droplet App Store

Last updated 7 October 2026

Privacy policy

Droplet is a journal, so the most private thing you own passes through it. This policy says plainly what happens to it. If anything here is unclear, email privacy@writedroplet.com.

The short version

  • Your journal is stored on your iPhone. Droplet has no accounts and no copy of it.
  • Droplet doesn't store or log your writing. It's sent to Cloudflare, which runs the AI model that writes your reflection; Cloudflare's terms say it doesn't use what you send to train AI models.
  • Reflections are written by AI: an open model run for Droplet on Cloudflare's servers.
  • Droplet asks before the first reflection, and you can say no. If the safety check on your iPhone flags what you wrote today, no reflection is asked for and none of it is sent.
  • With Plus reflections turned on, Droplet also sends what it remembers of you, all of it kept on your iPhone. In Settings, "What was last sent" shows every part of the last request.
  • If you vote on what Droplet builds next, our server keeps your vote until the round closes, then only the totals. If you send feedback, it keeps your message for 12 months, with nothing that identifies you or your iPhone beyond what you write. Cloudflare's database can restore deleted votes and feedback for up to 30 days.
  • Apple Health is off unless you switch it on. Then the weekly read sends only whether each day's sleep, steps and heart rate variability were lower, usual or higher than your own usual, and whether you had mindful minutes, never the numbers.
  • There are no ads, trackers or analytics in the app. We never sell data.
  • This website counts visits with Umami, which uses no cookies.

The app

Your journal

Everything you write, every reflection you receive and everything Droplet remembers for Plus is stored in the app's storage on your iPhone. If your iPhone backs up to iCloud or to a computer, that storage is in the backup, under your account. Droplet doesn't sync between devices, and we don't receive your journal.

Deleting an entry in Days deletes it and its reflection from Droplet. What Droplet remembers of that day keeps only what came from entries written before it, or your own words if you changed it; if a crisis was part of that day, it may keep only the words "A very hard day." for it, never anything you wrote. The weekly and monthly reads that drew on that day are deleted. Later entries that day keep their own reflections. Tide notes stay until you remove them on the Tide screen, and lines you marked not true stay and are sent with Plus reflections and reads for 90 days, unless you forget them there sooner. Delete everything, in Settings, deletes all of it from Droplet at once: every entry and reflection, your tide notes and the lines you marked not true, every weekly and monthly read and everything Droplet remembers. Your settings stay. A backup of your iPhone made before you deleted something still holds it until that backup is replaced or deleted. Deleting doesn't recall what was already sent for a reflection: Droplet's server stores none of it, and Cloudflare's terms apply to what it handled. Deleting removes what is on your iPhone; it doesn't recall a vote or feedback already sent. A vote stays on our server until its round closes, and feedback for 12 months (see Voting on what comes next, and Feedback). Deleting the app removes everything it stored on your iPhone.

Reflections

Reflections are free on any iPhone that runs Droplet, with no account. Your entry and your droplet are saved on your iPhone before anything is sent, so writing works whether or not a reflection can be written. Before the first reflection, Droplet asks you to agree and names where your writing goes. Until you agree, none of your writing is sent. If you decline, writing, your ocean, Days, Waters and Learn all carry on, and no reflection is made.

Each reflection, free or Plus, sends:

  • today's writing: the entry you just wrote and up to ten of today's earlier entries, with long ones shortened;
  • the time you wrote it;
  • your preferred reflection style;
  • the ideas recent reflections suggested, and the last suggestion you rated, with your rating;
  • your language and region, and your time zone;
  • that the safety check on your iPhone passed. If it finds something, nothing is sent at all (see Safety checks).

A free reflection also sends an App Attest key id and a signature.

App Attest is Apple's way for an app to prove a request came from the real app on a real iPhone. The key is made for this install of Droplet, with no account and no advertising identifier behind it, and nothing in it names you. The first time, the app registers the key with our server, with Apple's attestation that the real app made it. Each signature covers one request and carries a counter, so the same request can't be sent twice. The key on your iPhone goes when you delete the app; our server keeps its public half and counter with no expiry (see below).

