Privacy Policy

ToText Privacy Policy

Effective date: 2026-09-21 · Version: 2.11

ToText is a personal voice-note app for iPhone. It records your voice, turns it into text, writes a short summary, and lets you chat with that text. We built it to be as private as we could make it: there is no account, no sign-in, and almost nothing about you ever leaves your phone.

This document tells you, in plain English, what happens to your data. If you have questions, write to company@lovelaceloom.com.

The short version

• You don't create an account. We don't know your name, email, or phone number.
• Your recordings, transcripts, summaries, and chat history live on your iPhone and, when enabled, in your personal iCloud. We do not maintain a permanent server-side library or search index. Temporary processing copies and database recovery backups are described below.
• We briefly send the audio to a speech-to-text provider to turn it into text. The audio is deleted shortly after the transcription finishes.
• A finished transcript and summary sit on our server just long enough for your phone to download them - normally seconds. If your phone never picks them up, they expire on their own within about a day.
• When you ask follow-up questions about a recording, we hold that transcript for up to 30 minutes so each question doesn't have to re-upload it. Then it expires. The questions and answers themselves are never stored. The AI provider may keep that transcript in a short-lived processing cache so the next question is answered faster: the cache expires five minutes after the last question that used it (each reuse restarts the five minutes; we never ask for a longer window). It is not used for training.
• A counter that tracks how many minutes you've used this month lives on our server, attached to a random ID - not to you.
• To stop abuse, our server also keeps small counters that just count requests. One of them is keyed to a one-way hash of the IP address your request arrives from. They hold no content. The service stops using them within minutes to two days, and AWS removes the expired rows asynchronously afterwards.
• Payments go through Apple. We never see your credit card or your Apple ID.

If you'd rather skip the rest, that's the whole story.

What we collect about you

Almost nothing. Specifically:

• An anonymous device ID. When you first open the app, your iPhone creates a random identifier and stores it in the iOS Keychain. Your phone sends that identifier with service requests; we do not store the raw value. We store a one-way form produced with a server secret and use it to scope processing jobs, quotas and short-lived service controls. We can't trace that stored form back to you, and it isn't linked to your Apple ID, email or name.
• A short-lived rate-limiting counter derived from your IP address. Our service is anonymous and free to start, which makes it an easy target for automated abuse. To keep the lights on, the server takes the IP address your request arrives from, runs it through a one-way hash, and increments a plain request counter stored under that hash. To be precise about what this is and is not:
  • The address itself is never written down. Only the hash is stored - we do not keep the IP address in our database, and we do not enable request logs that would record it.
  • The row holds a number. No audio, no transcript, no summary, no question, no filename - no content of any kind. To be complete: the row's key also records which kind of request was counted (an upload, a question) and the minute or day it falls in, because that is what makes it a rate limit rather than a single total.
  • It is not joined to anything. It sits under its own key, separate from your anonymous device ID and from everything else. We do not build a profile from it and cannot use it to look you up.
  • It expires automatically. The service stops using per-minute counters after 15 minutes and per-day counters after two days. AWS removes the expired rows asynchronously afterwards; they contain only the counter and never content.

We do not collect:

• Your name
• Your email address
• Your phone number
• Your location (precise or coarse)
• Your contacts
• Your photo library
• Health, financial, or browsing data
• Advertising identifiers

There is no account to sign in to. There is no "sign up" screen. Installing the app is the only step.

What we process on our servers (and for how long)

When you finish a recording, your content passes through our service so we can do the work. Here is every place it sits on our side, and for how long:

• Your audio is uploaded to our storage and sent to a speech-to-text provider to be turned into a transcript. It is deleted within about a minute of the job ending - whether it succeeded or failed. A storage rule sweeps up anything left behind about a day later.
• The finished transcript and summary are written to a single file on our storage so your phone can download them. Your phone deletes that file as soon as it has saved the recording locally, which is normally within seconds of the recording appearing in the app. If your phone never confirms - it went offline, you closed the app - the file is still not kept: the database record expires after 24 hours and the file itself about a day later.
• The AI provider's raw output is held the same way while the job assembles the final result, and is deleted the moment that result is written - a matter of seconds.
• Follow-up questions. When you ask a question about a recording, your phone sends the transcript along with it. We hold that transcript for up to 30 minutes, tied to your device's anonymous ID, so your next question doesn't have to upload it again. It then expires on its own. Your questions and the answers to them are never stored.
• Re-summarising an existing recording stores nothing at all: the transcript goes to the AI provider and the result comes straight back to your phone.

