Effective 12 August 2026
Dumpli is an iPhone app that turns a brain dump into a plan for the day. It is made by an independent developer, who is the data controller for the limited processing described here. Questions, requests, or complaints go to akobirxujaalixonov@gmail.com.
Your tasks, your daily plan, your Later list, your reflections and the counters behind the “Stuck” feature are stored on the device itself. They are not uploaded, not backed up to us, and not readable by us. There is no Dumpli account, so there is nothing to log into and nothing of yours sitting on a server waiting to be breached.
If your iPhone is set to back up to iCloud, Apple's own backup may include the app's data. That copy is governed by Apple's privacy policy, not this one, and we have no access to it.
This is the one moment text leaves your device, and it only happens when you ask for it.
When you tap “Done — organize it”, the text you wrote is sent over an encrypted connection to our proxy server, which forwards it to Google's Gemini AI to be turned into a structured plan. The plan comes back the same way and is saved on your device.
Our proxy passes that text straight through and never writes it to storage. We keep no copy of your dumps, your tasks, or the plans generated from them. Google processes the request as our service provider under the Gemini API terms, which for paid API use do not permit using the content to train their models.
The proxy exists precisely so that no AI credentials ship inside the app and so abuse can be rate-limited — not so that we can see what you write.
To enforce a free tier and unlock subscriptions, the server stores a small amount of data keyed to your installation:
| What | Why | Kept for |
|---|---|---|
| Device key | An Apple App Attest public key and signature counter, proving requests come from a genuine, unmodified copy of the app | Until you delete the app |
| Usage counters | How many dumps this install organized this week and this day, to apply the free limit and a fair-use cap | 14 days / 2 days |
| Subscription state | Whether Pro is active, its expiry, the product bought and Apple's transaction id, so Pro works across your devices | 400 days |
| Attestation challenges | One-time random values that stop a captured request being replayed | 5 minutes |
Cloudflare, which runs the server, processes connection data such as IP addresses to route and protect the traffic, as described in their privacy policy. We do not build profiles from it.
The identifier above is a device key created by iOS for this app alone. It is not your Apple ID, not your phone number, and not an advertising identifier; it cannot be used to recognise you on any other service, and it tells us nothing about who you are. Delete and reinstall the app and a brand-new key is generated, unlinked to the old one.
If you connect it, Dumpli reads the events on your current day so it can see how many hours are actually free and plan only what fits between them. Access is read-only: Dumpli never creates, edits, moves or deletes anything in your calendar, and never reads past or future days.
What your meetings are called stays on the device. When the AI composes your morning it is told the free windows and the busy hours as bare times — no event titles, no attendees, no locations. Nothing from your calendar is stored on any server, and turning the connection off in Settings stops the reading immediately.
Dictation is handled by Apple's speech recognition, on the device wherever iOS supports it. Dumpli never records, stores, or uploads audio. The transcribed text is treated exactly like text you typed — it stays on the device until you choose to organize it.
Every reminder Dumpli shows is a local notification scheduled by your own iPhone. Nothing about your reminders passes through a server, and we cannot send you a push message.
Dumpli counts a handful of anonymous milestones — that a plan was created, that a task was completed — to understand which parts of the app work. These are bare counts: never the content of your thoughts, never a task title, never an identifier.
As of the effective date above, these counts never leave your device: they are written to the iPhone's own system log and nothing more. If that ever changes, this policy will be updated before the change ships.
Dumpli Pro is sold through Apple's In-App Purchase. Apple handles the payment; we never see your card details, billing address, or Apple ID. What reaches our server is the cryptographically signed receipt Apple issues, from which we read the product, the expiry date and the transaction id recorded in the table above.
Because everything personal stays on your iPhone, you are already in control of it: deleting the app deletes your tasks, plans, and history, irreversibly and immediately.
For the small server-side records, you may ask us to confirm what is held, correct it, or erase it — write to akobirxujaalixonov@gmail.com and we will respond within 30 days. If you are in the EU or UK, the GDPR gives you these rights along with the right to complain to your local data protection authority; our legal basis is performing the contract you entered when you chose to use the app, and our legitimate interest in preventing abuse of a paid AI service. If you are in California, the CCPA gives you comparable rights — and note we have no personal information to sell.
Data is processed on Cloudflare's global network and by Google's Gemini API, which may mean processing outside your country under those providers' standard safeguards.
Dumpli is not directed at children under 13, and we do not knowingly collect anything from them. There is nothing to collect: the app asks for no personal details at all.
If this policy changes, the effective date at the top changes with it, and any change that widens what we collect will be published here before the app that makes it is released.
Questions about your privacy, or a request about your data:
akobirxujaalixonov@gmail.com