Legal
Doris Privacy Policy
Doris is a private, AI-assisted memoir. It gathers moments from your day, only from sources you explicitly allow, and turns them into daily chapters that belong to you. A grounded deterministic fallback can preserve a usable record when AI is unavailable. This policy explains exactly what Doris collects, where it goes, and how you stay in control.
1. What Doris collects (only with your permission)
- Photos you select or allow, including their metadata (time, and location if present) and captions describing the scene. Classification starts on-device. If you separately enable Photo AI, a downscaled copy is processed through Doris’s secured AI gateway for a richer caption; an explicitly configured owner or developer build may use a direct cloud-AI fallback under the same consent.
- Location: your current location while Doris is open and, if you grant Always permission, significant location changes and visits that iOS reports while the app is in the background. Doris does not record or upload a continuous route. Raw visit and photo coordinates are retained on that iPhone for location lookup and are removed from cloud records; settled or confirmed place labels and times used in a journal moment may sync to your Doris account.
- Calendar & Reminders: event and task titles and times.
- Contacts: read on-device to find today’s birthdays and to let you choose one contact name for a person tag. A birthday note or name you select can become a journal moment and sync with your memoir. Your full address book is never uploaded. Together sends only a contact detail you select when you tap Find, as described below.
- Health & Motion: authorized daily values and short summaries (such as steps, distance, sleep rhythm, heart-rate trends, HRV, blood oxygen, respiratory rate, and VO₂ max), and the type, times, distance, and energy of each workout, used as journal context. If you authorize State of Mind, each feeling or daily mood you log in Apple Health or another app becomes its own private journal moment, with its time, pleasantness rating, the feelings and associations you chose, and the name of the app that recorded it. These values, summaries, workouts, and State of Mind entries may sync to your Doris account and be processed by the selected chapter route, including a cloud AI route. Beyond those items, Doris does not upload your HealthKit sample database.
- Notes, scans, shared content, and answers you add: captured text, mood check-ins, answers to Doris’s questions, and text or images you explicitly share or import, including content you choose from Mail or Messages.
- Connected email accounts: only after you authorize a Gmail or Microsoft account, or provide an app-specific password for an IMAP account, Doris reads message bodies and headers to identify completed purchase and payment receipts, messages you sent, and the exact incoming messages you replied to. Doris ignores unrelated incoming mail, drafts, spam, trash, and quoted history. For matching messages, it saves a short redacted description, limited subject and message time in your private account for journal sequencing; it does not save the full email body or attachments. Doris stores the account grant or app-specific password encrypted so it can check for new matching messages until you disconnect. It does not send, alter, delete, or mark email as read. Disconnecting stops future checks; journal details already added remain until you delete them or your account.
- Profile (“About You”): your name, pronouns, gender, exact date of birth/birthday, height, weight, and the human-readable home and work place labels you provide. Those profile fields may sync to your private Doris account, but the precise map coordinates used to anchor home or work remain on that iPhone and are removed from cloud records. Sensitive traits such as ethnicity or sexuality remain on your device at rest. Use of traits you choose to provide starts on after sign-in and acceptance of the app agreement: they may be sent transiently to cloud AI as private journal context. Ethnicity may also be used for requested posters; sexuality is never used for posters. You can turn this use off in About You. Doris does not infer these traits from appearance.
- Optional People Recognition: off by default. With Me only, Doris creates an encrypted face-feature template from your profile photo and the photos where you tag yourself, solely to recognize you in your own journal. With Me and people I tag, which needs its own separate consent, Doris also keeps an encrypted face-feature template for each person you name by tapping their face in a photo, built only from those tagged faces, and uses it to suggest or add that person’s name in your later photos. Templates are processed and stored only on that iPhone; they are never uploaded, synced, shared, or used for advertising or model training. Names Doris adds this way are marked as recognized and you can correct or remove them.
- Account and purchase history: your sign-in identity (Apple, Google, or email/password through Firebase Authentication), Premium product, transaction identifiers, subscription status, expiration, renewal, refund, and revocation events used to control access. Doris does not store your plaintext password. Apple processes payment details; Doris does not receive your full card or bank details.