Droplet Plus

A Plus reflection sends your App Store subscription receipt instead of the App Attest key, so our server can confirm you subscribe. With Plus reflections turned on (they stay off until you agree), each reflection also sends what Droplet remembers of you:

  • a one-line summary and mood for each of your last seven days. A very hard day is remembered only as "A very hard day.", never its words;
  • your tide notes: short lines Plus writes to remember what matters to you;
  • up to three older days whose summaries are like today's;
  • one-line summaries of a few past weeks and months;
  • lines you marked "not true", for 90 days, so Droplet doesn't write them again.

All of it is kept on your iPhone. On the Tide screen you can change or remove your tide notes and forget lines you marked not true; in Days you can change or clear each day's summary. In Settings, under Droplet Plus, "Exactly what's sent" lists every part of a request, and "What was last sent" shows every field the last reflection carried, the older week and month lines included, exactly as Droplet sent it. Deleting something you wrote clears it.

The weekly tide and the monthly read

With Plus reflections on, once a week the tide read sends the week's summaries and moods, your tide notes, your reflection style, lines you marked not true, whether the safety check flagged anything that week, your language and region, your time zone and your subscription receipt, and it sends again whenever that week's summaries change. Once a month, the monthly read sends the same for the month just gone, never anything from Apple Health, and it sends again whenever that month's summaries change.

Apple Health

Apple Health is off unless you switch on Health in the weekly tide. If you do, Droplet reads your sleep, step count, heart rate variability and mindful minutes, and compares each day with your own usual on your iPhone. The weekly tide read then sends only whether each day's sleep, steps and heart rate variability were lower, usual or higher than your usual, and whether you had mindful minutes. The numbers never leave your iPhone, and reflections never carry Health at all. Droplet only reads this data; it never writes to Apple Health. Health data is never used for advertising and never sold. You can turn access off at any time in the Health app or in Settings.

Where it goes, and who handles it

Everything above goes over an encrypted connection to Droplet's server, which runs on Cloudflare Workers. The server passes it to Cloudflare Workers AI, which runs the open AI model that writes your reflection, and sends the reflection straight back to your iPhone.

Droplet doesn't store or log what you send for a reflection or a read. Our server writes one log line per request, recording the route, whether it worked, how long it took and, if the server itself failed, the type of error, never anything you wrote. Cloudflare's own request logs for our server are turned off, and Droplet uses no Cloudflare product that stores what you send: no AI Gateway, no Batch API and no log export.

Besides votes and feedback (below), our server keeps only these, and none of them is anything you wrote:

  • for each install that sends a free reflection or feedback, or opens your journey on the home screen (which loads the round to vote on), its App Attest key's public half, the counter from its last signature, and whether Apple made the key for a test build, so it can check the next request. These are kept with no expiry, even after you delete the app, and aren't linked to you;
  • a count of today's requests for each install or subscription, to keep to the daily limits. It's named by a one-way hash of the key id or of the subscription's App Store transaction number, holds only the count, and is deleted at the next midnight UTC;
  • a count of today's new App Attest keys for each network address (for IPv6, each /64 block), named by a keyed hash so the address can't be read back, and deleted at the next midnight UTC. The address itself isn't stored or logged.

Cloudflare handles what you send on our behalf, as our processor. Cloudflare's terms for Workers AI say it doesn't use what you send to train AI models, and its Workers AI data usage page says the same. Cloudflare makes no promise about how long it keeps what you send while it runs the model. Cloudflare has no New Zealand region for Workers AI, so your writing may be processed outside New Zealand, in whichever Cloudflare data centre runs the model. Like any network, Cloudflare also records that a request happened, such as its time and the network address it came from, under its own privacy policy. We last checked Cloudflare's pages on 1 October 2026.

The AI models are open models that Cloudflare runs on its own servers. The companies that made them receive nothing.

Because there is no account at either tier, nothing sent carries your name, your email address or an Apple Account login. The Plus receipt is Apple's signed purchase record, which carries a transaction id and the store's country or region.

