Privacy Policy

ToText Privacy Policy

Effective date: 2026-10-16 · Version: 2.15

ToText is a personal voice-note app for iPhone. It records your voice, turns it into text, writes a short summary, and lets you chat with that text. The app works without an account or sign-in. If you choose the optional ChatGPT or Codex connection, a separate account and a server copy of your shared library's text are created, as explained below.

This document tells you, in plain English, what happens to your data. If you have questions, write to company@lovelaceloom.com.

The short version

• The app does not require an account. Optional support correspondence and the ChatGPT or Codex sign-in profile can include your name or email, as explained below.
• Your recordings, transcripts, summaries, and chat history live on your iPhone and, when enabled, in your personal iCloud. Unless you enable the optional connection, we do not maintain a permanent server-side library or search index. Temporary processing copies and database recovery backups are described below.
• We briefly send the audio to a speech-to-text provider to turn it into text. The audio is deleted shortly after the transcription finishes.
• A finished transcript and summary sit on our server just long enough for your phone to download them - normally seconds. If your phone never picks them up, they expire on their own within about a day.
• When you ask follow-up questions about a recording, we hold that transcript for up to 30 minutes so each question doesn't have to re-upload it. Then it expires. ToText does not store the questions and answers on its servers.
• A counter that tracks how many minutes you've used this month lives on our server, under a one-way hash of your device identifier or, when subscription-based metering is enabled, Apple's subscription identifier.
• To stop abuse, our server also keeps small counters that just count requests. One of them is keyed to a one-way hash of the IP address your request arrives from. They hold no content. The service stops using them within minutes to two days, and AWS removes the expired rows asynchronously afterwards.
• To help fix bugs, ToText may send technical crash reports to service providers. If you choose to share them, it also sends feature-use statistics or ad-measurement data. Each choice can be changed in the app's Settings, under Privacy.
• Payments go through Apple. We never see your credit card or your Apple ID.
• If you connect to ChatGPT or Codex, your shared recording details, summaries, transcripts and tasks are copied to AWS in the EU until you request deletion. This cloud copy contains no audio. Auth0 handles the connection's sign-in in the US and may store the name and email supplied by Apple.

If you'd rather skip the rest, that's the whole story.

What we collect about you

This section describes ordinary app service requests without the optional ChatGPT or Codex connection. Separate optional crash, usage and ad measurement sharing is described below. Sign-in profiles, shared library text and connection logs are described in that connection's section below. For ordinary app service requests, we collect:

• An anonymous device ID. When you first open the app, your iPhone creates a random identifier and stores it in the iOS Keychain. Your phone sends that identifier with service requests; we do not store the raw value. We store a one-way form produced with a server secret and use it to scope processing jobs, quotas and short-lived service controls. We can't trace that stored form back to you, and it isn't linked to your Apple ID, email or name.
• A short-lived rate-limiting counter derived from your IP address. Our service is anonymous and free to start, which makes it an easy target for automated abuse. To keep the lights on, the server takes the IP address your request arrives from, runs it through a one-way hash, and increments a plain request counter stored under that hash. To be precise about what this is and is not:
  • The address itself is never written down. Only the hash is stored - we do not keep the IP address in our database, and we do not enable request logs that would record it.
  • The row holds a number. No audio, no transcript, no summary, no question, no filename - no content of any kind. To be complete: the row's key also records which kind of request was counted (an upload, a question) and the minute or day it falls in, because that is what makes it a rate limit rather than a single total.
  • It is not joined to anything. It sits under its own key, separate from your anonymous device ID and from everything else. We do not build a profile from it and cannot use it to look you up.
  • It expires automatically. The service stops using per-minute counters after 15 minutes and per-day counters after two days. AWS removes the expired rows asynchronously afterwards; they contain only the counter and never content.

We do not collect:

• Your name
• Your email address
• Your phone number
• Your precise location
• Your contacts
• Your photo library
• Health, financial, or browsing data
• Apple's advertising identifier (IDFA)

No account or sign-in is required to use the app. The optional ChatGPT or Codex connection is the exception described below; support correspondence is described under "Feedback and support".

