Privacy Policy

Last updated: 29 October 2026 · Dansk

This policy applies to the apps published by Vesle Apps ("we", "us", "our"). Several of our apps help you keep a personal log of private or sensitive information, such as a personal diary, health notes, or wellness tracking. We take the privacy of that information seriously, and we have designed our apps to keep your data under your control.

The short version

Your data stays on your device by default. We have no server that sees your log. If you pair with someone, what you share passes, encrypted, through our Mailbox at Cloudflare, which cannot read it. If you send feedback, we get your text and — if you leave them on — the app version, iOS version and phone model. We only get your email address if you enter it yourself.
Synchronisation is optional and off unless you turn it on. If you enable it, the contents of your log are encrypted on your device with a key that stays in your keychain before they sync to your own private iCloud database, so neither we nor Apple can read them.
You can optionally pair with one or more people — for example a partner or a keyholder. Pairing on its own shares almost nothing: a check-in, a "talk to me" flag, and a shared board of rewards and penalties. Everything else, including your log entries and your notes, is off until you turn it on, one data type at a time, for each person separately. If you never pair with anyone, nothing is ever shared.
Push notifications are off for every relationship until you switch them on, and they never carry what was sent. We never send push to someone who uses the app on their own.
We have no access to the contents of your entries.
We never sell your data, and we never share it for advertising.
We do not use third-party analytics or tracking SDKs.

What data the apps handle

Our apps let you create and store content you choose to enter — for example diary entries, notes, health or wellness logs, and similar personal information. This content is stored locally on your device. We, as the publisher, do not have access to it and cannot read it.

We do not require you to create an account, and we do not ask for your name, email address, or other identifying information in order to use the apps. If you want a reply to feedback, you can choose to give us your email address (see Feedback and email to us).

iCloud sync and backups

Some apps offer optional synchronisation across your devices using Apple's iCloud. Synchronisation is off unless you turn it on, so it is entirely your choice.

What your log contains — outcomes, permissions, arousal levels, counts, check-ins, the Board, your notes and everything else you write — is encrypted on your device before it is uploaded to your own private iCloud database, with a key that stays in your iCloud Keychain. We cannot read it, and neither can Apple, whether or not you have switched on Apple's Advanced Data Protection.

Apple can still see what iCloud needs in order to sync: what kinds of records there are, how many, the dates and times they carry, when they were created or changed, and your role in a relationship (Dom, Sub or View). Test versions up to build 31 kept everything except notes and free text unencrypted in iCloud; their testers have been asked to delete that data before updating.

We do not operate this storage and have no access to the contents of your entries. Apple's handling of iCloud data is governed by Apple's Privacy Policy.

Your data may also be included in your device's standard backups (iCloud Backup or an encrypted local backup) if you have those enabled. These backups are managed by you and Apple, not by us. The contents of your log remain encrypted with your own key in these backups.

Sharing with a partner

DDiary lets you connect with one or more people — for example a partner or a keyholder — and exchange a limited set of information with them. You choose what, separately for each person. This is entirely optional. If you never pair with anyone, nothing is ever shared.

What can be sent

Always available once you pair

a check-in: green, yellow or red
a "talk to me" flag with a short heading you write yourself (at most 100 characters). This is something you write yourself, and your partner sees it.
a confirmation that one of the above was seen
entries on a shared board of rewards and penalties: a type and a number
the name the two of you give the board's units — for example renaming "Stars". This is something you write yourself, and your partner sees it.

Off by default — you decide, for each person and each type

your chastity periods: when a lock went on and came off, why it came off (completed, approved, not approved or emergency — fixed choices, not text you write, and not part of the notes), its goal, and the name you gave the device — something you write yourself, which your partner sees. A lock that is running when you switch sharing on is shared too, even if it began before you paired.
pauses in a chastity period, shared together with the period: when the pause began and ended, the reason (hygiene or other), whether it was supervised, and — if you choose "other" and write a reason of your own, at most 50 characters — that text. This is something you write yourself, and your partner sees it. Leave the field empty if you do not want to share a reason in your own words.
your arousal entries: a level
your edges: a count
your orgasms: the outcome, whether it was permitted, and the numbers you recorded alongside it
the notes you write about any of the above

None of these are shared until you switch them on for that specific person. Switching one off stops future sharing of that type; it cannot recall what was already sent.

So that you can always see exactly what a person has received, the app keeps a record on your own device — and in your own iCloud, if you have switched synchronisation on — of which of your entries were shared with whom. The record holds no content of its own, is never sent to your partner, and is deleted when the relationship ends.

