Privacy Policy

1. The short version

2. No-account, no-server architecture

DRFT does not maintain user accounts or a server-side database of your personal data. There is no sign-up, no password, and no DRFT profile. Your data lives in 2 places only: on your device (SwiftData, local), and for DRFT+ owners, in your own private iCloud database (Apple CloudKit — encrypted at rest by Apple, scoped exclusively to your Apple Account).

We operate no server that receives your data. The current version of the app contains no HTTP client at all: it communicates with Apple's iCloud and App Store services, and it opens external links (the feedback form, these legal pages, the App Store review page) in your browser when you tap them. Notifications are delivered entirely on-device; see section 7.

3. Audio capture & microphone access

DRFT captures audio differently on each platform:

• iPhone — DRFT uses the device microphone to capture ambient audio. Designed for speakerphone calls, in-person meetings, and other situations where audio is audible in the room. You must explicitly start each listening session; the microphone is only active while a session is running. DRFT does not tap into phone call audio directly — it listens to what is audible around the device.
• Mac — DRFT uses Core Audio process taps to capture the audio output of other applications on your system (Zoom, Teams, Google Meet, etc.). This is system-level audio routing — not a microphone tap and not ScreenCaptureKit, and no screen content is ever accessed. The Mac app does not hold a microphone entitlement. You grant the System Audio Recording permission once through macOS System Settings.

On both platforms, audio is processed in real time by Apple's on-device SpeechAnalyzer framework and is immediately discarded. Audio is never recorded to disk, never uploaded to any server, and never retained after processing.

4. Wake word detection

Wake word detection runs entirely on your device. Audio is transcribed locally into text using Apple's on-device speech recognition (SpeechAnalyzer, with its DictationTranscriber or SpeechTranscriber module), then matched against your configured wake words. No audio or transcript data leaves your device during this process. The speech-to-text stream is processed in real time and discarded — DRFT does not maintain a recording or a persistent running transcript. Only the short transcript window around a detection is saved, as described in section 6.

5. AI summaries

When a wake word fires, DRFT can generate a short AI summary of what was said around it. Summaries are generated on your device by Apple's Foundation Models framework (Apple Intelligence). Key details:

• Nothing is transmitted to summarize. There is no summary server, no proxy, and no AI vendor in the path. The transcript window leaves your device only as part of a DRFT+ moment synced to your own private iCloud database (see section 8).
• DRFT summarizes a short window of speech around the detection. The detection pipeline and saved moment keep at most 256 words; summary preparation identifies the wake word in that context and can shorten the input to fit the on-device model.
• Summaries are a DRFT+ feature and require an Apple Intelligence–capable device with Apple Intelligence turned on. Where that is not the case, DRFT explains why the summary is unavailable rather than sending the text elsewhere.
• If the on-device model declines to answer or the summary cannot be generated, DRFT shows the summary as unavailable, with a Try Again button that asks the on-device model again. The detection, its timestamp, and its transcript window are still saved.
• Tapping STOP ends listening, not summaries already under way: a moment caught before you stopped is still summarized, on your device, from the text already captured.

Legacy App Store builds (before 2.0). Older DRFT builds generated summaries through a Cloudflare Workers proxy that forwarded transcript text to OpenAI. That path was removed from the app in 2.0, and the proxy was shut down on 2026-09-06: it no longer receives transcript text. Copies of those older builds still installed on a device no longer receive summaries; updating to the current version restores them on-device. While that proxy ran, a summary request sent a ≤256-word transcript window, the wake word that fired, the app version, a platform tag, and an opaque iCloud user record ID hashed into a temporary rate-limit key; nothing was stored, and raw audio was never sent.

6. Data stored on your device

DRFT stores the following data locally on your device using SwiftData:

• Saved moments — The wake word that fired, the timestamp, the transcript window around it, the AI summary and its one-line short form (if one was generated), a read flag, how the audio was captured (microphone on iPhone; on Mac, the name of the app that was being captured, such as "Zoom"), and a detection identifier that lets your own devices recognize the same catch.
• Wake words & profiles — Your wake words and wake-word profiles, with each word's on/off state and catch progress (the level shown next to it). Wake words are one unified pool with no default/custom split; the cap is 3 on Free and there is no cap on DRFT+, and profiles (DRFT+, unlimited) each hold their own set.
• Word progress — A catch count for each word spelling and each installation, associated with a random installation identifier. These counts determine word levels. Deleting moments or a word does not erase its progress; RESET ALL DATA clears it.
• Speech-model customization — To spell your wake words correctly, DRFT builds a small custom vocabulary for Apple's on-device speech recognizer from your active wake words. Its training file lists those words in plain text, is stored only inside the app's container on your device, is rebuilt when your words change, and is removed by RESET ALL DATA. It is never synced or uploaded.
• App settings — Preferences such as haptics and your last known permission state.