The 30-minute and 24-hour windows above are enforced as access limits, not as a claim that AWS has physically erased every storage byte at the exact second. Once a row reaches its deadline, ToText's API refuses to read or return it even if asynchronous cloud cleanup has not removed the expired row yet. An expired row encountered during a request is also deleted best-effort, and the database TTL and storage lifecycle remain cleanup backstops. This distinction does not extend the period in which ToText can serve or process the content.

Database recovery backups. Our DynamoDB table also contains the temporary Q&A transcript cache. Continuous backups are enabled with a rolling one-day recovery window, the shortest supported setting. An expired row may remain in the live database until asynchronous deletion completes, and earlier versions may remain recoverable in that backup window after deletion. The one-day setting is not a deadline for erasing every copy one day after upload or access expiry. It does not extend the API access limits above, and we do not use this recovery history to serve expired content or restore individual user libraries.

We do not maintain a permanent server-side library or search index of your content. Temporary processing copies and database recovery backups follow the retention rules above. Your library lives on your devices and, when enabled, in your personal iCloud.

What stays on your device and in your own iCloud

These things live in ToText on your phone and, when iCloud Drive sync is on, in your personal iCloud. Temporary server processing and database recovery backups are described above:

• Your recording history
• Your audio files (with iCloud sync on, the audio is stored in your iCloud Drive so your devices share one copy)
• Your transcripts and summaries
• Your action items and tags
• Your Q&A chat history
• Your in-app preferences (device-only)

If you delete a recording in ToText, it is removed from your phone and, where it applies, from your iCloud Drive - and because devices share that iCloud copy, deleting on one device can remove shared content, including audio, for your other devices too. If you uninstall ToText from a device, that device's local content goes with it; anything in your iCloud Drive stays until you delete it there.

What goes to your personal iCloud Drive

If you have iCloud Drive turned on for ToText (this is on by default, but you control it), the app saves two things to your own iCloud Drive:

• The audio file of each recording, in iCloud Drive > ToText > Recordings
• A small JSON sidecar with the recording's transcript, summary, tags, and metadata, in the same folder

This is your iCloud Drive, under your Apple ID, governed by Apple's privacy policy - not ours. We can't see those files. To stop the sync, open iOS Settings → your name → iCloud → Saved to iCloud → ToText, and turn it off. To delete the synced files, open the Files app and remove them, the same way you would for Voice Memos.

The ToText Keyboard

ToText includes an optional system-wide keyboard ("ToText Keyboard") that works in any app - Messages, Mail, Notes, anything with a text field - not just ToText itself. It is a real keyboard: it has number, punctuation and symbol keys, a space bar, a return key and a delete key, so you can type with it. It also has a dictation pill, which is what lets you speak instead of type.

Full Access. iOS asks you to grant the keyboard "Full Access" before dictation works. We need it for one thing: the handoff to the ToText app. The keyboard itself can't record audio - Apple doesn't allow that. Full Access is what lets the keyboard use a small shared area on your phone (an "App Group") and open the ToText app, so it can tell the app to start or stop recording and read back the finished transcript. The recording, the transcription, and any network request all happen in the ToText app - never in the keyboard.

The keyboard has no network access of its own. There is no networking code anywhere in the keyboard: it does not connect to our servers, to Apple's, or to anyone else's. It has no way to send your typing - or anything else - off your phone.

What Full Access does not do: the ToText Keyboard never reads what is already sitting in the field you're typing into. It writes into that field - the characters you tap, a space, a new line, a deleted character when you tap delete, and the words you dictate - but it never reads any of that back, and it does not log, store, or transmit your keystrokes. The single thing it ever reads from the field is whether that field wants a light or a dark keyboard, so it can match your appearance.

Without Full Access, the keyboard still types normally. Only the dictation pill is disabled; it shows "Full Access needed" instead of starting a recording.

Two ways to finish a dictation:

• Finish (insert only) — the default. Your words are inserted as text into the field you are using. This transcription uses Apple’s speech recognition, not ToText’s cloud transcription. On iOS 26 and later, ToText tries Apple’s on-device model when available. On earlier iOS versions, or if that model is unavailable or fails, ToText uses Apple’s fallback speech-recognition service, which may send audio to Apple under Apple’s privacy policy. No audio is uploaded to ToText’s servers by this insert-only action. ToText deletes the temporary audio file on your device after transcription.
• Finish & Save - inserts the text the same way, and additionally keeps the audio as a normal ToText recording (with its own transcript and summary in the app), exactly as if you'd recorded it from inside ToText.