What we process on our servers (and for how long)

When you finish a recording, your content passes through our service so we can do the work. This section describes that temporary app processing, not the separate text library kept when you enable the optional connection:

• Your audio is uploaded to our storage and sent to a speech-to-text provider to be turned into a transcript. It is deleted within about a minute of the job ending - whether it succeeded or failed. A storage rule sweeps up anything left behind about a day later.
• The finished transcript and summary are written to a single file on our storage so your phone can download them. Your phone deletes that file as soon as it has saved the recording locally, which is normally within seconds of the recording appearing in the app. If your phone never confirms - it went offline, you closed the app - API access expires after 24 hours, and the storage object is covered by a one-day lifecycle rule; physical removal is asynchronous.
• The AI provider's raw output is held the same way while the job assembles the final result. We attempt to delete it as soon as the final result is written; if cleanup fails, it may remain until a later cleanup attempt or storage-lifecycle deletion.
• Follow-up questions. When you ask a question about a recording, your phone sends the transcript along with it. We hold that transcript for up to 30 minutes, tied to your device's anonymous ID, so your next question doesn't have to upload it again. It then expires on its own. ToText does not store your questions and the answers on its servers.
• Re-summarising an existing recording stores no content on ToText's servers: the transcript goes to the AI provider and the result comes straight back to your phone. The provider's retention is described below.

Imported video: When possible, the app extracts audio on your device before uploading it. Otherwise, the selected file may be sent for processing in full, including its video. The same deletion rules apply.

The 30-minute and 24-hour windows above are enforced as access limits, not as a claim that AWS has physically erased every storage byte at the exact second. Once a row reaches its deadline, ToText's API does not return it or use its content to answer new requests, even if asynchronous cloud cleanup has not removed the expired row yet. An expired row encountered during a request is also deleted best-effort, and the database TTL and storage lifecycle remain cleanup backstops. This distinction does not extend the period in which ToText can serve or process the content.

Database recovery backups. Our DynamoDB table also contains the temporary Q&A transcript cache. Continuous backups are enabled with a rolling one-day recovery window, the shortest supported setting. An expired row may remain in the live database until asynchronous deletion completes, and earlier versions may remain recoverable in that backup window after deletion. The one-day setting is not a deadline for erasing every copy one day after upload or access expiry. It does not extend the API access limits above, and we do not use this recovery history to serve expired content or restore individual user libraries.

Subscription notices from Apple. When a subscription starts, renews, ends or is refunded, Apple notifies our server. We keep the type of event, the plan and the App Store country for about seven days, with nothing that identifies you, and send ourselves a short notice about it.

Unless you enable the optional ChatGPT or Codex connection, we do not maintain a permanent server-side library or search index of your content. Temporary processing copies and database recovery backups follow the retention rules above. Your library lives on your devices and, when enabled, in your personal iCloud. The connection's separate cloud copy follows the rules in its section below.

What stays on your device and in your own iCloud

These things live in ToText on your phone and, when iCloud Drive sync is on, in your personal iCloud. Temporary server processing and database recovery backups are described above:

• Your recording history
• Your audio files (with iCloud sync on, the audio is stored in your iCloud Drive so your devices share one copy)
• Your transcripts and summaries
• Your action items and tags
• Your Q&A chat history
• Your in-app preferences (device-only)

If you delete a recording in ToText, it is removed from your phone and, where it applies, from your iCloud Drive - and because devices share that iCloud copy, deleting on one device can remove shared content, including audio, for your other devices too. If you uninstall ToText from a device, that device's local content goes with it; anything in your iCloud Drive stays until you delete it there.

What goes to your personal iCloud Drive

If you have iCloud Drive turned on for ToText (this is on by default, but you control it), the app saves two things to your own iCloud Drive:

• The audio file of each recording, in iCloud Drive > ToText > Recordings
• A small JSON sidecar with the recording's transcript, summary, tags, and metadata, in the same folder

This is your iCloud Drive, under your Apple ID, governed by Apple's privacy policy - not ours. We can't see those files. To stop the sync, open iOS Settings → your name → iCloud → Saved to iCloud → ToText, and turn it off. To delete the synced files, open the Files app and remove them, the same way you would for Voice Memos.