2. Where your data lives
Together: contact discovery starts selected in invitation-profile setup. Saving that profile can let another Doris reader find you using a verified email address or phone number they select. Doris sends only the selected contact detail when you tap Find, not your address book. Nearby visibility starts on when you open Together with a saved profile on a supported device and no open session; you can turn it off for that visit. Nearby discovery displays your invitation identity, not your journal. Sharing journal records still requires both participants to review and accept the session and its categories. Distance checks use the required device permissions; a saved consent choice does not grant an iOS permission.
Your moments and chapters are stored on your device and synced to your own private, per-account space in Google Firebase (Firestore and Cloud Storage), isolated by security rules so only your signed-in account can read or write it. There is no social feed and no public content; sharing happens only if you export or explicitly create a share. The in-app diagnostic checklist stores content-free status and timing results locally and includes no journal text; it leaves your device only if you explicitly share an exported report.
3. AI processing
Chapter creation normally uses Doris’s authenticated server gateway (Google Gemini, with OpenAI as its fallback). The gateway sends the context needed for the feature you requested, such as moment text, times, place labels, authorized Health summaries, workouts, and State of Mind entries, profile context you allowed, explicit imports, and, only when Photo AI is enabled, a downscaled photo, over encrypted connections. If that gateway is unavailable, an explicitly configured owner or developer build may send the same requested chapter context directly to Google Gemini. On supported devices, Apple Intelligence or a grounded deterministic fallback may instead create a local result without sending that chapter request to an external model. Every route remains subject to the permissions and choices described in this policy. Cloud AI providers process the supplied context to generate Doris output and do not use it to train their models under our API terms.
AI mood estimates: for signed-in readers, Doris automatically sends short, device-redacted summaries of eligible journal moments to its AI gateway to estimate the emotional tone of the recorded context. This feature starts on and currently has no separate off switch. It follows source permissions and uses photo captions only when Photo AI is enabled. Device-only, dismissed and work-redacted moments are excluded. Estimates are labeled, can be uncertain, and do not replace feelings you report or establish a diagnosis. Summaries are limited to eligible moments from the last 30 days; estimates are cached privately on the device for the signed-in account.
4. What Doris does NOT do
- No advertising, no data sale, no cross-app tracking.
- No third-party analytics SDKs.
- No background access to iMessage, SMS, or browsing history. Doris processes message exports, documents, or connected-account summaries only when you explicitly import or connect them.
- No cloud or third-party facial recognition. Optional on-device matching recognizes only you and the people you yourself have tagged, after you opt in. Doris never identifies strangers, searches for people outside your own photos, or infers race, ethnicity, gender, sexuality, or relationships from appearance. Only tag people who are comfortable being recognized; in some places the law requires their consent.
5. Your controls
- iOS source permissions are opt-in one by one and can be changed anytime in iOS Settings or in Doris → Profile → Privacy & Permissions.
- People Recognition is off until you enable it. You can make Doris forget any tagged person in Profile → People Recognition. Switching to Me only deletes every tagged person’s template; turning recognition off deletes all face templates from that iPhone. Retagging or deleting a photo removes what Doris learned from it.
- Export: download your full journal and data as JSON (Profile → Export).
- Delete: “Delete my data & account” in Profile, or on the subscription gate when Profile is unavailable, permanently erases your cloud data (moments, chapters, profile, media) and your account identity, and wipes local data.
6. Retention
Your data is kept while your account is active so your memoir can grow. Deleting your account removes it from our systems; residual backups purge on a rolling basis.
7. Children
Doris is for users who are at least 18 and the age of majority in their jurisdiction. Doris is not directed to children, and we do not knowingly collect data from anyone under 18 or under the age of majority.
8. Changes
If this policy changes materially, Doris will show the updated version in the app and update the date above.
9. Contact
Doris Legacy AI LLC (California Secretary of State Entity No. B20260300502)
PO Box 420046, San Francisco, CA 94142
Email: support@dorislifechapters.com
Terms of Use: Doris uses Apple’s standard Licensed Application End User License Agreement (EULA), supplemented by the in-app Doris Legal Agreement shown before first use. See Terms.