On-device handoff storage. Between the moment a dictation finishes and the moment the keyboard inserts it, the transcript is held briefly in shared storage on your iPhone - not visible outside the app and keyboard. It's deleted as soon as it's inserted, and if it's ever left behind (for example, if you switch away before the keyboard reopens), the app purges it automatically a short time later.

Third parties we rely on

To run the app, a small number of service providers briefly handle your data on our behalf, under contract and only to provide the service:

• A speech-to-text provider - receives the audio only to turn it into text, whose published terms commit it not to retain audio for model training, and whose copy of each transcription we delete through its API as soon as we fetch the result.
• An AI provider - receives the transcript only to write the summary and answer your follow-up questions. It does not use the content for training. For follow-up questions it may hold the transcript in a short-lived processing cache so the next one is answered faster; that cache expires five minutes after the last question that used it (each reuse restarts the five minutes, and we never ask for a longer window). Beyond that it does not retain the content.
• A cloud hosting platform - runs the temporary processing described above. Your data may be processed outside your country, including in the European Union and the United States, under appropriate legal safeguards.
• Apple - handles all payments and subscription state. We never see your credit card, Apple ID, or billing address.

We do not use:

• Analytics SDKs (Firebase, Mixpanel, Google Analytics, Amplitude, etc.)
• Crash reporters that send data to third parties
• Advertising networks or ad SDKs
• Social media SDKs
• Tracking pixels or cookies (the app is not a web browser)

Subscriptions and payments

ToText offers a free tier and two paid subscriptions (Basic and Pro). All purchases are handled by Apple's in-app purchase system. We never see your credit card or your Apple ID.

When the app needs to confirm your tier - for example, to apply your paid quota - it asks Apple's StoreKit framework for a signed receipt and sends it to our server only to be checked. We verify the signature, read out the tier, and discard the receipt itself. We do not store the receipt.

We do keep one small anti-fraud record per subscription, so that a single receipt copied onto many devices doesn't go unnoticed. It contains Apple's transaction ID for that subscription, the one-way hashed device IDs that have presented it, and the first and last time we saw it. That's all it contains: no name, no email, no billing details, no card number, and none of your recordings or text. It deletes itself automatically about 30 days after the subscription expires (about a year for a one-off, non-expiring purchase).

To manage or cancel your subscription, open iOS Settings → your name → Subscriptions, the same as any other app.

Feedback and support

Normal use of ToText never asks you for a way to reach you. When you choose to write to us, the app offers two routes in Settings → Help & feedback, and they are deliberately different:

• Send feedback without contact details. The message you type is sent to our service together with the topic you picked (general, bug or idea), where you opened the form, the ToText version, your device model and your iOS version. The service turns that into an email to our support mailbox; the message text is not written to our database or application logs. The app does not request or attach your name, email address or another contact detail, so we cannot reply to it - the app says so before you send. Like every request to our service, it carries your anonymous device ID; the one-way form of that ID is used only for the abuse counters described under "What we collect about you" and is not included in the email. Please do not put personal or sensitive information in the message.
• Get help by email. This opens a normal email draft in your own mail app, addressed to our support mailbox, with a subject that names the ToText version and a short block at the end listing the ToText version and build, your device model, iOS version and the app language. The draft is yours: you can edit or delete any part of it, including that block, before you send it. Nothing leaves your phone until you press Send in your mail app. If you do send it, we receive what any email carries - the address you sent it from, the text you wrote and any attachment you chose - and we use it only to answer you and to work out what went wrong. We can then reply to that address. Please do not attach a recording or transcript unless we ask for it.

The routes land in support inboxes operated for us by our email providers and are kept there like other correspondence for as long as we need them to handle the request and keep a record of what was agreed. To have an email support conversation deleted, write to us from the same address and we will delete the thread. Because feedback without contact details is not linked to a name or reply address, we generally cannot identify a particular message as yours or delete it on request. If you put identifying information in the message despite the warning, that information will be present in the email we receive.