The ToText Keyboard

ToText includes an optional system-wide keyboard ("ToText Keyboard") that works in any app - Messages, Mail, Notes, anything with a text field - not just ToText itself. It is a real keyboard: it has number, punctuation and symbol keys, a space bar, a return key and a delete key, so you can type with it. It also has a dictation pill, which is what lets you speak instead of type.

Full Access. iOS asks you to grant the keyboard "Full Access" before dictation works. We need it for one thing: the handoff to the ToText app. The keyboard itself can't record audio - Apple doesn't allow that. Full Access is what lets the keyboard use a small shared area on your phone (an "App Group") and open the ToText app, so it can tell the app to start or stop recording and read back the finished transcript. The recording, the transcription, and any network request all happen in the ToText app - never in the keyboard.

The keyboard has no network access of its own. There is no networking code anywhere in the keyboard: it does not connect to our servers, to Apple's, or to anyone else's. It has no way to send your typing - or anything else - off your phone.

What Full Access does not do: the ToText Keyboard never reads what is already sitting in the field you're typing into. It writes into that field - the characters you tap, a space, a new line, a deleted character when you tap delete, and the words you dictate - but it never reads any of that back, and it does not log, store, or transmit your keystrokes. The single thing it ever reads from the field is whether that field wants a light or a dark keyboard, so it can match your appearance.

Without Full Access, the keyboard still types normally. Only the dictation pill is disabled; it shows "Full Access needed" instead of starting a recording.

Two ways to finish a dictation:

• Finish (insert only) — the default. Your words are inserted as text into the field you are using. This transcription uses Apple’s speech recognition, not ToText’s cloud transcription. On iOS 26 and later, ToText tries Apple’s on-device model when available. On earlier iOS versions, or if that model is unavailable or fails, ToText uses Apple’s fallback speech-recognition service, which may send audio to Apple under Apple’s privacy policy. No audio is uploaded to ToText’s servers by this insert-only action. ToText deletes the temporary audio file on your device after transcription.
• Finish & Save - inserts the text the same way, and additionally keeps the audio as a normal ToText recording (with its own transcript and summary in the app), exactly as if you'd recorded it from inside ToText.

On-device handoff storage. Between the moment a dictation finishes and the moment the keyboard inserts it, the transcript is held briefly in shared storage on your iPhone - not visible outside the app and keyboard. It's deleted as soon as it's inserted, and if it's ever left behind (for example, if you switch away before the keyboard reopens), the app purges it automatically a short time later.

Third parties we rely on

To run the app, a small number of service providers briefly handle your data on our behalf, under contract and only to provide the service:

• A speech-to-text provider - receives the audio only to turn it into text, whose published terms commit it not to retain audio for model training, and whose copy of each transcription we delete through its API as soon as we fetch the result.
• An AI provider - receives the transcript only to write the summary and answer your follow-up questions. It does not use the content for training. It may temporarily retain content for processing and abuse prevention, generally for up to 30 days, or longer when required by law or necessary to prevent harm.
• A cloud hosting platform - runs the temporary processing described above. Your data may be processed outside your country, including in the European Union and the United States, under appropriate legal safeguards.
• Apple - handles all payments and subscription state. We never see your credit card, Apple ID, or billing address.

Crash reports, usage statistics and ad measurement use a few more service providers, described in the next section.

We do not use:

• Social media SDKs
• Advertising or tracking cookies. The optional hosted sign-in uses necessary authentication and session cookies, as described below.

We use our own service usage and request counters to understand usage and reliability, as well as to enforce limits. These counters contain no recordings or text. We do not use them for advertising or cross-app tracking.

How we improve ToText and measure our ads

To fix bugs, improve the app and see which of our ads work, ToText uses service providers for the sharing options below. These options are separate from audio processing and the optional connected text library.

• Crash reports include technical details and are kept for up to 90 days in regular storage. Backup copies may remain longer.
• Usage statistics include feature-use events and a random usage identifier, and are generally available for a year. Providers may retain them longer.
• Ad measurement shows which of our ads bring new users. It uses an installation ID and basic device, network and install details. It may also include App Store purchase and transaction details for ToText. Data is normally kept for up to 24 months; some data may be retained longer. It doesn't use Apple's advertising identifier.

