Privacy
Last updated 5 October 2026.
Which policy this is
Donna is the service you use on iPhone and the web. It is run by Youth Coast Space Management Limited, Macao SAR.
01 · Who this covers
This page covers your use of Donna: the iPhone app (available on Apple's App Store), the web app, and this website. On the web you currently sign in through the service's account system at fractal.day.
02 · What Donna collects
Who you are. Your user id, your email address, and the display name your sign-in provider gives us. On iPhone you sign in with Apple or Google; on the web you can also use an email sign-in link.
What you say. The full text of your conversations with Donna, typed and spoken, and the transcript of every voice call.
What you make. Lists, notes, cards, tasks, plans and comments; the jobs you give Donna and their results; and the photos and files you attach or share to Donna.
Your calendar. Event titles, times, places, attendees and the start of their notes, and the names of your calendars — from your iPhone's own calendars, and from Google Calendar if you connect it.
How you tend to work. Donna derives a short written description of your working patterns — a tendency profile — from your activity, and uses it as context when planning.
Your voiceprint, only if you say yes. See section 08.
Operational records. Sign-in cookies, an audit log of changes and tool calls, records of how the app is used (for example, that a call started or a setting changed), a device token if you turn on push notifications, and your purchase history if you buy a plan or a refill.
We do not collect location in the background. Donna asks for it only when you ask a card for something that needs it.
03 · Where it goes — the AI path
This is the section that matters, so it is specific.
What goes with a request. To answer you, Donna may send the companies in section 04: what you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar.
Voice calls pass through Donna's server. During a call, your microphone audio goes from your device to Donna's server, and from there to OpenAI. OpenAI turns your speech into text, writes Donna's replies and speaks them, and sees photos you send her during the call. When ElevenLabs is in use, it handles the call instead: ElevenLabs turns your speech into text and speaks Donna's replies, Anthropic writes the replies, and Google writes a short note about the call.
Dictation and Apple Watch voice notes. ElevenLabs may turn them into text.
Donna works in the background too. Summarising your conversations, choosing what to remember, describing photos you send her, and running the jobs you give her, including web searches, each mean sending the relevant content to one of the companies in section 04.
Which company handles a given request is not fixed. It depends on the route in use and on backups when a company is unavailable. Every company that could handle a request is named in section 04; none is promised for any particular request.
04 · Who receives your data
This list is complete as of the date at the top. The same list is on Who we work with.
| Who | What they do | What they get |
|---|---|---|
| ElevenLabs | May run your voice calls with Donna when it is in use: may turn your speech into text, speak her replies, and hand each turn to the AI company that writes the reply. May also turn dictation and Apple Watch voice notes into text. | Your microphone audio and its transcript, and the text Donna speaks aloud. During a call: What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. |
| Anthropic | May write Donna's replies in voice calls ElevenLabs runs, and may run the jobs she does for you, such as looking things up. | What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. |
| May write a short note about each voice call ElevenLabs runs, as part of its call processing. | The transcript of the call. | |
| Z.ai | May summarise your conversations with Donna, describe photos you send her, and help decide how to handle a request. | What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. Photos you send her. |
| OpenRouter | Backup route for those summaries and descriptions when the main one is unavailable; may pass them to the AI company it selects. | What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. Photos you send her. |
| OpenAI | May run your voice calls with Donna: may turn your speech into text, write her replies and speak them. May also write her replies when the main route is unavailable, and build the search index of what is saved to your account. | Your microphone audio and its transcript, and the text Donna speaks aloud. What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. Photos you send her. |
| Nous Research | Backup for conversation summaries when the main route is unavailable. | What you ask Donna and your conversations with her; your name and email; your notes, lists, files and photos and what she remembers, which she reads to answer you; and calendar events when you let her use your calendar. |
| Exa | May run web searches for the jobs Donna does for you. | The search queries Donna writes for a job, which can include details from what you asked. |
Each of them receives your data only to perform the function described. None is permitted to sell it or pass it on for their own purposes.
Infrastructure, which is not optional. These companies host Donna's server and your account. Declining AI processing does not switch any of them off — deleting your account is the control for that.
| Who | Where | What for |
|---|---|---|
| Hetzner | Singapore | Hosts Donna's server, where your conversations with her, what she remembers and her jobs are kept, and from which requests go to the companies above. |
| Supabase | Singapore | Account database, file storage and sign-in. Not optional: your account already lives here; declining AI processing does not change this — deleting your account does. |
| Vercel | United States | Hosts Donna's account service. Not optional: every request to it passes through Vercel regardless of this consent. |
Apple handles sign-in and push notifications on iPhone. Google handles sign-in, and calendar if you connect it. Cloudflare delivers this website and counts its page views (section 11).
05 · Messages Donna drafts for you
Donna can write a message to a real person and put it in front of you. Nothing is transmitted when the draft is made. Donna reads it back to you as written, and it is sent only when you say so — that confirmation is a separate, deliberate act, and nothing else authorises the send.
Where a connected account has been set up for you, Donna can send on WhatsApp and Telegram after your approval. General self-service channel linking is still under review. Email and SMS drafting exists, but sending on those channels is not live yet.
When a message is sent, it leaves our systems and is handled by that channel's operator under their terms, not ours.
