Privacy Policy

Effective: July 14, 2026 · Last updated: July 30, 2026

Our design principle is simple: your data lives on your device. Almost nothing you store in Deeta ever reaches our servers, and the narrow paths that do leave your device are described plainly below.

1. Introduction and scope

Deeta is made by Deeta LLC ("Deeta," "we," "us"). Deeta is a private, on-device app for keeping rich, structured information about the people in your life.

This policy explains what information Deeta handles, where it lives, when (if ever) it leaves your device, and the choices and rights you have. It covers the Deeta iOS app and the deeta.app website. The effective date of the current version is shown at the top of this policy and changes whenever we revise it (see Section 14).

2. What we collect and where it lives

On-device data (never sent to a server unless you explicitly share or run an AI query). Your contacts, deets (the notes and structured details you keep about people), tags, groups, your own self-profile, and your AI preferences are stored on your device, encrypted. They do not touch our servers as part of normal use.

Quick-capture content ("Saved to Deeta"). Links, text, and notes you save through the iOS Share Sheet, inside iMessage, or via Siri/Shortcuts are stored as deets on your device, encrypted — they are never sent to our servers. This includes a private, hashed map that links an iMessage conversation to a contact so captures land in the right place; that map stays on your device and is never synced. See Section 13 for how these capture flows work.

Account data. Your email address, your multi-factor-authentication secret (if you enable MFA), and a flag recording that you confirmed you are old enough to use Deeta are stored through our authentication provider, Supabase.

Identity verification. If you choose to verify your identity, we record only which methods you completed and when — never the underlying documents or data. Email verification records only that your (already-provided) email was confirmed. Phone verification and government-ID verification are not part of this release. (If phone verification is turned on in a future release, it would send a one-time code to your number through our SMS provider, AWS SNS, and then discard the number — storing only a one-way hash, never the number itself. We would disclose that in the release that turns it on.)

Subscription data. If you subscribe, we store your subscription state (a RevenueCat subscriber ID, the billing platform, and your entitlement level). We do not store your card details.

Usage analytics. We use TelemetryDeck for privacy-preserving product analytics — which features and screens you use, and context like your subscription tier — plus a per-launch anonymous session identifier. These events are not linked to your account (we do not attach your account identifier) and contain no personal details like your name, contacts, or messages. They are never used to track you across other companies' apps or websites.

Crash reports. We use Firebase Crashlytics to diagnose crashes. Crash reports carry standard device diagnostics (such as model, OS version, and a device identifier used for crash triage) but no Deeta account identifier — so they are not linked to your account. They are used only to fix bugs, never to track you.

When you share a profile, the share payload is encrypted in transit (TLS) and at rest (AES-256). Shares are time-limited and revocable. If someone re-shares a profile they received, that reshare is a static snapshot — there is no live link back to the original sender.

When you accept someone's shared profile, your self-profile name and verified email are shared with that person. This lets them see who imported their profile and manage or revoke the share. Sharing this is required — there is no anonymous accept. It is zero-knowledge to Deeta: your name and email are encrypted under a key derived from the share that our servers never hold, so Deeta cannot read them. Only the person who shared with you can read them, on their device.

4. AI queries and third-party processing

Transient by default — nothing is kept. When one of your AI questions actually needs the cloud, Deeta sends a serialized version of the relevant data through our Supabase Edge Function proxy to the AI provider you selected, returns the answer, and immediately discards both the question and the answer. There is no server-side storage of your AI content, with one narrow, opt-in exception: if an AI question is blocked as off-topic and you tap "This doesn't seem right?", that single question's text is written to a founder-only review queue so we can improve the filter. That path is consented per tap, locked down so only we can read it, deleted if you delete your account, and time-limited (the raw text is redacted 90 days after review; entries never reviewed are deleted after 180 days). No other server path keeps your AI content.

You choose the AI provider. Deeta lets you choose which third-party AI provider handles your queries, on every plan. The full set of possible AI recipients is Anthropic (Claude), OpenAI, Google (Gemini, via Google Vertex AI in the EU), and Groq (the default is Anthropic first, OpenAI second). Each processes your query under its own data-processing terms. We disclose all four — not just one.

Identity tokenization on the chat path. Before anything leaves your device on the AI-chat path, the identities of your contacts are replaced with on-device pseudonyms (like P1, P2). The map from a pseudonym back to a real person never leaves your device, and the answer is translated back to real names on your device before you see it. This applies to every AI-chat cloud call, whichever provider you pick, and it fails safe: a chat query that cannot be tokenized is blocked rather than sent. This is the main privacy mechanism for chat queries. (It does not apply to the separate deet-extraction flow described below, which is protected differently — so please don't read this as "everything that leaves your device is tokenized.")