Your choice. Crash reports help us keep ToText stable, so they may be on from the start. Usage statistics and ad measurement run only if you turn them on. You can enable or turn off each one anytime in the app's Settings, under Privacy. Turning them off does not change app features, your Free allowance or your paid plan.

Our providers handle this data under agreements that protect it as this policy describes, including when it is processed outside your country. Ad platforms have their own ad settings; for X, see X's ad settings.

ToText in ChatGPT and Codex (optional)

This section applies only if you enable the connection. The app still works without it. This release shares an existing text library; it does not offer new audio uploads or transcription from ChatGPT.

How sharing works

In the ToText app, open Settings > ChatGPT, read and accept the consent screen, and sign in with Apple. The connection creates a separate account and copies eligible completed recording text to our servers. Add ToText in a supported ChatGPT or Codex host and use the same Apple account to reach that cloud copy. Sharing runs while ToText is open and connected to the network; it is not an immediate, offline or always-running background delivery guarantee. After a successful sync, the assistant can reach the cloud copy even when the phone is off. Changes made through the assistant return to the app on its next successful sync.

Data used for the connection

• Connection account: the account identifier issued by Auth0, the identifier Apple supplies for your Apple account, connection and consent dates, accepted consent version, and whether the account is active. These identify your library and record your consent.
• Sign-in profile: Auth0's Apple connection requests a name and email where Apple supplies them; an email may be Apple's private relay address. Auth0 stores this profile separately from the library and can update it at sign-in. The library's structured account, recording and task records do not include the profile name or email. We do not use the sign-in profile for advertising or marketing. Text you choose to share can itself contain personal information.
• Plan and usage: app-reported and server-verified plan and expiry, a one-way reference to the verified StoreKit proof rather than the signed receipt or transaction identifier itself, monthly usage counters, last phone sync time, and shared recording count. These support plan verification, prevent proof reuse, and show library status. This release does not provide ChatGPT audio transcription or an authoritative shared transcription-minute meter.
• Recording details: recording identifier, title, recording date and time, duration, language, tags, favorite status, transcript availability, app or legacy-upload origin, change times, and whether a change came from the app or the assistant.
• Summaries and transcripts: current and original AI summaries, summary source, and transcript text split into segments with start/end times and neutral labels such as "Speaker 1". We do not identify people by their voice.
• Tasks: text, done/open status, position, parent recording and change information. Deleted items can retain content-free deletion markers so deletion reaches the phone.
• Legacy uploads: records of links issued before uploads were disabled can include a random link code, creation/expiry times, status, file name and size, failure reason and recording identifier. Previously authorized audio, if any, is held separately from the text library. There is no deployed ChatGPT transcription service for that audio.

What the assistant receives and can change

For a request about your library, ToText returns relevant search titles, recording links, short excerpts and passage times; recording details, summaries, tags and tasks; paginated transcript segments and speaker labels; or connection status, plan, remaining-minute counters, last sync, shared count and a plans link. Status can distinguish a personal library from the synthetic reviewer demo and state that uploads are unavailable. Legacy upload status can be returned for existing links. Tools do not return your sign-in profile, internal account identifier, access tokens or technical logs.

At your request, the assistant can rename recordings, change tags or favorites, rewrite summaries, and add, edit, complete, reopen or delete tasks. It cannot delete recordings or create new audio upload links in this release. These edits are stored and sync back to the phone. We receive the tool request needed for the action, not your whole conversation; search words are used for the answer and are not kept as search history. Optional host hints about locale, approximate location, device or conversation identifiers are ignored by library tools.

Returned content becomes part of your conversation with OpenAI. OpenAI handles it under its own privacy policy, terms and your account settings, including applicable history, memory and model-improvement choices. Deleting the ToText cloud copy does not delete content OpenAI already received; manage those conversations in ChatGPT or Codex separately.

Purpose, providers and location

We use connection data to provide the library access and edits you request, keep libraries separate, record consent, verify plans, prevent abuse and troubleshoot reliability. We do not sell it, use it for advertising or behavioral profiling, or use the cloud library to train our own AI models.

