Privacy Policy

1. Who we are

Dear RoRo ("we", "us") is operated by Eunggyu Lee, Rehbergstrasse 4, 81479 Munich, Germany, and is the controller for the processing described here. This policy covers the Dear RoRo app for iPhone and the family pages at dearroro.app/f/. We process personal data under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Questions: hello.dearroroapp@gmail.com.

2. The short version

3. What stays on your phone

• Days you keep: words, photos, videos, the date
• Moments (daily photos and short voice clips)
• The people your journal is for: your name and photo, your children's names, birthdays and photos, your partner's name
• Stories you made, with their audio and covers
• Your copy of a voice recording

Faces in your photos are recognised on the phone itself, to suggest which days belong to which person. Face data never leaves the phone.

If you delete the app, this data is deleted with it, unless you have turned on iCloud backup.

4. iCloud backup

If you turn on iCloud backup in the app, a copy of your journal is saved in your own iCloud Drive. That copy is held by Apple under your Apple account and Apple's privacy policy; we have no access to it. You can turn the backup off at any time.

5. No account: an anonymous ID

To count free stories, check purchases and keep the days you send to family, the app creates a random anonymous ID on our server (Supabase) the first time it needs one. It is not linked to your name, email address or Apple ID, unless you sign up for news by email (section 12).

6. Making a story

When you make a story, the app sends what is needed to write and read it:

• the topic or kind of story you chose
• the words of the days you picked (only the ones you pick)
• names, ages and gender of the children, or your partner's name, as they appear in the story
• for a story of one day, the photo you pick for the cover, if you pick one
• the chosen language and voice

The text is written by Anthropic (Claude) or, as a fallback, Google (Gemini); the cover is painted by Google (Gemini); the audio is read by Cartesia. The finished story is sent straight back to your phone. We do not store your words, photos or stories on our server. We only record that a story was made (type, language, time) to count it against your plan. We do not use your content to train AI models.

7. Making a voice (biometric data)

You can make a voice so that stories are read in it: your own, or that of a family member who records on your phone. A voice recording is biometric data under Art. 9 GDPR, so we process it only with the explicit consent of the person whose voice it is, given in the app before recording. That person must be at least 16.

• The recording (about a minute) is sent through our server to Cartesia, which creates the voice. Our server does not keep the recording; your copy stays on your phone.
• We store the voice's ID at Cartesia, the name you gave it, its language and when it was made, plus a count of uses for daily limits.
• You can remove a voice at any time in the app. It is then also deleted at Cartesia. Removing it withdraws your consent for the future.

8. Sending days to family

You can send chosen days to a family member through a personal link (dearroro.app/f/…). Only what you send leaves your phone:

• the words of the day and the photos and videos you include. Photos and videos are made smaller on the phone first, and location data in them is not included. They are stored on our server (Supabase; photos and videos in Cloudflare R2) until you take the day back in the app.
• for each link: the name you give the person, whose days they are, when the link was made and last opened.

The first time the person opens the link, they sign in once, so that the link works for that one person and not for anyone it is forwarded to:

• Kakao: we keep only the Kakao account's identifier.
• Google or Apple: sign-in goes through our authentication service (Supabase), which stores the account's identifier and the email address and name that Google or Apple provide. We use only the identifier, to check the link.

The page then remembers the sign-in in that browser, so the person does not have to sign in each time.

We do not receive their contacts or anything else from the account. To have this sign-in deleted, the person can write to us.

If you share a day through KakaoTalk, a photo for the message card is uploaded to Kakao's image server, because our photos are private. Kakao's privacy policy applies to that card.

Taking a day back or turning a link off removes it from our server. If you delete the app without doing so, write to us and we will delete it.

9. Writing the journal together

You can invite your partner to write the journal together, each on your own iPhone. This uses Apple's iCloud sharing (CloudKit): the shared days are kept in the iCloud account of the person who invited, and shared only with the people who accepted. A day is shared only when "Together" is on for it. Photos and videos are made smaller first. We do not run this storage and cannot see it; Apple's privacy policy applies. Either of you can stop sharing at any time.

