Privacy Policy

1. The short version

2. No-account, no-server architecture

DRFT does not maintain user accounts or a server-side database of your personal data. There is no sign-up, no password, and no DRFT profile. Your data lives in 2 places only: on your device (SwiftData, local), and for DRFT+ owners, in your own private iCloud database (Apple CloudKit — encrypted at rest by Apple, scoped exclusively to your Apple Account).

We operate no server that receives your data. The current version of the app contains no HTTP client at all: it communicates with Apple's iCloud and App Store services, and it opens external links (the feedback form, these legal pages, the App Store review page) in your browser when you tap them. Notifications are delivered entirely on-device; see section 7.

3. Audio capture & microphone access

DRFT captures audio differently on each platform:

• iPhone — DRFT uses the device microphone to capture ambient audio. Designed for speakerphone calls, in-person meetings, and other situations where audio is audible in the room. You must explicitly start each listening session; the microphone is only active while a session is running. DRFT does not tap into phone call audio directly — it listens to what is audible around the device.
• Mac — DRFT uses Core Audio process taps to capture the audio output of other applications on your system (Zoom, Teams, Google Meet, etc.). This is system-level audio routing — not a microphone tap and not ScreenCaptureKit, and no screen content is ever accessed. The Mac app does not hold a microphone entitlement. You grant the System Audio Recording permission once through macOS System Settings.

On both platforms, audio is processed in real time by Apple's on-device SpeechAnalyzer framework and is immediately discarded. Audio is never recorded to disk, never uploaded to any server, and never retained after processing.

4. Wake word detection

Wake word detection runs entirely on your device. Audio is transcribed locally into text using Apple's on-device speech recognition (SpeechAnalyzer + SpeechTranscriber), then matched against your configured wake words. No audio or transcript data leaves your device during this process. The speech-to-text stream is processed in real time and discarded — DRFT does not maintain a recording or a persistent running transcript. Only the short transcript window around a detection is saved, as described in section 6.

5. AI summaries

When a wake word fires, DRFT can generate a short AI summary of what was said around it. Summaries are generated on your device by Apple's Foundation Models framework (Apple Intelligence). Key details:

• Nothing is transmitted. The transcript window never leaves your device. There is no summary server, no proxy, and no AI vendor in the path.
• The window the model sees is capped at 256 words of transcript around the detection.
• Summaries are a DRFT+ feature and require an Apple Intelligence–capable device with Apple Intelligence turned on. Where that is not the case, DRFT explains why the summary is unavailable rather than sending the text elsewhere.
• If the on-device model declines to answer or the summary cannot be generated, DRFT simply shows no summary. The detection, its timestamp, and its transcript window are still saved.

Legacy App Store builds (before 2.0). Older DRFT builds generated summaries through a Cloudflare Workers proxy that forwarded transcript text to OpenAI. That path was removed from the app in 2.0, and the proxy was shut down on 2026-09-06: it no longer exists, so no DRFT build of any version can send transcript text anywhere. Copies of those older builds still installed on a device no longer receive summaries; updating to the current version restores them on-device. While that proxy ran, a summary request sent a ≤256-word transcript window, the wake word that fired, the app version, a platform tag, and an opaque iCloud user record ID hashed into a temporary rate-limit key; nothing was stored, and raw audio was never sent.

6. Data stored on your device

DRFT stores the following data locally on your device using SwiftData:

• Saved moments — The wake word that fired, the timestamp, the transcript window around it, the AI summary and its one-line short form (if one was generated), a read flag, how the audio was captured (microphone on iPhone; on Mac, the name of the app that was being captured, such as "Zoom"), and a detection identifier that lets your own devices recognize the same catch.
• Wake words & profiles — Your wake words and wake-word profiles, with each word's on/off state and catch progress (the level shown next to it). Wake words are one unified pool with no default/custom split; the cap is 3 on Free and there is no cap on DRFT+, and profiles (DRFT+, unlimited) each hold their own set.
• Speech-model customization — To spell your wake words correctly, DRFT builds a small custom vocabulary for Apple's on-device speech recognizer from your active wake words. Its training file lists those words in plain text, is stored only inside the app's container on your device, is rebuilt when your words change, and is removed by RESET ALL DATA. It is never synced or uploaded.
• App settings — Preferences such as haptics and your last known permission state.

This data stays on your device unless you have DRFT+ and iCloud sync is active (see section 8). Saved moments are capped at 10 on Free, where the oldest roll off as new ones arrive; DRFT+ keeps every saved moment until you delete it.

iCloud Key-Value Storage. DRFT also stores your first and last name (entered during onboarding) in Apple's iCloud Key-Value Storage, under the keys drft.firstName and drft.lastName. Your name seeds your first wake words during onboarding and keeps them consistent across your own devices. This data persists across app deletion per Apple's NSUbiquitousKeyValueStore semantics; to clear it, use Settings → RESET ALL DATA inside the app before deleting the app.