This data stays on your device unless you have DRFT+ and iCloud sync is active (see section 8). Saved moments are capped at 10 on Free, where the oldest roll off as new ones arrive; DRFT+ keeps every saved moment until you delete it.

Sharing a moment. Share on a moment's page uses the system share sheet to hand the app you choose a one-line description of the catch (the wake word, the app or device it came from, and the time) and the moment's summary. The transcript window is not included. Nothing is shared unless you tap Share, and what the receiving app does with it is governed by that app's own policy.

iCloud Key-Value Storage. From version 2.1.0, DRFT keeps no copy of the first and last name you enter during onboarding: it uses the name on your device to seed your first wake words (when you have none yet), which are then stored like any other wake word. Versions before 2.1.0 also stored the name in Apple's iCloud Key-Value Storage, under the keys drft.firstName and drft.lastName, where it synced across your own devices and persisted across app deletion per Apple's NSUbiquitousKeyValueStore semantics. DRFT 2.1.0 and later erase that copy every time the app launches, and Settings → RESET ALL DATA erases it too.

6a. The App Store privacy label

DRFT's App Store privacy label says Data Not Collected. Under Apple's definition, collection involves sending data off your device in a way that gives the developer or its third-party partners access beyond servicing a request. Data processed only on your device is not collected, and Apple says developers are not responsible for declaring data Apple collects through its own frameworks and services.

This label does not mean your data is never stored or synced. DRFT stores your moments and words locally; with DRFT+, they and your per-installation word catch counts sync to your private iCloud database, which we cannot access. Apple handles purchases, and DRFT checks entitlement on your device. None of this is sent to a DRFT server or a third-party analytics service. See section 8 for sync details and section 9 for support information you choose to submit outside the app.

7. Notifications

Detection notifications are on-device local notifications (Apple's UNUserNotificationCenter). They are scheduled on the same device that detected the wake word, with no server relay. They are time-sensitive so they can surface during Focus; while an iPhone Live Activity alerts you to the same catch, its notification is passive and silent. DRFT asks for notification permission when you first start listening or use the Notifications row in Settings, never during onboarding. If you decline or revoke notification permission, no notification is shown; DRFT still saves the detection and surfaces it in the app.

What a notification contains. A detection notification carries only a title of the form “<KEYWORD> Detected”, the fixed body “Saved to History.”, and an opaque detection ID under userInfo["drft"]. Transcripts and AI summaries are never placed in a notification. When you open a detection notification, the app loads the moment (including any summary) from local app storage, or from your private CloudKit container when DRFT+ sync is active.

CloudKit change notices. Apple uses silent push notifications to keep DRFT+ iCloud sync up to date. These are separate from detection alerts: DRFT has no push server, sends no device token to us, and does not relay detection notifications between your Mac and iPhone. A catch on your Mac alerts your Mac; a catch on your iPhone alerts your iPhone. Synced data is described in section 8.

8. iCloud sync (DRFT+)

For DRFT+ owners, DRFT mirrors saved moments, wake words, wake-word profiles, and word progress across your devices using Apple CloudKit. A moment syncs its identifier, timestamp, wake word, transcript window, AI summary and short summary, read flag, audio-source information, detection method, and shared detection identifier. A wake word syncs its text, on/off state, creation date, and legacy progress-reset date; a profile syncs its name, word entries, active state, and creation and update dates.

Word progress sync. Each installation uploads its own catch count for each normalized word spelling, together with a random installation identifier. Your devices combine these counts to show the word's level. These records remain when you delete individual moments or words; RESET ALL DATA clears them. They are used only for your word progress, never for advertising or developer analytics.