Voting on what comes next

Tap your depth on the home screen to open your journey, and under "Shape what's next" you can spend droplets on what Droplet should build next. Spending never lowers your depth or your waters. Opening your journey loads the round, which sends only this install's App Attest key id and a signature, at either tier; the first time, it also registers that key with Apple's attestation (see Reflections). A vote sends the same, with the option you chose, how many droplets you spend on it and how many you have, and never your writing. Our server keeps each vote as the round, the option, the droplets and a one-way hash of the key id, so it can hold each install to the round's limit, until the round closes. Closing keeps only the total for each option and deletes every vote. Cloudflare's database can restore deleted votes for up to 30 days, and then they are gone.

Feedback

Send feedback, in Settings, sends a message to Robin: what it is about, your message and the app version, signed with this install's App Attest key like a vote. Our server stores the message, what it is about, the app version and the time it arrived. It stores nothing about the key or your network address with it, so nothing in it identifies you or your iPhone beyond what you write. Feedback is kept for 12 months, then deleted. Cloudflare's database can restore deleted feedback for up to 30 days, and then it is gone.

Debugging info is off unless you turn it on. If you do, your message also carries:

  • your iOS version and iPhone model;
  • language and time zone;
  • which switches are on and which engine you chose;
  • how many entries and reflections you have;
  • the names and times of the last errors.

Language is your language and region setting, such as en_NZ. The switches are reflections and Plus reflections. The engine is the AI model picked in a test build of Droplet on this iPhone, if one ever was; an App Store build installed over that test build still sends it, and otherwise it is empty. An error's name is a code such as "WorkerError.status.429", with the time it happened, for up to the last 20; never an error's message. Debugging info never holds anything you wrote, and it is kept with your message for the same 12 months. "Exactly what's sent", on the feedback screen, shows the whole message before you send it.

The AI

Reflections are written by AI: an open model run for Droplet on Cloudflare's servers.

In the app, that AI is called Droplet, and it writes in Droplet's voice. It isn't a person, and it can be wrong. The weekly tide read and the monthly read are written the same way.

Safety checks

Crisis helplines are always in the app. Before a reflection is asked for, the app checks today's writing on your iPhone for signs you might not be safe. If it finds them, no reflection is asked for and none of that writing is sent: the app shows its own crisis message and the helplines for your region straight away, and the day is remembered only as "A very hard day.". Our server also runs a check with an AI model alongside each reflection; if that check flags the entry, the reflection is rewritten to put your safety first and the app shows the same helplines. A feedback message the check on your iPhone flags shows the same helplines, and is still sent if you send it. Both checks can miss things, so the helplines never depend on them.

Siri, Shortcuts and widgets

These run through iOS on your iPhone. What you capture with them is stored in your journal like any other entry.

Purchases

Apple handles payment. We never see your payment details. Apple tells the app whether you subscribe, and the app sends that signed receipt to our server with each Plus request.

No tracking

The app contains no analytics, advertising or third-party tracking code, and it does not track you across other apps or websites.

This website

We count visits with Umami, run on our own server at analytics.omit.nz. Umami uses no cookies and does not identify you. It records pages viewed and actions such as which buttons are pressed and how far a page is scrolled, so we can tell which parts of the site are useful. From the demo it records only the mood the page guessed from your line, never the words; the demo runs entirely in your browser. If your browser sends a Do Not Track signal, nothing is recorded.

The site is served by Cloudflare, which processes your IP address to deliver and protect it.

Children

Droplet is not directed at children under 13.

Your rights

Under New Zealand's Privacy Act 2020 you can ask for access to, or correction of, personal information we hold about you. Because Droplet keeps your journal on your iPhone, we usually hold none beyond what you write in feedback. Email privacy@writedroplet.com and we'll reply within 20 working days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner.

Changes

If we change how your writing is handled, we'll update this page and the date at the top, and tell you in the app before the change applies to you.

Contact

Droplet, Auckland, New Zealand. privacy@writedroplet.com