Free on theApp Store

Legal

Doris Privacy Policy

Doris. Your Life. In Chapters, operated by Doris Legacy AI LLC (California, USA).
Effective: August 4, 2026 · Applies to the Doris iOS app.

Doris is a private, AI-assisted memoir. It gathers moments from your day, only from sources you explicitly allow, and turns them into daily chapters that belong to you. A grounded deterministic fallback can preserve a usable record when AI is unavailable. This policy explains exactly what Doris collects, where it goes, and how you stay in control.

1. What Doris collects (only with your permission)

  • Photos you select or allow, including their metadata (time, and location if present) and captions describing the scene. Classification starts on-device. If you separately enable Photo AI, a downscaled copy is processed through Doris’s secured AI gateway for a richer caption; an explicitly configured owner or developer build may use a direct cloud-AI fallback under the same consent.
  • Location: your current location while Doris is open and, if you grant Always permission, significant location changes and visits that iOS reports while the app is in the background. Doris does not record or upload a continuous route. Raw visit and photo coordinates are retained on that iPhone for location lookup and are removed from cloud records; settled or confirmed place labels and times used in a journal moment may sync to your Doris account.
  • Calendar & Reminders: event and task titles and times.
  • Contacts: read on-device to find today’s birthdays and to let you choose one contact name for a person tag. A birthday note or name you select can become a journal moment and sync with your memoir. Your full contact list, phone numbers, emails, and addresses are never uploaded.
  • Health & Motion: authorized daily aggregate values and short summaries (such as steps, distance, workouts, sleep rhythm, heart-rate trends, HRV, blood oxygen, respiratory rate, and VO₂ max) used as journal context. These daily values and summaries may sync and be processed by the selected chapter route, including a cloud AI route; Doris does not upload your HealthKit sample database.
  • Notes, scans, shared content, and answers you add: captured text, mood check-ins, answers to Doris’s questions, and text or images you explicitly share or import, including content you choose from Mail or Messages.
  • Profile (“About You”): your name, pronouns, gender, exact date of birth/birthday, height, weight, and the human-readable home and work place labels you provide. Those profile fields may sync to your private Doris account, but the precise map coordinates used to anchor home or work remain on that iPhone and are removed from cloud records. Sensitive traits such as ethnicity or sexuality remain on your device at rest; they may be sent transiently as AI context only when you explicitly opt in, and you can turn that use off anytime.
  • Optional People Recognition: off by default. If you explicitly enable it, Doris creates an encrypted face-feature template from profile or reference photos you approve, solely to match you in your own journal. The template remains on that iPhone and is deleted when you turn matching off or delete your account.
  • Account and purchase history: your sign-in identity (Apple, Google, or email/password through Firebase Authentication), Premium product, transaction identifiers, subscription status, expiration, renewal, refund, and revocation events used to control access. Doris does not store your plaintext password. Apple processes payment details; Doris does not receive your full card or bank details.

2. Where your data lives

Your moments and chapters are stored on your device and synced to your own private, per-account space in Google Firebase (Firestore and Cloud Storage), isolated by security rules so only your signed-in account can read or write it. There is no social feed and no public content; sharing happens only if you export or explicitly create a share. The in-app diagnostic checklist stores content-free status and timing results locally and includes no journal text; it leaves your device only if you explicitly share an exported report.

3. AI processing

Chapter creation normally uses Doris’s authenticated server gateway (Google Gemini, with OpenAI as its fallback). The gateway sends the context needed for the feature you requested, such as moment text, times, place labels, authorized daily Health aggregates, profile context you allowed, explicit imports, and, only when Photo AI is enabled, a downscaled photo, over encrypted connections. If that gateway is unavailable, an explicitly configured owner or developer build may send the same requested chapter context directly to Google Gemini. On supported devices, Apple Intelligence or a grounded deterministic fallback may instead create a local result without sending that chapter request to an external model. Every route remains subject to the permissions and choices described in this policy. Cloud AI providers process the supplied context to generate Doris output and do not use it to train their models under our API terms.

4. What Doris does NOT do

  • No advertising, no data sale, no cross-app tracking.
  • No third-party analytics SDKs.
  • No background access to iMessage, SMS, or browsing history. Doris processes message exports, documents, or connected-account summaries only when you explicitly import or connect them.
  • No cloud or third-party facial recognition. Optional on-device matching is limited to the account owner after explicit opt-in. Doris never infers race, ethnicity, gender, sexuality, relationships, or another person’s identity from appearance.

5. Your controls

  • Permissions are opt-in one by one and can be changed anytime in iOS Settings or in Doris → Profile → Privacy & Permissions.
  • People Recognition is off until you enable it. Turning it off immediately removes the encrypted face template from that iPhone.
  • Export: download your full journal and data as JSON (Profile → Export).
  • Delete: “Delete my data & account” in Profile, or on the subscription gate when Profile is unavailable, permanently erases your cloud data (moments, chapters, profile, media) and your account identity, and wipes local data.

6. Retention

Your data is kept while your account is active so your memoir can grow. Deleting your account removes it from our systems; residual backups purge on a rolling basis.

7. Children

Doris is for users who are at least 18 and the age of majority in their jurisdiction. Doris is not directed to children, and we do not knowingly collect data from anyone under 18 or under the age of majority.

8. Changes

If this policy changes materially, Doris will show the updated version in the app and update the date above.

9. Contact

Doris Legacy AI LLC (California Secretary of State Entity No. B20260300502)
PO Box 420046, San Francisco, CA 94142
Email: support@dorislifechapters.com

Terms of Use: Doris uses Apple’s standard Licensed Application End User License Agreement (EULA), supplemented by the in-app Doris Legal Agreement shown before first use. See Terms.