This data is stored in a custom private CloudKit zone (DRFTUserDataV1) inside your personal iCloud account, in container iCloud.BryanCabrera.DRFT. We cannot access this database. Apple's iCloud privacy practices and encryption-at-rest apply. DRFT has not enabled Apple's End-to-End Encryption option on this zone, so standard iCloud-at-rest encryption (Apple-key-managed) applies.

Sync follows your entitlement and your iCloud account: it is active when you own DRFT+ and your device is signed into iCloud, and inactive otherwise. There is no separate in-app on/off switch. To stop it, turn DRFT off under iCloud in your system settings, or sign out of iCloud. No audio data is ever synced. The RESET ALL DATA action in Settings also deletes the DRFT+ CloudKit zone when sync is active.

Deleting the iCloud copy. From version 2.1.0, when that zone is deleted — by RESET ALL DATA on any of your devices, or because you delete DRFT's data from iCloud in your system settings — each of your devices signed in to the same iCloud account that has DRFT 2.1.0 or later and DRFT+ sync active erases its own copy too once it receives that deletion: its saved moments, wake words, profiles, and word catch counts, its speech-model training file, and any copy of its database that DRFT had set aside because it could not be opened. Its settings and your DRFT+ purchase are kept, and so are moments, words, and profiles created on it after the deletion arrived, which then sync again. All word catch counts are cleared. An iCloud encryption reset instead keeps and re-uploads the local data. A device still on an earlier version keeps its copy and uploads it to iCloud again, from where it can sync back to your other devices, so update DRFT on every device before you reset. A device that does not receive the deletion keeps its copy; this is not a guaranteed remote wipe.

Local sync cache. So that your edits reach iCloud as updates rather than new copies, DRFT keeps a small cache on each syncing device of every synced record's CloudKit system fields (such as its record ID and change tag), never the record's field values such as the transcript window or summary. Versions before 2.1.0 cached whole records, transcript window and summary included (version 1.0.5 kept them in the app's preferences); DRFT 2.1.0 and later convert any such copy to system fields only and then delete it, starting at the first launch after the update, whether or not you still have DRFT+. RESET ALL DATA deletes the cache entirely.

9. Feedback submissions

When you tap Feedback in Settings (or on a moment's page), DRFT opens a web feedback form hosted by Tally (tally.so) in your browser. What you submit goes to Tally and is governed by Tally's privacy policy; DRFT does not pre-fill your name or any personal data into the form — only what you choose to type is included. We review submissions to respond to you and improve DRFT. For privacy or legal questions, you can also email us directly (see Contact below).

10. Analytics

Website. Our website (bryancabrera.xyz) uses no analytics, no cookies, and no third-party trackers.

App. DRFT does not use third-party product analytics SDKs. There is no Firebase, Mixpanel, Amplitude, Segment, PostHog, or equivalent in the iPhone or Mac app. We receive no detection counts or session activity. Word catch counts stay local on Free and sync only to your private iCloud database with DRFT+, as described in section 8.

11. Advertising

DRFT contains no advertising. There are no ads on any platform or tier — iPhone or Mac, free or DRFT+. DRFT does not integrate Google Mobile Ads (AdMob), the Google User Messaging Platform (UMP) consent SDK, or App Tracking Transparency, and it collects no advertising identifiers (such as IDFA), ad-interaction events, or IP-derived location for advertising purposes. There is no rewarded-ad or ad-supported unlock path for any feature.

An earlier version of the iPhone free tier showed ads served by Google Mobile Ads; advertising has since been removed from the app entirely.

12. Third-party services

• Apple CloudKit (DRFT+ sync) — Saved moments, wake words, profiles, and per-installation word catch counts synced to your private CloudKit zone (DRFTUserDataV1) in container iCloud.BryanCabrera.DRFT. We cannot access this database.
• Apple iCloud Key-Value Storage (versions before 2.1.0) — First and last name (all tiers), synced across your own devices and persisting across app deletion. DRFT 2.1.0 and later store nothing here and erase that copy at launch.
• Apple StoreKit — DRFT+ purchase and entitlement state, managed entirely by Apple. DRFT never sees your payment instrument.
• Vercel — Website hosting (bryancabrera.xyz). No analytics, no cookies.
• Tally — Web feedback form (tally.so) opened from Settings → Feedback. Submissions governed by Tally's privacy policy.
• Cloudflare Workers and OpenAI (retired) — Used by the cloud summary path in App Store builds older than 2.0, as described in section 5, until that proxy was shut down on 2026-09-06. No DRFT build contacts either today. Transcript text sent by those older builds while it ran was governed by OpenAI's API data usage policies; OpenAI states that API inputs and outputs are not used to train its models by default.