PII field-stripping. In addition, personal contact details the model doesn't need — phone numbers, email addresses, physical addresses — are stripped out before a query is serialized. Field-stripping removes those values; tokenization pseudonymizes the identities that remain. The two work together.

Private Mode (on supported devices). On Apple-Intelligence-capable devices you can choose Private Mode, which uses Apple's on-device Foundation Models. In this mode, all reasoning over your data happens on your device and no personal or special-category data leaves it at all. When a question needs public web information, your device sends only an anonymous web search (never a contact, name, or sensitive detail) and matches the results locally. Precisely: "In Private Mode, your contacts and personal data never leave your device. When you ask about public information, Deeta sends only an anonymous web search — never your contacts, names, or sensitive details."

Sensitive (special-category) questions. Questions that touch sensitive topics (such as health or religion) default to on-device handling on capable devices. Any part that must still reach the cloud is tokenized, and for users in the EU/EEA/UK it is routed to EU-based AI infrastructure.

Turning notes into deets — a separate flow. When you turn spoken notes or forwarded text into structured deets, the parsing runs on your device on Apple-Intelligence-capable hardware — the content never leaves the device. Only on a device that can't run it locally is the raw text sent to a secure third-party AI service — Google's Gemini (via Vertex AI), with Anthropic's Claude as a fallback — to structure it, and then immediately discarded (nothing is stored). This extraction text is sent as-is — it is not identity-tokenized or PII-stripped, because the text itself is what's being structured. It is protected differently: (a) on-device first, so a device that can run it locally never falls back to the cloud; (b) the AI is instructed to extract only — never infer or diagnose; (c) you review and confirm every field before anything is saved; (d) for EU/UK users this runs on EU-based servers; and (e) nothing is retained. If you extract from an image, the text is read on your device (Vision) and the image is never uploaded — only the extracted text can reach the cloud. Precisely: "On newer iPhones, Deeta structures your notes entirely on your device. On older devices, the text you're saving is sent to a secure AI service (Google or Anthropic) to structure it — never stored, and you confirm every detail before it's saved. For users in the EU and UK, this happens on EU-based servers."

Off-topic questions are answered on your device — your question itself is never sent to any server. For signed-in users, a usage counter tied to your account is updated so we can account for queries; that counter contains no part of your question.

Web search (Brave). External web search uses the Brave Search API, always called through Deeta's proxy (the Brave key is never in the app). This happens on two paths — external web search on the Plus+ plan, and the anonymous web-search step of Private Mode — and on both, only a depersonalized public web query leaves your device. Brave is a disclosed sub-processor. Separately, if you use Siri or Apple dictation for voice input, Apple processes the spoken text as a sub-processor (Siri voice input is off by default for EU users).

By plan. Free: no location and no cloud web search. Plus+: optional coarse location (used transiently for context, never stored) and optional external web search via Brave.

5. Subscription billing

Apple App Store: Apple is the merchant of record for in-app purchases.
Web (Stripe): Stripe processes your payment data. Deeta receives your subscription state through a RevenueCat webhook but does not store your card details.

6. Research participation

This applies only to users at research-eligible academic institutions who opt in through the consent screen.
What is captured: pseudonymous usage patterns (IDs derived by a one-way HMAC — see Section 12 for how these are destroyed on deletion). Event types include self-profile changes, sharing actions, contact imports, and AI-query events. No names, contacts, messages, or personal details are captured.
Data is shared only with named academic researchers bound by signed Data Use Agreements.
Only half of eligible users are ever shown the consent prompt (a 50/50 split); the other half never see it and no data is shared.
You can withdraw anytime in Settings → Privacy → Research Participation; your past data is excluded from future exports.
The consent flow is built to IRB standards. No research data is shared with anyone until an Institutional Review Board has approved the study and a Data Use Agreement is signed.

7. Android waitlist

If you join the Android waitlist, your email is stored solely to notify you at launch. It is not sold, shared, or used for anything else. We keep limited security metadata (the share link used, an approximate country, and a hashed IP with a daily-rotating salt). You can unsubscribe via the link in any email or by writing to privacy@deeta.app.