10. Purchases

Purchases are made through Apple's App Store; we never see your payment details. RevenueCat manages purchases for us and receives the anonymous ID (section 5), the products bought and their status from Apple.

11. Usage statistics

We use PostHog (EU servers) to see which parts of the app are used and where people stop, so we can improve it. We record actions only, such as "a day was kept" or "a story was made", with app version, device model, iOS version, language and which plan you have. We never record your words, names, photos or anything else in your journal. The ID is random and kept on the phone; it does not identify you. PostHog receives your IP address to make the connection; we do not use it to identify you. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by writing to us.

12. News by email

In the app (Profile → News from Dear RoRo) you can leave an email address to get an occasional letter about what's new in Dear RoRo. This is entirely optional.

• We store the address, your phone's language (to write in it) and when you signed up, with your anonymous ID (section 5). Nothing from your journal is sent.
• Letters are sent through Resend.
• You can stop at any time: tap "Stop the news" in the app, which deletes the address from our server, or reply to any letter.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

13. If you used the earlier version

Earlier versions of Dear RoRo used an account. When you update, the app can bring your earlier memories onto your phone once, using the sign-in still saved on the phone. The data of that earlier account stays on our server until you ask us to delete it. To delete the earlier account and everything in it, write to us from the account's email address or tell us how to identify it.

14. Our website

When you visit dearroro.app, our host Netlify processes your IP address and browser details to deliver the pages (server logs). The website does not use cookies or visitor statistics, and fonts are served from our own site.

15. Service providers

• Supabase (database, anonymous ID, server functions)
• Cloudflare R2 (photos and videos you send to family)
• Anthropic (Claude: writing stories)
• Google (Gemini: writing stories as a fallback, painting covers; Google sign-in on family pages)
• Cartesia (voices and reading stories aloud)
• RevenueCat (purchase management)
• PostHog (usage statistics, EU)
• Kakao (sign-in on family pages, KakaoTalk sharing)
• Resend (sending the news emails you signed up for)
• Netlify (hosting of dearroro.app)
• Apple (App Store purchases, iCloud backup, writing together, Apple sign-in on family pages)

Each provider processes data only to provide its service to us, under a data processing agreement or its business terms. We do not sell personal data.

16. Legal bases

• Contract (Art. 6(1)(b) GDPR): making stories, sending days to family, purchases, the anonymous ID
• Consent (Art. 6(1)(a) GDPR): news by email
• Explicit consent (Art. 9(2)(a) GDPR): voice recordings
• Legitimate interest (Art. 6(1)(f) GDPR): usage statistics in the app, server logs, security and abuse prevention
• Legal obligation (Art. 6(1)(c) GDPR): where the law requires us to keep records

17. How long we keep data

• Words, photos and stories for a story: not kept after the story is made
• Voice recordings: not kept on our server; the voice itself until you remove it
• Days sent to family: until you take them back or turn the link off
• Story and voice counts: as long as needed to apply plan limits
• Usage statistics: as long as needed to improve the app
• Email address for news: until you stop the news or ask us to delete it
• Sign-ins on family pages: until the link is turned off or the person asks us to delete it
• Earlier-version account data: until you ask us to delete it

18. Children

Dear RoRo is for adults keeping a journal about the people they love. Children do not use the app. Information about children is entered by their parent and, apart from what the parent chooses to use for a story, send to family or share when writing together (sections 6, 8 and 9), stays on the parent's phone.

19. Transfers outside the EU

Some providers (for example Anthropic, Google, Cartesia, RevenueCat, Resend) process data in the United States or other countries outside the EEA. We rely on adequacy decisions (including the EU-U.S. Data Privacy Framework where the provider is certified) or EU Standard Contractual Clauses.

20. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object (Art. 21) and to withdraw consent at any time (Art. 7(3)). Because there is no account, please tell us what to look for (for example, the family link or the earlier account's email address). Write to hello.dearroroapp@gmail.com; we answer within one month.

You may also lodge a complaint with a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), www.lda.bayern.de.

21. Changes

If what the app does with data changes, we will update this policy and, for important changes, tell you in the app.

22. Contact