Who is accountable for your data
Drip is published and operated by Zhuo Wang as an individual developer, who is the party accountable for the processing described here. For any question about this policy or your data, write to 359867620@qq.com.
Original audio never leaves your device
Recordings stay in the app's own container on your device. Drip's servers have no interface capable of receiving audio: a cloud AI request has exactly six fields (record ID, content revision, consent version, organizer version, locale, and text), and none of them can carry bytes or a file reference. An automated test fails the build if that shape ever changes.
This is a structural fact rather than a promise — even a coding mistake has no channel through which audio could leave the device.
Only transcript text leaves, and only after you agree
When you turn on third-party AI organizing, the transcript text of the single thought being organized is sent to Drip's AI gateway, which forwards it to the model processor DeepSeek (api.deepseek.com). It returns tidied text, a category, and any action items. The record ID, content revision, consent version, organizer version, and locale are sent alongside it.
Never sent with that text: your Apple ID, email address, name, device identifiers, location, or any thought other than the one being organized.
The feature is off by default and requires three conditions at once: you are signed in, you have explicitly agreed to the current version of this disclosure, and your account has available credit. If any one is missing the request never happens, and the app falls back to rule-based organizing that runs entirely on your device.
DeepSeek is a provider located in mainland China, so enabling this feature means that text is transferred to mainland China for processing. If you would rather not do that, leave it off — recording, playback, transcription, history, and export are unaffected.
Drip does not durably store that text: AI operations exist only in the service process's memory, disappear when it restarts, and no database table holds them.
What is actually stored on the server
Only the identifiers, amounts, and digests that accounts and billing require. No database table holds transcript text, titles, or audio:
- A randomly generated account ID that cannot be traced back to you
- A SHA-256 digest of your Apple identity (never the identifier in plaintext) and an encrypted Apple refresh token
- App Store transaction identifiers and a receipt digest, so credits are granted exactly once and refunds can be reconciled
- An append-only credit ledger
Two unrelated deletion paths
One — local content (recordings, transcripts, organized results): deleting in the app takes effect immediately, involves no server, and works offline, because Drip's servers never held a copy. Deleting the app removes all local content. Note that iCloud sync is not enabled, so a deletion applies to that device only.
Two — your account: Settings → Delete account data. This revokes the refresh token with Apple, deletes the identity binding, and marks the account deleted. Already-issued credentials get no grace period: the next request after deletion is rejected rather than waiting for the credential to expire.
What is kept after account deletion, and why
The credit ledger and App Store transaction records are not deleted; the database itself forbids modifying or deleting ledger entries.
This is deliberate. They are the financial record of real money, tied to refund reconciliation and tax and audit obligations. Deleting them would make those obligations impossible to meet, and would let an account deleted and recreated claim already-granted credits a second time.
These records are keyed by that random account ID. When the account is deleted, the digest linking it to your Apple identity is gone and the refresh token is revoked, so what remains is a record of amounts that can no longer be connected to you. It contains no transcript text, no titles, and no audio.
Stated plainly: there is currently no automatic expiry for those financial records.
What we do not collect
Location, contacts, calendars, photos, health data, browsing or search history, advertising identifiers, and device-fingerprinting signals — no code path reads any of them. The app contains no analytics or attribution SDK and does no cross-app tracking.
We do not sell your content, track you for advertising profiles, or use your recordings or text to train general-purpose models.
Your choices
You can withdraw third-party AI consent in Settings at any time, after which no further text is sent. You can export original audio and text. Without an account, without consent, or with no credit, recording, playback, on-device transcription, history, and export all keep working — cloud AI is an enhancement, never a condition for capturing or keeping a thought.
When this disclosure changes
If the substance of this disclosure changes — a different model processor, for instance — the consent version is raised. Cloud AI resumes only after you agree again: consent given against an earlier disclosure is never reused for new processing.
Contact
For privacy questions or requests to access or delete your data, write to 359867620@qq.com, a mailbox managed by Zhuo Wang personally.