Privacy policy

Effective October 15, 2026

If someone comes to us with a subpoena, what we can hand over is limited to what we hold, which is nothing at all unless you switched on attorney sharing, and ciphertext if you did. That is a separate question from what you yourself can be required to produce, and the two get confused constantly. Both are answered in Legal process, subpoenas and discovery.

Who we are

Documented ("we", "us") makes Documented: At Work for iPhone and Android, and operates this website. This policy explains what information the app and the website handle, and, mostly, what they deliberately don't.

Where the iPhone and Android apps differ, this policy says so. Most of it is the same on both.

The app

Your entries stay on your device

Everything you put in Documented: At Work (text, photos, video, voice notes and their text, scanned documents, message captures, the people and places you name, and the details of your entries) is stored locally on your phone. By default it stays there. We do not receive it, and there is nothing for us to read.

There is exactly one way your entries leave your device to us, and you have to turn it on yourself: sharing with your attorney. Until you connect an attorney, nothing you write is uploaded anywhere. If you never connect one, that stays true for as long as you use the app.

No account, no sign-up

The app does not require an account. We do not collect your name, email address, phone number, employer or any other identifier to use the app.

Advertising and measurement

The iPhone app uses five third-party services.

• RevenueCat records subscription events, such as a trial starting or a subscription renewing or being cancelled, so we can see how the business is doing.
• Meta receives those same subscription events, and, if you allow tracking when iOS asks you, an advertising identifier, so we can tell which ads bring people to the app.
• AppsFlyer counts installs, trials and subscriptions and records which ad brought each one, so we can compare one advertising channel against another on the same terms instead of taking each network's word for its own performance. It tells the network that delivered the ad that an install happened, and nothing more than that, except for TikTok, described next.
• TikTok is told one thing: that someone who arrived from a TikTok ad started a free trial, so it can show our ads to people more likely to find the app useful. If you allow tracking when iOS asks you, that notice carries an advertising identifier. If you decline, it carries none.
• Amplitude counts which screens get used and which steps people give up on, so we can find the parts that do not work and fix them.

On Android, only RevenueCat and Amplitude apply. The Android app carries no crash reporter, no advertising identifier and no attribution SDK, and Meta, AppsFlyer and TikTok receive nothing from it. It also carries Google's ML Kit, described under Reading text from screenshots, and, for adding a location to an entry, Google Play services location and Android's built-in geocoder, described under Location.

None of these services receives your entries, your photos, your voice notes, your locations, or the names of the people in your record. Nothing you write in the app is part of this, and nothing you write leaves your phone.

If you decline the tracking request, no advertising identifier is collected and nothing is linked to you. Meta and TikTok then receive no advertising identifier and nothing that points back to you. RevenueCat and AppsFlyer still record that an install, a trial or a subscription happened, because that is how we count them, but with no identifier attached and nothing that points back to you. You can change your mind at any time in iOS Settings, under Privacy & Security, then Tracking.

That tracking request does not govern Amplitude, in either direction. Amplitude works the same way in both apps. It receives the onboarding screens you view, the answers you pick from fixed lists, and events in the app, along with your phone's operating system version, device model, the app's version, your language, your text size and notification settings, and a random device identifier the app makes up itself. It never receives your name, your entries, anything you type, your location (no city, no coordinates), your IP address, your carrier, an advertising identifier, or, on Android, the app set ID.

What Amplitude receives is linked to your subscription events from RevenueCat, in both apps, so we can tell whether the people who find the app useful are the people who subscribe. That link is the only one: nothing here is combined with data from outside those two services, sold, shared, or used to target advertising at you. Amplitude handles it only as our service provider. Allowing or declining Apple's prompt neither switches it on nor switches it off. It is on from the start, and the app gives it its own switch in Settings, under Product analytics. Switch it off and nothing is sent.

Our App Store privacy label may say "Data Used to Track You." Apple requires that label whenever an app may share an advertising identifier with a third party, and it applies whether or not you personally allow it.

This is a statement about the app. The website is measured separately and is described below. The two share nothing.

Reading text from screenshots

The app can turn a screenshot of a message conversation, or a photo of a document, into an entry by reading the text in it. The reading happens on your phone. The image is never uploaded for this, and no server sees it.

On Android this uses Google's ML Kit. The recognition itself is offline, but the component reports technical diagnostics to Google: your device make, model and Android version, the app's package name and version, how long the operation took, and the size and format of the image. It does not send the image, the text found in it, or anything you have written.

We would switch that reporting off if we could. Google provides no way to disable it for text recognition, so the honest position is to tell you it happens rather than to imply it does not.

Voice notes

The app asks for the microphone only when you record a voice note, and for speech recognition only to turn it into text. The words are worked out on your phone. The recording and its text stay in the app.

iCloud sync (iPhone only)

If iCloud sync is available and turned on, your record syncs to your private iCloud database so it survives a lost or replaced phone. This sync happens between your device and your own Apple iCloud account, under Apple's iCloud terms and encryption. We have no access to your iCloud data. You can turn iCloud off for the app at any time in iOS Settings, and remove the app's iCloud data in Settings, then your name, then iCloud, then Manage Storage.