Choosing what to share

Sharing is per person and per data type. Every relationship starts with all log sharing switched off; you turn on exactly what you want that person to see. There is no "share everything" switch, and pairing with someone does not in itself give them access to your log. Nothing you recorded before you paired with a person is ever shared with them — with one exception: if you share locks, the lock you are in at that moment is shared, so they can follow it. Otherwise sharing only covers what you record from then on.

Two things are worth knowing before you turn something on. First, what has already been sent cannot be recalled — switching a type off stops future sharing, it does not reach into the other person's phone. Second, your partner keeps their copy of what you shared even if you later end the relationship or block them. We cannot delete data on someone else's device, and neither can you.

What is never sent

The name you give a person, what you write about what triggered an entry, and the private note you can add to a check-in stay on your own device. They are encrypted there and are never sent to anyone.

Your notes are different: they stay on your device unless you deliberately turn on note sharing for a specific person. If you do, that person receives the notes you write from then on. The one exception is the reason you may write for a pause in a chastity period: it is part of the pause and follows chastity sharing, not note sharing.

How the connection is made

You connect by scanning each other's code, or by sending each other your codes, and then confirm with one tap that you see the same six-digit number. There is no directory, no search and no profiles. Nobody can contact you unless you deliberately paired with them.

How it travels: the Mailbox

Everything you share with a partner passes through the Mailbox, a small program of ours at vesle.app that runs at Cloudflare. Before anything leaves your device it is encrypted with a key that only your two devices can compute, and it is signed so that nobody else can insert anything. The Mailbox keeps each item so that your partner's devices can fetch it, and deletes it after 90 days at the latest. Neither we nor Cloudflare can read what you exchange.

The items are stored in the EU: Cloudflare keeps each channel in its own storage in the EU. On the way there, your request can still be handled by Cloudflare's servers outside the EU, and Cloudflare logs the storage's ID outside the EU. So the data is stored in the EU, but it is not processed only in the EU.

What the Mailbox sees

the channel's address: a long random-looking number worked out from your pairing, new for every pairing
a running number for each item, and when it arrived
each item's size, which the app pads to fixed steps so that the size says nothing about the content
which of the two of you sent it — as one of two anonymous marks, not who you are
whether the item should show a notification or arrive silently
if one of you has switched on push for the relationship: that device's push token (see Push notifications)

It does not see who you are, your name, your Apple Account or anything you send, and it needs no account. The Mailbox itself keeps no IP address, but your IP address reaches Cloudflare, as it does with any website (see Who receives data).

Test versions from before the Mailbox

The App Store version uses the Mailbox. Test versions released before the Mailbox exchange through a database of ours in Apple's iCloud (CloudKit's public database) instead. What is sent is encrypted in the same way, but Apple handles it on our behalf, and CloudKit marks each item with an identifier of the sender's Apple Account. This ends when the testers update and pair again.

What we can see

Nothing about the content, unless one of you sends it to us in a report (see Feedback and email to us). Because we run the Mailbox, we could in principle look at what it sees about a channel — the list above — but not who is involved or what is said. We do not do this in the ordinary course of running the app.

Ending a connection

You can end a relationship or block a partner at any time. Doing so deletes the keys, so the contents of the shared channel become permanently unreadable. When you leave a relationship — by ending it, blocking the person or using The Exit — and when you use "Delete all data", the app also asks the Mailbox to delete the items you sent that are still there, together with any push token for those relationships. Anything your partner had not fetched yet then never arrives. If the app cannot reach the Mailbox, the items are deleted after 90 days instead. None of this reaches your partner's device: whatever they have already received stays with them, and neither we nor you can delete it. Your partner is not notified. If you block someone, we keep a short cryptographic fingerprint of their keys on your device so that pairing with them again is refused — no name, no contact details, nothing else about them.

Push notifications

Push notifications are not in DDiary yet. When they come, this is how they work:

Push is off for every relationship until you switch it on. Each of you decides for your own device, one relationship at a time.
When you switch it on, your phone gets a push token from Apple and gives it to the Mailbox for that relationship only. The token is an address for your device; Apple can link it to your device.
When your partner sends something, the Mailbox asks Apple to deliver a notification. It never carries what was sent: it either shows a fixed, neutral text, which your phone shows in your own language, or it has no text at all and only wakes the app. The app then fetches the item from the Mailbox itself and decrypts it on your phone.
Apple thus learns that your device got a notification from DDiary, and when — not from whom, and not what.
Switch push off for the relationship, and the app asks the Mailbox to delete the token. It is also deleted when the channel closes or expires, when you leave the relationship or use "Delete all data", and if your phone has not renewed it for 90 days.