06 · Your calendar
On iPhone, Donna reads and writes your phone's own calendars through Apple's calendar system, once you allow it. On the web, if you connect Google Calendar, Donna gets full read and write access to it. Donna reads events — titles, times, places, attendees and the start of their notes — and can create, change and delete the events you ask her to.
Donna changes your calendar when you ask her to. If you refuse calendar access, Donna tells you it cannot see your calendar rather than guessing.
You can revoke Google Calendar access at any time from your settings or from Google's third-party access page, and we stop reading it immediately.
07 · What Donna remembers, and how to delete it
Donna keeps one long-running conversation and remembers across sessions. She picks out what is worth remembering from your conversations on her own. Sensitive things — health, money, legal matters, religion or politics, sexuality, and other people's private details — are not added to her memory unless you say yes; she asks you first. That memory is inspectable: you can see the lines Donna has kept and delete any of them.
Deleting a memory line removes it from Donna's memory going forward. It does not reach copies already held by the AI providers in section 04.
08 · Voice calls, and Your voice
Voice calls are not ephemeral. We store the full transcript of each call, along with its summary and duration, attached to your account. Section 03 says where the audio goes. We are auditing access controls across every product path. If you delete your account, your call records are deleted too, including on Donna's server, subject to the backup and log limits in section 12.
Your voice (voiceprint)
Optional, and only if you say yes. Donna can learn your voice so she can recognise you on your calls. She asks before she learns it, and makes nothing unless you agree.
What it is. A voiceprint is a numerical model of how your voice sounds, made from a short sample of your speech. It is biometric data. We keep the voiceprint and the sample it was made from on Donna's server, encrypted.
How it is used. Only to recognise your voice on your own calls with Donna. We do not send it to the companies in section 04, use it for advertising or to identify anyone else, or sell it.
How long we keep it. Until you tap Forget my voice in Settings › Your voice, or delete your account. Either one deletes the voiceprint and its sample from Donna's server.
09 · How long we keep it
Not yet settled. We keep your content for as long as your account exists, and keep an audit log of changes and tool calls for the same period. Deleting a card or a conversation in the app removes it from your view; the audit-log entry recording the change remains. Your voiceprint is kept only until you forget it or delete your account (section 08).
We have not set a retention window — not for our database, not for our logs, not for the audit trail — and we have not verified what each AI provider in section 04 keeps or for how long. So do not read this page as a promise that your prompts are deleted anywhere after any period, or that any provider does or does not use them to improve its models.
10 · Consent, and what it does today
We record an explicit consent to third-party AI processing for each account, and you can withdraw it. Our server is able to refuse to transmit anything for an account without one.
Do not assume every release blocks transmission until consent has been recorded. The service records your answer, but enforcement can vary by release. Withdrawing consent does not retrieve anything a provider has already received.
We tell you this because it is true, not because we are comfortable with it.
11 · What we do not do
- We do not sell your personal data.
- We do not share it with advertisers or data brokers.
- There are no tracking pixels, no ad networks and no advertising identifier in the app or on this site, and no third-party analytics SDKs in the app. The iPhone app declares no tracking and an empty tracking-domain list.
- This website is delivered through Cloudflare, and Cloudflare Web Analytics counts its page views for us. It uses no cookies.
- We do not build a profile of you for anyone but you. The tendency profile exists to plan your days.
- We do not show a cookie banner, because there is nothing to consent to beyond the sign-in cookie that keeps you logged in.
12 · Deleting your account
In the iPhone app, Settings › Account › Delete account deletes your account and its data: your account record, and what Donna's server keeps for you — your conversations, memory, lists, notes, jobs, attachments and voiceprint. It is a deletion, not a deactivation, and you are signed out at the end of it. Backups and logs are subject to the limits below.
Two honest limits. An active subscription is billed by Apple and must be cancelled separately in your Apple Account settings — deleting your account here does not cancel it. And deletion covers what we hold: it does not reach copies already sent to the AI providers in section 04, or our backups and logs.
On the web there is no delete button yet. Until there is, email [email protected] from the address you signed in with and we will delete it for you.
13 · Your other rights and controls
- Access and export. Ask for a copy of what we hold about you and we will send it.
- Correction. Most of your content is editable in the app. For anything that is not, ask.
- Disconnect Google. Revoke calendar access from settings or from Google, any time.
- Withdraw AI processing. Withdraw the consent you gave in the app. What that changes depends on the release — see section 10.
- Forget what Donna keeps. See every line she has kept and delete any of it (section 07).
- Forget your voice. Settings › Your voice › Forget my voice deletes your voiceprint and its sample.
14 · Security
Most account data in Postgres is protected by per-user row-level security. We are still auditing every product path and do not claim complete per-user isolation across the whole service. Traffic to us and to every provider named above is encrypted in transit.
We are a small product and hold no formal security certification. Treat us accordingly with genuinely sensitive material. There is a plain-English explainer of what Donna can see and where it goes at /security.
15 · Children
Donna is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has an account, write to us and we will remove it.
16 · Changes, and how to reach us
When what we do with your data changes, this page changes in the same release and the date at the top moves. If a change is material we will tell you in the app before it takes effect.
Questions, requests, or a correction to anything stated here: [email protected].