The Android app has no sync and no cloud backup. It also excludes itself from Android's own backup, so nothing is copied to Google Drive. Your record lives on that phone and nowhere else, which is the more private arrangement and also the more fragile one: if you lose the phone, the record goes with it unless you have attorney sharing switched on.

Trusted timestamps

When you seal an entry, the app computes a SHA-256 hash of it (a fixed-length cryptographic fingerprint) and may send only that hash to an independent RFC 3161 timestamp authority, which returns a signed proof of the time. The hash contains none of your content and cannot be reversed into it. The timestamp authority never receives your entries, media, location, or identity beyond the technical minimum any internet request involves (such as an IP address handled under that provider's own policy).

Location

Adding a location to an entry is optional. The app asks for permission the first time it is needed, and if you say no, it does not ask again. You can revoke the permission at any time in your phone's Settings, and the app works fully without it. Where something happened can always just be typed.

On Android, if you choose approximate location, the app honours it: the place is recorded as a street or an area, never a house number.

What is stored. When you allow location, each entry gets two things: the coordinates, and a street-address label made from them. Both are sealed into the entry's fingerprint along with everything else in it. That makes the location part of the seal, and it also means that once an entry is sealed, its location cannot be removed from that entry.

What leaves your phone. To turn coordinates into a street address, your phone sends them to Apple (on iPhone) or Google (on Android). Only the coordinates are sent, never the entry or anything you have written. That lookup is handled under Apple's or Google's own privacy policy. No other service in the app receives your location, and neither do we, unless you switch on attorney sharing, where it travels inside the encrypted entry that only your attorney can read.

A photo you attach may carry coordinates of its own, in the metadata your camera writes into the file. We do not read or use that metadata, but we also do not strip it. If a photo reaches your attorney through sharing, any metadata inside it goes too. Your phone's camera settings control whether that metadata is written in the first place.

Reminders

If you set reminders to write, they are scheduled on your phone as local notifications. They never include anything from your record. You can change or turn them off in the app or in your phone's Settings.

The app lock

The lock uses your phone's own authentication: Face ID or Touch ID on iPhone, fingerprint or face unlock on Android, with your device passcode as the fallback. Biometric data is managed entirely by the operating system and never reaches us or the app itself.

Exports are yours to control

When you export your record, for example as a PDF timeline, you decide where it goes. The app hands it to your phone's share sheet and keeps no copy anywhere else. We never see an export.

Sharing with your attorney

This is the one feature that sends your entries to our servers, and it is off until you switch it on.

To connect an attorney you type their email address, which we use to look them up in the attorney directory. From then on, each entry you seal is encrypted on your phone before it is sent, using a key derived from that attorney's own public key. Attachments travel the same way. What arrives on our server is ciphertext, and only your attorney holds the key that opens it.

So we do hold a copy of shared entries, and we cannot read it. Those are two separate facts and both matter: the first is why there is something for us to delete if you ask, and the second is why a breach of our servers would not expose what you wrote.

You can disconnect an attorney at any time in the app's settings. Disconnecting stops anything further being sent. It does not by itself remove what was already delivered to them.

Deleting your data

There is no account to close, because there isn't one. What deletion means depends on where the data is.

• On your phone. Deleting the app deletes the record stored on it. On Android nothing is backed up to Google Drive, so uninstalling removes it outright. On iPhone, if iCloud sync was on, remove the synced copy from your own iCloud account as described above. If your phone's own backups are on, the app's data may be in them too, under Apple's or Google's terms.
• Anything shared with an attorney. Disconnect the attorney in the app to stop anything further being sent. To have what was already uploaded deleted from our servers, write to privacy@documented.co and we will remove it. You do not have to give a reason. We will confirm when it is done.
• If you never turned on attorney sharing, we hold nothing, and there is nothing on our side to delete.
• Usage data in Amplitude is not linked to your identity. To find it we may need the app's anonymous identifier. Email us and we will help.

Children's privacy

Documented: At Work is made for adults keeping a record of their own working life. The app is not directed at children under 13, and we do not knowingly collect personal information from them.

The website

This is a marketing site. It is not the app, it never receives anything from the app, and none of what follows applies to your record.