We never send push to someone who uses DDiary on their own, and the Mailbox keeps no token for them. If you switch on iCloud sync, Apple uses its own push service to tell your devices that your iCloud has changed. That runs between Apple and your devices, and we are not part of it.

The Android version of DDiary does not exist yet. When it does, it will use Google's Firebase Cloud Messaging in the same way, again only if you switch push on.

Feedback and email to us

DDiary has a feedback form under Profile → Help → Send feedback. It sends when you tap Send, not before. Each time, it sends one message to vesle.app, and from there it reaches us as an email.

What is sent

the kind of feedback: bug, idea or other
your text, at most 2,000 characters
the app version, the iOS version and the phone model (for example "iPhone17,1" — the model, not your particular phone), unless you switch them off in the form
your email address, but only if you tapped Accept and entered it yourself

The form shows all of this before you send it. Nothing from your log and nothing about your relationships is sent with it. The app adds no ID for your phone and uses no cookies. When your feedback has been sent, the app shows a reference, for example F-3FA85F64. The same reference is in the email, so we can find your message if you write to us about it.

If you want a reply

Without an email address, the email we receive does not say who you are, unless your text does. If you want a reply, the form first tells you that we will then know who you are, and the address field only appears after you tap Accept. Until you send, Undo removes the address again. We read what you send, but we do not promise a reply.

How it travels

The app sends your feedback over an encrypted connection to vesle.app. A small program there, which runs at Cloudflare, checks it and passes it on as one email to our inbox, support@vesle.app, at Hetzner in Germany. The email comes from our own address. If you gave us yours, it is added as the address to reply to.

We do not store your IP address, and it is not included in the email. Cloudflare, which sits in front of vesle.app, records it for up to 31 days as part of its security monitoring. We do not use it to find out who has written.

If the form cannot send

If the form cannot send your feedback, the app offers to open your own mail app with the same text instead. You can read and change it there before you send it, or not send it at all. It is then an ordinary email from your own address.

Report to us, and ordinary email

Two other things reach the same inbox. In a relationship, "Report to us" opens your own mail app with a report ready to send: your description and, unless you switch it off, words your partner has sent you, such as their notes and "talk to me" headings. So if someone reports you, we may receive words you sent them. And you can email us at support@vesle.app yourself. Both come from your own address.

From the version of DDiary that uses the Mailbox, a report also contains the relationship's Mailbox address, so that we can find the channel. Together with Cloudflare's records (see Who receives data), the address could let us look up the IP addresses both of you used in the last 31 days. We keep a report until the case is closed, and no longer than 90 days.

Email to vesle.app addresses passes through Cloudflare before it reaches our inbox at Hetzner.

Who handles it for us

Cloudflare, Inc. (USA) hosts vesle.app, runs the program that receives feedback, and passes on email sent to vesle.app addresses.
Hetzner Online GmbH (Germany) provides our inbox, where feedback, reports and email to support@vesle.app are kept.

Both handle it on our behalf. Cloudflare also has a role of its own; see Who receives data.

How long we keep it

We delete feedback and other email to support@vesle.app, including any email address and our own replies, no later than 90 days after we receive or send them. We keep a report until the case is closed, and no longer than 90 days.

Having it deleted sooner

Write to support@vesle.app, and we will delete it. For feedback, mention the reference the app showed you after you sent it, or write from the address you gave us. Without one of them we cannot tell which message is yours. For a report or an ordinary email, write from the address you used. You can ask to see what we have in the same way.

No analytics, no tracking, no ads

We do not embed third-party analytics, advertising, or tracking software in our apps. We do not build advertising profiles, and we do not track you across other apps or websites.

How we use data

Your content stays on your device, or goes only to the people you have chosen to share it with, through the Mailbox. We do not use it for any purpose, and we have no access to its contents. The Mailbox uses what it sees only to deliver items and notifications. What you send us yourself — feedback, a report or an email — we use to read it, to act on it, and to reply if you asked for one. We do not sell, rent, or share your personal data with third parties other than those listed below.