8. Pre-launch waitlist

If you join the pre-launch waitlist through deeta.app, your email is used only for Deeta launch updates and is never sold or shared. You can unsubscribe anytime via the unsubscribe link. As we say on the site: we do not sell or share your information with anyone, ever.

9. Children's privacy (COPPA)

Deeta is intended for users 13 and older. During onboarding we ask for your date of birth and block anyone under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact privacy@deeta.app and we will delete it.

If you are in the EU/EEA/UK, you have the rights to access, rectify, delete, port, restrict processing, and object. Most of these are built directly into the app:

Access and portability (Articles 15 and 20): Settings → Privacy → Export My Data produces an on-device JSON + CSV bundle plus a server-side data packet.
Erasure (Article 17): Settings → Account → Delete My Account runs a hard-delete server cascade.
Rectification: you edit your own data at any time in the app.

For requests that arrive outside the app, write to privacy@deeta.app; we verify your identity and respond within 30 days.

11. Your CCPA rights

If you are a California resident, you have the rights to know, delete, and opt out of the sale or sharing of your personal information (we do not sell or share your data), and the right to non-discrimination for exercising them. These are satisfied by the same in-app Export My Data and Delete My Account tools, applied uniformly to all US users.

12. Data retention

On-device data: kept as long as the app is installed. You can remove it with Delete My Account (which offers to wipe local data) and export it any time.
Quick-capture data: captured deets follow the same on-device retention as any deet. The on-device conversation-to-contact map is deleted when the linked contact is deleted.
Server-side account data: a short list — your authentication record, usage counters, consent logs, zero-knowledge ciphertext, the off-topic review queue, and processor records. All of it is hard-deleted (not merely hidden) when you delete your account. AI-query content is never retained.
Share payloads: zero-knowledge ciphertext we cannot read; they expire on the schedule the sender set (24 hours to 30 days) and are hard-deleted on expiry or revocation.
Subscription records: retained for tax and legal compliance (typically 7 years); the RevenueCat subscriber record is deleted when you delete your account.
Research events: identified by pseudonymous, HMAC-derived IDs tied to a per-user salt held on our servers. While that salt exists the events are treated as personal data; when you delete your account, the salt and your mapping are permanently destroyed, so the remaining events can no longer be traced back to you by anyone, including us.
Backups: your data is removed from active systems immediately on erasure and ages out of encrypted backups within our retention window (target: 30 days or less).
Waitlist emails: kept until the launch notification is sent, and deleted within 30 days of unsubscribing.

13. Saving links & notes ("Saved to Deeta")

Capture surfaces. You can save content to a contact or to your own profile from the iOS Share Sheet, inside iMessage, or via Siri/Shortcuts. What you save is stored on your device as an encrypted deet; our servers are never aware of it.
Clipboard. We can tell whether your clipboard holds a link without reading it (using an iOS pattern-detection API that shows no prompt). We only read the clipboard when you explicitly tap "Save link from clipboard," which triggers the iOS "Pasted from …" banner.
Link previews. When you save a link, your device — not our servers — fetches a preview from the destination site. The preview isn't stored, and no Deeta-identifying information is sent (only a standard User-Agent).
Siri / Shortcuts. Contact names are indexed on your device so Siri can resolve "save this to Sarah," including relationship terms like "my mom." That index stays on your device.
Digital business cards (e.g., Blinq, HiHello, Popl). When you save a link to someone's digital business card, your device fetches and parses that card into proposed deets — on your device, at your explicit request — and you review every field before anything is saved. Our servers never see the card or the link. This reads the card owner's published contact details only to let you save a contact you were handed — the same as reading the card and typing it in. There is no server-side scraping, crawling, bulk collection, or access to login-walled content, and the saved copy is a one-time snapshot, not a live link.

14. Changes to this policy

If we make material changes, we'll notify you with an in-app banner and by email, with a 30-day window. The effective date at the top of this policy always reflects the most recent revision.

15. Contact

Questions about privacy? Email privacy@deeta.app.

Deeta LLC · 300 East Bay Dr PMB 17127543, Largo, FL 33770, USA.

16. Do Not Track and third-party tracking

Deeta does not track you across third-party websites or services over time, and therefore does not respond differently to "Do Not Track" (DNT) browser signals — there is no cross-site behavioral tracking to turn off. No third party collects personally identifiable information about your activities across different websites through Deeta. Our in-app analytics (TelemetryDeck) are aggregated and not linked to your account, and are never used to profile you across other companies' apps or websites; the deeta.app website uses cookieless Cloudflare Web Analytics and sets no advertising or cross-site tracking cookies.