We do not sell, rent, or share your personal data with any third party for their own marketing purposes.

13. Children's privacy

DRFT is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us at nohbodie@icloud.com and we will delete it promptly.

Age verification. DRFT does not use Apple's Declared Age Range API or any other age-assurance mechanism: no age range is requested, stored, or transmitted, and the corresponding Apple Developer entitlement is not enabled. If that changes, this policy will be updated first.

14. Your rights

Because virtually all DRFT data lives on your device, you have direct control. Deleting the app removes all local data. You can also use Settings → RESET ALL DATA to wipe everything (saved moments, wake words, profiles, word catch counts, preferences, the CloudKit zone if sync is active, and any copy of your name an earlier version left in iCloud Key-Value Storage) in 1 action; from version 2.1.0, deleting the CloudKit zone also erases the synced copies on your other devices running DRFT 2.1.0 or later that receive the deletion (see section 8). The 1 item not deleted is your DRFT+ purchase, which Apple owns and which the app tells you is unaffected.

GDPR (EEA, UK, Switzerland). If you are in the EEA, UK, or Switzerland, you have the following rights regarding any personal data DRFT processes:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data.
• Restriction — request that we restrict processing in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time.
• Lodge a complaint — with your national supervisory authority.

Lawful basis per data category: We hold no copy of your data, so in practice these rights are exercised on your own device. Name entered during onboarding — contract performance (seeding your first wake words on your device; versions before 2.1.0 also kept it in iCloud Key-Value Storage to keep them consistent across your devices). Saved moments, wake words, profiles, and word catch counts — contract performance, processed on your device and in your own iCloud account. For App Store builds older than 2.0 only: transcript text forwarded for a cloud summary and the opaque iCloud user record ID sent with it — legitimate interest (providing the feature you requested, and rate-limiting the service), avoidable by updating the app.

We will respond to rights requests within 30 days. To submit a request, email nohbodie@icloud.com.

CCPA / CPRA (California residents). We do not sell or share personal information. DRFT serves no ads and uses no advertising identifiers or cross-context behavioral advertising. California residents have the right to know what personal information is collected, to delete it, to correct it, to limit use of sensitive PI, and to non-discrimination for exercising these rights. Categories of PI involved: name (entered during onboarding and used on your device; kept in iCloud Key-Value Storage only by versions before 2.1.0); saved content and per-installation word catch counts stored on your device and, with DRFT+, in your private iCloud database; purchase entitlement state; and, for App Store builds older than 2.0 only, identifiers (the opaque iCloud user record ID sent with cloud summary requests for rate limiting).

15. Data retention

Audio is ephemeral — processed in real time and discarded immediately. No audio is ever written to disk or transmitted. Saved moments (detection metadata, transcript window, and summary text) persist on your device until you delete them or they roll off the tier cap. Word catch counts remain when you delete moments or words, so levels keep their progress. Use Settings → RESET ALL DATA to clear the counts along with your other app data and, when sync is active, the private iCloud copy.

We retain no personal data, because we operate no server that receives any. Feedback you submit through the Tally form is retained by Tally and reviewed by us only as long as needed to respond and improve DRFT. The legacy summary Worker, used only by App Store builds older than 2.0 and shut down on 2026-09-06, did not log or store transcript text or summary content, and the identifier sent with such a request was hashed into a temporary rate-limit key that was not persisted.

16. Security

On-device data is protected by iOS/macOS system encryption and your device passcode. Speech recognition and summarization run locally in sandboxed system frameworks — audio never leaves the device. Any network communication (iCloud, the App Store, and links you open) uses HTTPS/TLS.

17. Changes to this policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. Material changes will be communicated through the App or this page at least 30 days before taking effect.

18. Contact

Questions, concerns, or rights requests? Reach out at nohbodie@icloud.com. We respond within 30 days.

See also: Terms of Service.