Security

• All traffic between the app and our servers goes over HTTPS (TLS 1.2 or newer) using Apple's built-in URLSession. We do not implement our own cryptography.
• Audio is encrypted in transit and at rest while it is being processed.
• We declared ITSAppUsesNonExemptEncryption = NO in the app, because we use only Apple's standard HTTPS and no proprietary encryption.

Your rights (GDPR and CCPA)

Normal app use gives us no name, email or account. If you contact support by email, or type identifying information into optional feedback despite the warning, that support correspondence can identify you as described above. Outside support, what we hold is the pseudonymous counters described under "What we collect about you", plus the short-lived processing copies described under "What we process on our servers". So there is very little to request from us:

• Right to access - every recording, transcript, and summary is already visible inside the app. For identifiable support correspondence, write from the same email address and we will help with an access or deletion request. Anonymous feedback normally cannot be matched back to a person.
• Right to delete - open Settings → Delete all my data to remove the app's local content, attempt to clear its iCloud content, and request deletion of eligible data stored under your anonymous device ID. The app reports cleanup failures it detects and retries eligible pending work; in some edge cases content in iCloud may survive without being flagged, which is why the uninstall route below also exists. You can also uninstall the app and remove the ToText folder from iCloud Drive.
• Right to portability - your recordings export from inside the app (share sheet on any recording).
• Right to object / restrict processing - stop using the app or uninstall it. We can't process what we don't receive.

About the anonymous monthly counter. Under your device's anonymous ID we hold the counter of minutes used in the current month, plus small daily request counters that expire by themselves within two days. Being precise about how that ID works matters here, because it decides what deletion is possible. Your phone generates a random identifier and sends it to us with every request - it is what tells our server the request is yours. We never store it. What we store is a one-way hash of it, salted with a secret only the server holds. So while a request is in front of us we can reach exactly your rows, which is how the erasure endpoint below is able to work at all - but we hold nothing that ties those rows to you as a person: no name, no email, no account. And we cannot run it backwards, from a row to a device or from an email address to a row. That is the honest obstacle to deleting by email: not that the rows are unreachable, but that we have no way to know which rows are yours. We would have to ask you to hand us your device's identifier, which would mean giving up the anonymity that is the whole point. Write to company@lovelaceloom.com if you want to talk it through and we will explain exactly what is held.

When you choose Settings → Delete all my data, the app removes local content, attempts to clear its iCloud content, and requests immediate deletion of the server rows that can be addressed safely: rows under your anonymous device partition (apart from the two counter families below) and processing jobs still known to the app. If iCloud or a network request fails, the app reports that cleanup is incomplete and retries the pending work on a later launch; it does not repeat the local database wipe or intentionally delete recordings created afterwards.

The current month's minute counter and the daily rate-limit counters are retained so deletion cannot be used to reset free allowances or rate limits. Daily counters expire within two days. The current-month counter has no automatic expiry today: it stops being used after the month ends and is deleted by a later erasure request, but it may otherwise remain as a pseudonymous usage count and last-activity time. We are documenting that limitation rather than calling it temporary.

Some bounded rows use different database keys and cannot be reached by the device-partition erasure request. A Q&A transcript cache becomes inaccessible after 30 minutes; upload idempotency and any processing job no longer known to the app become inaccessible after about 24 hours; finished-result handover objects have a one-day lifecycle safety net; and the StoreKit anti-fraud observation record expires on the schedule described above. Physical removal by database TTL and storage lifecycle is asynchronous. IP-derived rate-limit counters cannot be linked to a device and stop being used within minutes to two days.

Deleting a live database row does not immediately remove its earlier versions from recovery backups; the backup window described above still applies.

The IP-derived rate-limiting counters described under "What we collect about you" are a separate case. We store no mapping between them and your device ID, so a device erasure request cannot identify them. They hold only a request count, stop being used within minutes to two days, and are removed asynchronously afterwards.

Children

ToText is rated 4+ in the App Store but designed for general use. We do not knowingly collect data from children under 13. We do not direct the app at children, and because there is no account or profile, we have no way to identify a user's age. If a parent believes their child has used the app and wants the anonymous device counter removed, see the previous section.

Changes to this policy

When something material changes, we'll update the version number and effective date at the top of this document. The current version always lives on this page, which is what the app opens when you tap Settings → About → Privacy Policy - so what you read in the app and what you read here are the same document.

Contact

Privacy questions, comments, deletion requests, or anything else:

company@lovelaceloom.com

The ToText app is operated by Lovelace Loom.