AWS stores the cloud library in Frankfurt, Germany, encrypted in transit and at rest. Auth0 operates the connection identity and sign-in in its United States region, including Apple identifiers, sign-in profiles and authentication metadata. Its hosted sign-in uses necessary cookies to maintain authentication and single sign-on; this can remember the last signed-in account. Apple handles Sign in with Apple. OpenAI receives the library content requested by its tools. These services can process information outside your country; the US and your country may provide different data protections. Auth0's handling is described in its data-processing information and Okta privacy policy. The optional connection does not send new audio to the app's speech-to-text or AI providers.

Share only content you have the right to share, including permission from other people where needed. Do not share protected health information, payment-card data, government identifiers, passwords, API keys or other authentication secrets through this connection. OpenAI's restricted-data rules apply; consent does not waive them. The connection is not a medical-record service and does not guarantee that prohibited information is automatically detected or removed.

Retention and deletion

• Cloud library and account: retained until you request deletion, including if the account stays connected but unused. Disconnecting only in ChatGPT, signing out or uninstalling the app does not delete this cloud copy.
• Disconnect and delete: use Settings > ChatGPT > Disconnect and delete in ToText. This removes the connection account and shared-library access and requests deletion of stored library content. Already authorized writes can finish after the request; obsolete text and legacy audio are removed by background cleanup. Removal is asynchronous, not a guarantee that every byte is physically erased at that instant or within a fixed deadline. Your phone recordings are not deleted by this action.
• Sign-in profile: we separately attempt deletion at Auth0, including a bounded retry. This can fail even after library access is removed; a remaining sign-in profile is not restored library access. There is no guaranteed automatic post-request identity retry or fixed completion time. Contact company@lovelaceloom.com for help with a remaining profile or deletion request. If the app cannot complete the cloud deletion request, keep the pending deletion and retry; an expired sign-in can require Apple verification for deletion.
• Backups: the connection's separate library database currently has no point-in-time recovery or database backups, and its storage buckets do not keep object versions. We do not keep manual or separate backup exports of users' connection libraries. This is separate from the temporary app-processing database's rolling one-day recovery window described above.
• Plan-proof records: anti-reuse lookup and account-scoped discovery records become eligible for database TTL deletion 30 days after proof expiry. Removal is asynchronous. The account's proof reference follows account retention; account deletion removes records still owned by that account, not a lookup now held by another account.
• Legacy links and audio: link records become eligible for database deletion seven days after link expiry. The ingest bucket has a one-day expiration rule, rounded to a UTC-midnight boundary and followed by asynchronous removal, not a hard 24-hour deletion promise. Previously authorized late uploads are checked and obsolete files are removed by background cleanup.
• ToText operational logs: configured retention is 30 days. Logs contain request identifiers, route/method/status, timing, feature/outcome, account-identifier hashes and error codes; an unmatched URL path can be recorded up to 80 characters. They are used for operation and troubleshooting, not advertising. Request bodies, search history, authentication secrets and optional host hints are not included in these request logs.
• Auth0 authentication logs: separate from ToText's logs; they can include account identifiers, sign-in times and outcomes, IP addresses and browser/device user-agent information. The current subscription/trial displays 30-day log retention; provider retention can change with the subscription. Profile records follow the separate profile-deletion process above. These are not transcript or audio logs.

You can review and correct shared text in ToText and through supported assistant tools, withdraw sharing consent by disconnecting and deleting, or contact us about access, export or deletion. Disconnect the app in each host to stop that host's access. Removing access cannot retract content already received by the host. The reviewer demo contains only invented sample recordings and is separate from personal libraries. This connection is not intended for children under 13.

Subscriptions and payments

ToText offers a free tier and two paid subscriptions (Basic and Pro). All purchases are handled by Apple's in-app purchase system. We never see your credit card or your Apple ID.

When the app needs to confirm your tier - for example, to apply your paid quota - it asks Apple's StoreKit framework for a signed receipt and sends it to our server only to be checked. We verify the signature, read out the tier, and discard the receipt itself. We do not store the receipt.

We do keep one small anti-fraud record per subscription, so that a single receipt copied onto many devices doesn't go unnoticed. It contains Apple's transaction ID for that subscription, the one-way hashed device IDs that have presented it, and the first and last time we saw it. That's all it contains: no name, no email, no billing details, no card number, and none of your recordings or text. It becomes eligible for asynchronous deletion about 30 days after the subscription expires (about a year for a one-off, non-expiring purchase).

