID, or billing address.

We do not use:

• Analytics SDKs (Firebase, Mixpanel, Google Analytics, Amplitude, etc.)
• Crash reporters that send data to third parties
• Advertising networks or ad SDKs
• Social media SDKs
• Tracking pixels or cookies (the app is not a web browser)

Subscriptions and payments

ToText offers a free tier and two paid subscriptions (Basic and Pro). All purchases are handled by Apple's in-app purchase system. We never see your credit card or your Apple ID.

When the app needs to confirm your tier - for example, to apply your paid quota - it asks Apple's StoreKit framework for a signed receipt and sends it to our server only to be checked. We verify the signature, read out the tier, and discard the receipt itself. We do not store the receipt.

We do keep one small anti-fraud record per subscription, so that a single receipt copied onto many devices doesn't go unnoticed. It contains Apple's transaction ID for that subscription, the one-way hashed device IDs that have presented it, and the first and last time we saw it. That's all it contains: no name, no email, no billing details, no card number, and none of your recordings or text. It deletes itself automatically about 30 days after the subscription expires (about a year for a one-off, non-expiring purchase).

To manage or cancel your subscription, open iOS Settings → your name → Subscriptions, the same as any other app.

Security

• All traffic between the app and our servers goes over HTTPS (TLS 1.2 or newer) using Apple's built-in URLSession. We do not implement our own cryptography.
• Audio is encrypted in transit and at rest while it is being processed.
• We declared ITSAppUsesNonExemptEncryption = NO in the app, because we use only Apple's standard HTTPS and no proprietary encryption.

Your rights (GDPR and CCPA)

We hold no name, no email, no account - nothing that identifies you. What we do hold is the pseudonymous counters described under "What we collect about you", plus the short-lived processing copies described under "What we process on our servers". So there is very little to request from us:

• Right to access - every recording, transcript, and summary is already visible inside the app. We have no archive to search and nothing to send you.
• Right to delete - open Settings → Delete all my data to remove the app's local content, attempt to clear its iCloud content, and request deletion of eligible data stored under your anonymous device ID. The app reports cleanup failures it detects and retries eligible pending work; in some edge cases content in iCloud may survive without being flagged, which is why the uninstall route below also exists. You can also uninstall the app and remove the ToText folder from iCloud Drive.
• Right to portability - your recordings export from inside the app (share sheet on any recording).
• Right to object / restrict processing - stop using the app or uninstall it. We can't process what we don't receive.

About the anonymous monthly counter. Under your device's anonymous ID we hold the counter of minutes used in the current month, plus small daily request counters that expire by themselves within two days. Being precise about how that ID works matters here, because it decides what deletion is possible. Your phone generates a random identifier and sends it to us with every request - it is what tells our server the request is yours. We never store it. What we store is a one-way hash of it, salted with a secret only the server holds. So while a request is in front of us we can reach exactly your rows, which is how the erasure endpoint below is able to work at all - but we hold nothing that ties those rows to you as a person: no name, no email, no account. And we cannot run it backwards, from a row to a device or from an email address to a row. That is the honest obstacle to deleting by email: not that the rows are unreachable, but that we have no way to know which rows are yours. We would have to ask you to hand us your device's identifier, which would mean giving up the anonymity that is the whole point. Write to company@lovelaceloom.com if you want to talk it through and we will explain exactly what is held.

When you choose Settings → Delete all my data, the app removes local content, attempts to clear its iCloud content, and requests immediate deletion of the server rows that can be addressed safely: rows under your anonymous device partition (apart from the two counter families below) and processing jobs still known to the app. If iCloud or a network request fails, the app reports that cleanup is incomplete and retries the pending work on a later launch; it does not repeat the local database wipe or intentionally delete recordings created afterwards.

The current month's minute counter and the daily rate-limit counters are retained so deletion cannot be used to reset free allowances or rate limits. Daily counters expire within two days. The current-month counter has no automatic expiry today: it stops being used after the month ends and is deleted by a later erasure request, but it may otherwise remain as a pseudonymous usage count and last-activity time. We are documenting that limitation rather than calling it temporary.

Some bounded rows use different database keys and cannot be reached by the device-partition erasure request. A Q&A transcript cache becomes inaccessible after 30 minutes; upload idempotency and any processing job no longer known to the app become inaccessible after about 24 hours; finished-result handover objects have a one-day lifecycle safety net; and the StoreKit anti-fraud observation record expires on the schedule described above. Physical removal by database TTL and storage lifecycle is asynchronous. IP-derived rate-limit counters cannot be linked to a device and stop being used within minutes to two days.

The IP-derived rate-limiting counters described under "What we collect about you" are a separate case. We store no mapping between them and your device ID, so a device erasure request cannot identify them. They hold only a request count, stop being used within minutes to two days, and are removed asynchronously afterwards.

Children

ToText is rated 4+ in the App Store but designed for general use. We do not knowingly collect data from children under 13. We do not direct the app at children, and because there is no account or profile, we have no way to identify a user's age. If a parent believes their child has used the app and wants the anonymous device counter removed, see the previous section.

Changes to this policy

When something material changes, we'll update the version number and effective date at the top of this document. The current version always lives on this page, which is what the app opens when you tap Settings → About → Privacy Policy - so what you read in the app and what you read here are the same document.

Contact

Privacy questions, comments, deletion requests, or anything else:

company@lovelaceloom.com

The ToText app is operated by Lovelace Loom.