TrueDraftPrivacy Policy
This policy explains how TrueDraft handles information across the website, iOS app, custom keyboard, share extension, and API. TrueDraft is the controller of account and product data. Privacy requests may be sent to privacy@truedraft.me.
1. Information we collect
- Account and identity: Apple or Supabase user ID, email address (including Apple relay addresses), optional display name, account dates, authentication and consent records, and marketing preference.
- Content you choose: screenshots, extracted conversation text, rewrite text, instructions, generated drafts, feedback, and optional names, relationship notes, communication preferences, and memories.
- Subscription and entitlement: plan, status, usage allowance, expiration, and Apple transaction verification data when paid subscriptions are enabled. TrueDraft does not receive full payment-card numbers from Apple.
- Technical and security: IP address in transient server and hosting logs, request time, endpoint, response status, device and network metadata supplied in HTTPS requests, authentication failures, abuse signals, model name, prompt version, and token counts.
- Support and legal requests: messages, attachments, contact details, verification information, and records of access, deletion, export, opt-out, copyright, or complaint handling.
- Website storage: acknowledgement of the cookie notice in local storage. The site currently uses no analytics, advertising, tracking, or session-replay tools.
2. How we use information
We use information to authenticate accounts; provide, personalize, and secure the Service; generate requested analyses and drafts; sync saved context; administer limits and subscriptions; respond to support and rights requests; prevent fraud and abuse; comply with law; and send marketing only when separately selected. We do not use sensitive message content for targeted advertising.
3. Screenshots, keyboard, and share extension
- Screenshot image bytes are processed in memory and are not saved as original image files in the TrueDraft database. Extracted text and generated results are saved to the signed-in account until deletion.
- The keyboard does not log ordinary typing. Full Access is requested only for network access to TrueDraft’s API and communication with the main app through the private App Group.
- Generated replies and the authentication credential are stored in the App Group/Keychain so the app and extensions can work together. iOS may retain local data under its normal backup and device-management behavior.
4. Service providers and disclosures
| Recipient | Data sent | Purpose |
|---|---|---|
| Apple | Apple ID authorization, app/subscription events, diagnostics governed by device settings | Sign-in, App Store distribution, and purchases |
| Supabase | Email, auth tokens and identifiers; account/product records in hosted PostgreSQL | Authentication and database hosting |
| Render | HTTPS requests, IP/log metadata, uploaded content in transit, API responses | API hosting and operations |
| OpenRouter and the selected model provider | Screenshot content or rewrite text, instructions, and relevant saved context; no TrueDraft account email | Generate the requested analysis or draft |
We may also disclose limited information to professional advisers, authorities, or transaction counterparties when legally required or reasonably necessary to protect rights, safety, and the Service. TrueDraft does not currently use Stripe, analytics vendors, ad networks, data brokers, or session replay. A vendor will not be added until the policy and processor register are updated and required agreements are in place.
5. Legal bases and international transfers
Where GDPR applies, processing is based on performance of the service contract, legitimate interests in security and reliable operation, consent for optional marketing, and legal obligations. Providers may process information in the United States and other countries. Appropriate contractual and supplementary safeguards must be confirmed in the vendor register before EEA/UK launch.
6. Retention
Account content is retained while the account is active and erased from the active database when the user deletes the account. Raw screenshot files are not retained in the database. Security and hosting logs should be configured for the shortest operational period and no longer than 30 days unless an incident or law requires longer. Support, consent, financial, and legal records may be kept as required to establish compliance. Provider backup deletion follows the provider’s documented cycle.
7. Your rights and choices
You can correct profile data, export a machine-readable JSON copy, and permanently delete the account in the app. You may withdraw marketing consent at any time. Depending on location, you may also request access, correction, deletion, portability, restriction, objection, or appeal and complain to a regulator. See Your Privacy Choices.
TrueDraft does not sell personal information or share it for cross-context behavioral advertising. A Do Not Sell or Share preference is available in the app and by email. We honor legally recognized opt-out preference signals on web surfaces if sale or sharing is introduced; it is not currently introduced.
8. Children
TrueDraft is not directed to children under 13 and signup requires an age attestation. We do not knowingly collect personal information from a child under 13. A parent or guardian who believes a child submitted data should contact us for deletion. Regional minimum ages may be higher; the App Store age rating and launch territories must be reviewed before release.
9. Security and incidents
TrueDraft uses HTTPS in transit, provider-managed encryption at rest, server-only model credentials, Keychain protection for app credentials, scoped account access, audit logs for staff content access, and rate limiting. No system is perfectly secure. We maintain an incident-response process that includes assessment and, where required, regulator notice within 72 hours of awareness and notice to affected people.
10. Contact and changes
Contact privacy@truedraft.me. Material changes will be dated and presented for renewed acceptance when required.