Connected accounts additionally keep the verified plan and expiry and a one-way proof reference to prevent reuse across connection accounts, as described in the optional connection section. The signed receipt is not stored there.

To manage or cancel your subscription, open iOS Settings → your name → Subscriptions, the same as any other app.

Feedback and support

Normal use of ToText never asks you for a way to reach you. When you choose to write to us, the app offers two routes in Settings → Help & feedback, and they are deliberately different:

• Send feedback without contact details. The message you type is sent to our service together with the topic you picked (general, bug or idea), where you opened the form, the ToText version, your device model and your iOS version. The service turns that into an email to our support mailbox; the message text is not written to our database or application logs. The app does not request or attach your name, email address or another contact detail, so we cannot reply to it - the app says so before you send. Like every request to our service, it carries your anonymous device ID; the one-way form of that ID is used only for the abuse counters described under "What we collect about you" and is not included in the email. Please do not put personal or sensitive information in the message.
• Get help by email. This opens a normal email draft in your own mail app, addressed to our support mailbox, with a subject that names the ToText version and a short block at the end listing the ToText version and build, your device model, iOS version and the app language. The draft is yours: you can edit or delete any part of it, including that block, before you send it. Nothing leaves your phone until you press Send in your mail app. If you do send it, we receive what any email carries - the address you sent it from, the text you wrote and any attachment you chose - and we use it only to answer you and to work out what went wrong. We can then reply to that address. Please do not attach a recording or transcript unless we ask for it.

The routes land in support inboxes operated for us by our email providers and are kept there like other correspondence for as long as we need them to handle the request and keep a record of what was agreed. To have an email support conversation deleted, write to us from the same address and we will delete the thread. Because feedback without contact details is not linked to a name or reply address, we generally cannot identify a particular message as yours or delete it on request. If you put identifying information in the message despite the warning, that information will be present in the email we receive.

Security

• All traffic between the app and our servers goes over HTTPS (TLS 1.2 or newer) using Apple's built-in URLSession. We do not implement our own cryptography.
• Audio is encrypted in transit and at rest while it is being processed.

Your rights (GDPR and CCPA)

App use without the optional connection gives us no sign-in name, email or account. The connection's separate library and profile, and your choices about them, are described above. If you contact support by email, or type identifying information into optional feedback despite the warning, that support correspondence can identify you as described above. The following device-based rights and counters describe ordinary app processing, not the connection's cloud library:

• Right to access - every recording, transcript, and summary is already visible inside the app. For identifiable support correspondence, write from the same email address and we will help with an access or deletion request. Anonymous feedback normally cannot be matched back to a person.
• Right to correction - write to us to correct personal information we hold about you.
• Right to delete - open Settings → Delete all my data to remove the app's local content, attempt to clear its iCloud content, and request deletion of eligible data stored under your anonymous device ID. The app reports cleanup failures it detects and retries eligible pending work; in some edge cases content in iCloud may survive without being flagged, which is why the uninstall route below also exists. You can also uninstall the app and remove the ToText folder from iCloud Drive.
• Right to portability - your recordings export from inside the app (share sheet on any recording).
• Right to object / restrict processing - turn off crash reports, usage statistics or ad measurement in the app's Settings, under Privacy, or stop using the app. We can't process what we don't receive. Crash reports that start on their own rely on our interest in keeping the app working.
• Right to complain - you can also contact your local data-protection authority.

About device-based monthly counters. For allowances based on a device, we hold under your device's anonymous ID the counter of minutes used in the current month, plus small daily request counters that expire by themselves within two days. Being precise about how that ID works matters here, because it decides what deletion is possible. Your phone generates a random identifier and sends it to us with every request - it is what tells our server the request is yours. We never store it. What we store is a one-way hash of it, salted with a secret only the server holds. So while a request is in front of us we can reach exactly your rows, which is how the erasure endpoint below is able to work at all - but we hold nothing that ties those rows to you as a person: no name, no email, no account. And we cannot run it backwards, from a row to a device or from an email address to a row. That is the honest obstacle to deleting by email: not that the rows are unreachable, but that we have no way to know which rows are yours. We would have to ask you to hand us your device's identifier, which would mean giving up the anonymity that is the whole point. Write to company@lovelaceloom.com if you want to talk it through and we will explain exactly what is held.