6a. App Store privacy nutrition label categories

The following data types are declared in DRFT's App Store privacy manifest (PrivacyInfo.xcprivacy), mirroring what the App Store shows on the product page. All of it is first-party and used for app functionality only; none of it is used for tracking, and none of it is shared with advertisers. Each item reaches an Apple-private store that DRFT itself cannot read.

• Name — First and last name entered during onboarding; stored in iCloud Key-Value Storage on all tiers.
• Other User Content — Wake words, wake-word profiles, and saved moments; stored locally and, for DRFT+ owners, synced to your private CloudKit zone.
• Purchase History — DRFT+ entitlement state managed by Apple StoreKit; DRFT reads entitlement state only, never payment instrument details.

Nothing else is declared, because nothing else leaves your device. Detection counts and session activity stay in local storage for display inside the app. Two declarations were removed when their reasons went away: the advertising and device-ID-for-ads entries when ads were taken out, and User ID in 2.0, when the cloud summary path (and with it the opaque iCloud user record ID used for rate limiting) was removed from the app.

7. Notifications

DRFT notifications are on-device local notifications (Apple's UNUserNotificationCenter). They are scheduled on the same device that detected the wake word — there is no Apple Push Notification service (APNs) round-trip and no server relay. They are marked time-sensitive so they can surface during Focus. If you decline or revoke notification permission, no notification is shown; DRFT still saves the detection and surfaces it in the app.

What a notification contains. A detection notification carries only a title of the form “<KEYWORD> Detected”, the fixed body “Open DRFT to view summary.”, and opaque identifiers (the keyword and a detection ID) under userInfo["drft"]. Transcripts and AI summaries are never placed in a notification. When you open a detection notification, the app loads the moment (including any summary) from local app storage, or from your private CloudKit container when DRFT+ sync is active.

No device tokens, no push relay. Because notifications are local, DRFT does not register for remote push, never transmits an APNs device token to any server, and does not relay detections between your Mac and iPhone. A detection on your Mac notifies your Mac; a detection on your iPhone notifies your iPhone. Your wake words and saved moments still sync across devices through iCloud (DRFT+, see section 8).

8. iCloud sync (DRFT+)

For DRFT+ owners, DRFT mirrors saved moments, wake words, and wake-word profiles across your devices using Apple CloudKit. The synced fields for a moment are its identifier, timestamp, wake word, transcript window, AI summary and short summary, read flag, audio-source information, how it was detected, and the shared detection identifier used to merge the same catch across your devices; a wake word syncs its text, on/off state, creation date, and progress-reset date; a profile syncs its name, its words, whether it is active, and its creation and update dates. This data is stored in a custom private CloudKit zone (DRFTUserDataV1) inside your personal iCloud account, in container iCloud.BryanCabrera.DRFT — DRFT cannot access it. Apple's iCloud privacy practices and encryption-at-rest apply. DRFT has not enabled Apple's End-to-End Encryption option on this zone, so standard iCloud-at-rest encryption (Apple-key-managed) applies.

Sync follows your entitlement and your iCloud account: it is active when you own DRFT+ and your device is signed into iCloud, and inactive otherwise. There is no separate in-app on/off switch. To stop it, turn DRFT off under iCloud in your system settings, or sign out of iCloud. No audio data is ever synced. The RESET ALL DATA action in Settings also deletes the DRFT+ CloudKit zone when sync is active.

9. Feedback submissions

When you tap Feedback in Settings, DRFT opens a web feedback form hosted by Tally (tally.so) in your browser. What you submit goes to Tally and is governed by Tally's privacy policy; DRFT does not pre-fill your name or any personal data into the form — only what you choose to type is included. We review submissions to respond to you and improve DRFT. For privacy or legal questions, you can also email us directly (see Contact below).

10. Analytics

Website. Our website (bryancabrera.xyz) uses no analytics, no cookies, and no third-party trackers.

App. DRFT does not use third-party product analytics SDKs. There is no Firebase, Mixpanel, Amplitude, Segment, PostHog, or equivalent in the iPhone or Mac app. Usage data such as detection counts and session activity is stored locally on your device for display inside the app and is not transmitted to any server.

11. Advertising

DRFT contains no advertising. There are no ads on any platform or tier — iPhone or Mac, free or DRFT+. DRFT does not integrate Google Mobile Ads (AdMob), the Google User Messaging Platform (UMP) consent SDK, or App Tracking Transparency, and it collects no advertising identifiers (such as IDFA), ad-interaction events, or IP-derived location for advertising purposes. There is no rewarded-ad or ad-supported unlock path for any feature.