Who receives data

Cloudflare, Inc. (USA) hosts vesle.app and runs the Mailbox and the program that receives feedback, and passes on email sent to vesle.app addresses. It does so as our processor, under its Self-Serve Subscription Agreement and its Data Processing Addendum (version 6.4).
In addition, Cloudflare collects traffic and log data about the requests to vesle.app, including your IP address, and uses it for its own purposes, such as security and running and improving its network ("Network Data"). For that data Cloudflare is an independent controller, under its own privacy policy. Separately, the security analytics Cloudflare gives us keep each request's IP address and the address of the page for up to 31 days.
Apple delivers push notifications, but only for a relationship where you have switched push on. It receives your device's push token and the notification, which never carries what was sent. The terms are Apple's Developer Program License Agreement; Apple offers no separate data processing agreement. Test versions from before the Mailbox also exchange through a database of ours in Apple's iCloud (see How it travels). If you switch on iCloud sync, your data is in your own iCloud account; there Apple handles it for you, not for us.
Google LLC (USA) will deliver push notifications in the Android version, but only if you switch push on. It will receive a Firebase installation ID and a push token. The Android version does not exist yet, so today Google receives nothing from DDiary.
Hetzner Online GmbH (Germany) provides our inbox, support@vesle.app.

Transfers outside the EU

Cloudflare, Apple and Google are American companies, so data can be transferred to the USA. Cloudflare's transfers rely on the EU-US Data Privacy Framework, with the EU's Standard Contractual Clauses as a fallback. Google's terms for Firebase do the same. Apple and Google receive nothing from the Mailbox unless you switch push on.

How long data is kept

Items in the Mailbox: deleted after 90 days, or sooner when you leave the relationship (end it, block or use The Exit) or use "Delete all data".
Push tokens: deleted when you switch push off, when the channel closes or expires, when you leave the relationship or use "Delete all data", and after 90 days without renewal.
IP addresses in Cloudflare's security analytics: up to 31 days.
Reports: until the case is closed, and no longer than 90 days.
Feedback and other email to us: no longer than 90 days.
Everything on your device and in your own iCloud: until you delete it.

What you record in DDiary is about your sex life, which the GDPR counts as a special category of personal data. Where we handle personal data about you — the items and push tokens in the Mailbox, and what you send us yourself — we do so with your explicit consent (GDPR Article 9(2)(a), together with Article 6(1)(a)). You give it in the app: when you tap Accept before pairing, when you switch on a data type or push for a person, and when you send us feedback or a report.

You can withdraw your consent at any time, as easily as you gave it: switch a data type or push off for a person, end or block the relationship, use The Exit or "Delete all data", or write to support@vesle.app to have what you sent us deleted. Withdrawing does not affect what happened before, and it cannot recall what your partner has already received.

Children's privacy

DDiary is intended for adults, and you confirm that you are 18 or over when you first open the app. Our apps are not directed at children, and we do not knowingly collect personal data from children.

Your rights under the GDPR

If you are in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) gives you rights over your personal data, including the right to access, correct, export, and erase it, and the right to lodge a complaint with a supervisory authority. In Denmark, where we are based, that is Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk).

Because the personal data you keep in our apps is stored on your own device (and, if you choose, in your own iCloud account), you remain in direct control of it:

Access and export: your data is available to you within the app on your device.
Correction: you can edit or update any entry directly in the app.
Erasure: you can delete individual entries, or remove everything in the app with "Delete all data". If iCloud sync is switched on, that deletion also reaches your iCloud once it has synced. Deleting the app itself, or deleting data while sync is off, does not remove what is already in your iCloud; you can remove that under Settings → your name → iCloud → Manage Account Storage. Anything you have shared with another person also exists on their device. Deleting your own data does not remove their copy — that is theirs to delete, and nobody else can do it for them.

We do not hold a copy of your log on our own systems. The Mailbox holds only encrypted items for up to 90 days, which we can neither read nor link to you, so there is nothing there for us to retrieve for you; the app deletes yours as described above. What you send us yourself — feedback, a report or an email — is kept in our inbox; see Feedback and email to us for how to see it or have it deleted. If you have any questions about your rights, contact us at the address below.

Data controller

The publisher and data controller for the apps is Vesle Apps I/S, a Danish company registered with the Danish Business Authority under company registration number (CVR) 46591860, with its registered address at Esbønderupvej 33, 3230 Græsted, Denmark. You can reach us at support@vesle.app with any privacy question or request.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Significant changes will be reflected here.

Contact

Questions about this policy or your privacy? Email support@vesle.app.