When you choose Settings → Delete all my data, the app removes local content, attempts to clear its iCloud content, and requests immediate deletion of the server rows that can be addressed safely: rows under your anonymous device partition (apart from the two counter families below) and processing jobs still known to the app. If iCloud or a network request fails, the app reports that cleanup is incomplete and retries the pending work on a later launch; it does not repeat the local database wipe or intentionally delete recordings created afterwards.

The current month's device-based minute counter and the daily rate-limit counters are retained so deletion cannot be used to reset free allowances or rate limits. Daily counters expire within two days. As the updated monthly-retention setting is deployed, device-based monthly counters written or updated by that version receive an expiry about two months after the month they count. Counters created before that setting, including ones not subsequently updated, may not have an automatic expiry; a later erasure request removes eligible legacy rows. We document that limitation rather than claiming every existing row already has an expiry.

Subscription-based metering is being introduced in stages. Until it is enabled, paid allowances remain device-based. When subscription-based metering is enabled and a verified subscription identifier is available, the monthly minute counter is kept under a secret-keyed, one-way hash of the subscription identifier Apple issues to your purchase (the same identifier the app already sends us inside the signed receipt). Devices presenting that same subscription then share one monthly allowance. That counter row holds only the minutes used, the last activity time and an expiry about two months after the month it counts. Because it is not filed under your device partition, Delete all my data does not remove it; expired rows are removed asynchronously. While a recording is being processed and during its short handover window, its job row links the hashed subscription-pool key and the hashed ID of the device that submitted it, so completion, failure or cancellation updates the correct allowance. Separately, the StoreKit anti-fraud record described above keeps Apple's subscription transaction identifier together with the hashed IDs of devices that presented it until that record expires. These technical links associate usage with a subscription and its pseudonymous devices. The counter contains no name, email, billing details, audio, transcript or summary and does not identify you to us as a person. If verified subscription identity is unavailable, device-based metering may still apply.

Some bounded rows use different database keys and cannot be reached by the device-partition erasure request. A Q&A transcript cache becomes inaccessible after 30 minutes; upload idempotency and any processing job no longer known to the app become inaccessible after about 24 hours; finished-result handover objects have a one-day lifecycle safety net; device and subscription minute counters receiving the updated retention setting get an expiry about two months after their month, subject to the rollout and legacy device-row limitations above; and the StoreKit anti-fraud observation record expires on the schedule described above. Physical removal by database TTL and storage lifecycle is asynchronous. IP-derived rate-limit counters cannot be linked to a device and stop being used within minutes to two days.

Deleting a live database row does not immediately remove its earlier versions from recovery backups; the backup window described above still applies.

If you enabled the optional connection, also use Settings > ChatGPT > Disconnect and delete to request removal of its cloud copy. The app's Delete all my data flow can request connection deletion too; if sign-in has expired, complete the separate Apple verification needed for deletion. The connection's asynchronous content cleanup and separate sign-in profile failure conditions described above still apply.

The IP-derived rate-limiting counters described under "What we collect about you" are a separate case. We store no mapping between them and your device ID, so a device erasure request cannot identify them. They hold only a request count, stop being used within minutes to two days, and are removed asynchronously afterwards.

Children

ToText is rated 4+ in the App Store but designed for general use. We do not knowingly collect data from children under 13 or direct the app at children. Ordinary app use has no age profile; the optional ChatGPT or Codex connection is not intended for children under 13. If a parent believes a child has shared information, contact us about deletion; device-counter removal is described above.

Changes to this policy

When something material changes, we'll update the version number and effective date at the top of this document. The current version always lives on this page, which is what the app opens when you tap Settings → About → Privacy Policy - so what you read in the app and what you read here are the same document.

Contact

Privacy questions, comments, deletion requests, or anything else:

company@lovelaceloom.com

ToText is operated by Eyal Ronen under the LovelaceLoom brand.