An earlier version of the iPhone free tier showed ads served by Google Mobile Ads; advertising has since been removed from the app entirely.

12. Third-party services

• Apple CloudKit (DRFT+ sync) — Saved moments, wake words, and profiles synced to your private CloudKit zone (DRFTUserDataV1) in container iCloud.BryanCabrera.DRFT. DRFT cannot access this data.
• Apple iCloud Key-Value Storage — First and last name (all tiers). Syncs across your own devices. Persists across app deletion.
• Apple StoreKit — DRFT+ purchase and entitlement state, managed entirely by Apple. DRFT never sees your payment instrument.
• Vercel — Website hosting (bryancabrera.xyz). No analytics, no cookies.
• Tally — Web feedback form (tally.so) opened from Settings → Feedback. Submissions governed by Tally's privacy policy.
• Cloudflare Workers and OpenAI (retired) — Used by the cloud summary path in App Store builds older than 2.0, as described in section 5, until that proxy was shut down on 2026-09-06. No DRFT build contacts either today. Transcript text sent by those older builds while it ran was governed by OpenAI's API data usage policies; OpenAI states that API inputs and outputs are not used to train its models by default.

We do not sell, rent, or share your personal data with any third party for their own marketing purposes.

13. Children's privacy

DRFT is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us at nohbodie@icloud.com and we will delete it promptly.

Age verification. DRFT does not use Apple's Declared Age Range API or any other age-assurance mechanism: no age range is requested, stored, or transmitted, and the corresponding Apple Developer entitlement is not enabled. If that changes, this policy will be updated first.

14. Your rights

Because virtually all DRFT data lives on your device, you have direct control. Deleting the app removes all local data. You can also use Settings → RESET ALL DATA to wipe everything (saved moments, wake words, profiles, preferences, the CloudKit zone if sync is active, and the name stored in iCloud Key-Value Storage) in 1 action. The 1 item not deleted is your DRFT+ purchase, which Apple owns and which the app tells you is unaffected.

GDPR (EEA, UK, Switzerland). If you are in the EEA, UK, or Switzerland, you have the following rights regarding any personal data DRFT processes:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data.
• Restriction — request that we restrict processing in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time.
• Lodge a complaint — with your national supervisory authority.

Lawful basis per data category: We hold no copy of your data, so in practice these rights are exercised on your own device. Name in iCloud Key-Value Storage — contract performance (seeding your first wake words and keeping them consistent across your devices). Saved moments, wake words, and profiles — contract performance, processed on your device and in your own iCloud account. For App Store builds older than 2.0 only: transcript text forwarded for a cloud summary and the opaque iCloud user record ID sent with it — legitimate interest (providing the feature you requested, and rate-limiting the service), avoidable by updating the app.

We will respond to rights requests within 30 days. To submit a request, email nohbodie@icloud.com.

CCPA / CPRA (California residents). We do not sell or share personal information. DRFT serves no ads and uses no advertising identifiers or cross-context behavioral advertising. California residents have the right to know what personal information is collected, to delete it, to correct it, to limit use of sensitive PI, and to non-discrimination for exercising these rights. Categories of PI involved: name (iCloud Key-Value Storage, if provided during onboarding); and, for App Store builds older than 2.0 only, identifiers (the opaque iCloud user record ID sent with cloud summary requests for rate limiting).

15. Data retention

Audio is ephemeral — processed in real time and discarded immediately. No audio is ever written to disk or transmitted. Saved moments (detection metadata, transcript window, and summary text) persist on your device until you delete them or they roll off the tier cap. Use Settings → RESET ALL DATA to erase everything at once.

We retain no personal data, because we operate no server that receives any. Feedback you submit through the Tally form is retained by Tally and reviewed by us only as long as needed to respond and improve DRFT. The legacy summary Worker, used only by App Store builds older than 2.0 and shut down on 2026-09-06, did not log or store transcript text or summary content, and the identifier sent with such a request was hashed into a temporary rate-limit key that was not persisted.

16. Security

On-device data is protected by iOS/macOS system encryption and your device passcode. Speech recognition and summarization run locally in sandboxed system frameworks — audio never leaves the device. Any network communication (iCloud, the App Store, and links you open) uses HTTPS/TLS.

17. Changes to this policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. Material changes will be communicated through the App or this page at least 30 days before taking effect.

18. Contact

Questions, concerns, or rights requests? Reach out at nohbodie@icloud.com. We respond within 30 days.

See also: Terms of Service.