Analytics and cookies

The website may use Google Analytics 4 so we can see which pages people find useful and which ones fail them. When it does, it is configured like this:

• Cookies are off until you accept them. Analytics loads in Google's Consent Mode with storage denied by default. Until you press Accept on the banner, no analytics cookie is written and no visitor ID is kept. We receive an anonymous, aggregate page count and nothing that follows you between visits.
• If you accept, Google Analytics sets its standard cookies (_ga and similar) so returning visits can be recognised as returning. You can change your mind by clearing this site's cookies and site data in your browser, which brings the banner back.
• If you decline, that choice is remembered locally and the banner stays gone. Analytics continues in its cookieless mode.
• No advertising signals, ever. Google's ad-related signals (ad_storage, ad_user_data, ad_personalization) are denied permanently and are never granted, even if you accept. We run no remarketing and no cross-site tracking pixels, and no advertising platform receives anything from this site. The one thing we record about advertising is the click identifier described under Landing pages, which we keep ourselves and never pass on.
• What we measure. Pages viewed, roughly where in the world the visit came from, what kind of device it was, and clicks on the App Store buttons. Analytics never receives your name, your email address, or anything you type into a field.

Quizzes and sign-up forms

Some pages may offer a short quiz, a guide or a kit by email, and ask for your email address to send it.

• What we keep. The email address you enter, the page you entered it on, and any answers you gave on that page.
• Where it goes. To a server we run, and nowhere else. It is not handed to an advertising platform, a data broker or a mailing list provider, and we do not sell it or trade it.
• What we use it for. Sending you what you asked for, understanding what people need so we can write better guidance, and writing to you about Documented. If you would rather not hear from us, tell us and we will stop.
• Leaving part way through. Your answers are not sent to us until you submit your email. Close the page before that and we hold no record of them.
• Deleting it. Write to privacy@documented.co and we will delete your email and the answers attached to it. You do not have to give a reason.

Landing pages

Some of our advertisements may point to landing pages that ask for your email address and nothing else about you.

• What we keep. The email address you enter, which page you entered it on, and the click identifier described below.
• The click identifier. When you arrive from an advertisement, the link carries an identifier the advertising platform uses to mark which ad was clicked. The page strips it out of the address before analytics loads, so it is never sent to Google, and keeps it with your email so we can tell which advertisements are worth running. We do not send it back to the advertising platform.
• Where it goes. To the same server that holds sign-up form entries. It is not sold and not handed to a data broker.
• Deleting it. Write to privacy@documented.co.

Also worth knowing

• Hosting. Our web host may keep short-lived technical logs (such as IP addresses) to deliver and secure the site, under its own privacy policy.
• Fonts. If a page loads typefaces from Google Fonts, your browser requests font files from Google's servers, under Google's privacy policy.

Legal process, subpoenas and discovery

Two different things get called "a subpoena for my notes", and they have opposite answers. This section separates them, because the difference decides what is actually at stake.

If someone serves us

We respond to valid legal process only, we read what is asked for, and we object to requests that are overbroad or that reach beyond what the process authorises. What we are able to hand over is limited by what we hold, which is very little by design:

• There is no account, so there is nobody to look up. We do not collect your name, email address or phone number to use the app, and we hold no user directory to search.
• If you never turned on attorney sharing, we hold nothing. Not your entries, not your media, not a record that you use the app. A demand for it returns nothing, because there is nothing.
• If you did turn it on, we hold ciphertext. Entries and attachments are encrypted on your phone to your attorney's own public key before they are sent. We can produce the encrypted bytes and nothing else, because we hold no key that opens them.
• The timestamp authority holds fingerprints, not content. Sealing sends a SHA-256 hash, which cannot be reversed into the entry it came from.
• iCloud is Apple's. If you use iCloud sync, that copy sits in your own Apple account under Apple's terms, and any demand for it is a matter between the requesting party and Apple, not us.
• The website is separate. If you gave us an email address through a form or a landing page, that is what we hold about you and it is described above. It has no connection to your record.

Where process reaches something we actually hold, we will notify the person affected before we respond, so that they have the opportunity to object, unless the law or a court order forbids us from telling them.

If you are asked for your own record

This is the part no privacy policy can help with, so we would rather say it plainly than leave you to discover it later. If you are a party to a dispute or a case, for example with an employer, the other side can require you to produce relevant records that are in your possession or control, and a record of what happened at work is usually relevant. That request is served on you, not on us. Keeping the record on your device protects it from a breach, from a third party, and from us. It does not change what you may be required to hand over yourself, and encryption is not a legal privilege.

Deleting entries once a dispute is under way can do real harm. Documented is not a law firm, and questions about your own situation belong with an attorney licensed where you are.

Purchases

If you buy a subscription, the transaction is processed by the store you bought it from: Apple through the App Store, or Google through Google Play. We receive no payment card details from either. Their handling of purchase data is described in Apple's and Google's own privacy policies.

Your rights

Depending on where you live, including California and the European Economic Area, you may have the right to access, correct or delete personal data we hold, or to object to how we use it. We do not sell personal data. Write to privacy@documented.co and we will help.

Changes to this policy

If we change this policy, we will post the updated version here with a new effective date. Changes that would send more data off your device get called out prominently, not buried.

Contact

Questions about this policy or your privacy: privacy@documented.co.

Documented is not a law firm and does not provide legal advice. Records are tamper-evident, not tamper-proof.