Privacy Policy

1. Who we are

dotdotdot (the website at dotdotdot.batuhan.org and the iOS app “dotdotdot - Text Story Maker”) is made by Batuhan KATIRCI, an independent developer based in Istanbul, Türkiye (“we”, “us”). We are the data controller for the personal data described here.

To contact us about privacy, use the form on the support page and pick “Privacy or data request”.

2. The website and web app

The editor runs entirely in your browser. Your stories, the photos and sounds you add and your settings are saved in your browser’s storage on your device (IndexedDB and localStorage). Videos are made in your browser too: nothing is uploaded unless you share a story. Clearing your browser’s data for the site deletes them.

The website sets no cookies (the only cookie is the sign-in cookie of our private admin panel) and loads no third-party scripts, fonts or trackers.

3. Share links

When you choose to share a story (from the website, or from the iOS app on a paid plan), we store and publish what you share at a link (/s/…): the story’s script, title and settings, the media it uses (photos, avatars, background video, music, voice notes and AI voice clips) and a preview image.

• A shared story is public content. Anyone with the link can watch it, download the video and copy it, with its media, into their own projects. Shared pages are hidden from search engines (noindex), but anyone you send the link to can pass it on.
• Sharing doesn’t need an account. You get a secret edit token, kept in your browser or the app, which lets you update the link or stop sharing. We only store a fingerprint (SHA-256 hash) of it.
• How long: share links don’t expire on their own. A story stays online until you stop sharing it, or until we remove it (for example after a report or a breach of the Terms). Its content and media are then deleted. A minimal record (the link id, title, dates and the number and size of media files) stays in our admin records.
• Lost your edit token? Ask us through the support page with the link, and we’ll remove it.

4. iOS app: your account

The first time you open the app, it creates an anonymous account with Firebase Authentication (a Google service). The account is just a random user id: we don’t ask for your name, email or phone number. It lets the app back up your projects and keep your plan.

If you choose Sign in with Apple (Settings › Account & backup), the account is linked to your Apple ID so you can restore your projects on another phone. Apple then gives us an identifier for your Apple ID and, if you allow it, your email address, which may be a private relay address that Apple creates for you. The email is stored with your account in Firebase Authentication and shown in the app. We don’t use it for marketing.

Our server also keeps a small record of each account: the user id, how it signs in (anonymous or Apple), its plan, the platform and app version, and when it was first and last seen.

5. iOS app: projects and cloud backup

Your projects are saved on your phone, and videos are rendered on your phone. To keep them safe, the app backs them up to our server:

• your projects (script, people’s names, settings),
• the media you add to them (photos, avatars, videos, music and sounds, the voice notes you record or pick, and AI voice clips),
• and, if you use the AI assistant, its conversation about each project.

The backup is stored on Cloudflare (R2 storage, KV, D1 and Durable Objects), linked to your account id. It is private: only requests signed in as your account can read it. We don’t look at it except when you ask us to help with a problem, or when the law requires it.

If you add photos or contacts’ pictures to a story, they are part of the project and are backed up with it. If you export a video, the app only saves it to your Photos or shares it where you choose; videos aren’t uploaded to us.

6. iOS app: purchases

Plus, Pro and Lifetime are bought through Apple’s App Store. Apple handles the payment: we never see your card or payment details, your name or your Apple ID’s billing information.

After a purchase, the app sends the transaction that Apple signed to our server. We verify Apple’s signature and store the result (the product, its expiry date and transaction ids) linked to a random id of your app install and to your account, so your plan works on your devices and for sharing. Apple also sends our server notifications about renewals, cancellations and refunds, which we use to keep your plan up to date.

7. iOS app: the AI assistant

The AI assistant (Plus and Pro) writes and edits stories for you. When you use it:

• What is sent: your request, the earlier messages of that conversation, the open story’s content (its script, people, settings and timing) and the results of the edits the assistant makes. This goes to our server, which sends it to an AI model through OpenRouter (OpenRouter, Inc.). OpenRouter passes it to the company that runs the model; today that is OpenAI, but the model and its provider may change. They process it to generate the answer, under their own terms and privacy policies.
• What we keep: our server doesn’t store the content of the conversation. It records usage counts for each step (the number of steps, tokens, cost, the model, how long it took and whether it worked), linked to your account, to apply the daily limits of your plan and to watch costs. The conversation itself is kept on your phone and in your cloud backup (section 5).
• Contacts: the assistant only looks at your contacts when you ask it to use someone from them, and only after you allow access. The search runs on your phone. The names of the matching contacts (at most 12 per search) are sent to the assistant so it can pick the right one; phone numbers, email addresses and other details are never read. When a contact is used, its first name and photo are added to your story on your phone (and backed up with it like any other photo).
• Voice input: if you dictate a request, Apple’s speech recognition turns it into text. The app asks for recognition on the device when your phone supports it, so the audio doesn’t leave the phone; otherwise Apple may process it under Apple’s privacy policy. We never receive the audio of a dictation, only the text you send.

Please don’t put sensitive personal information (yours or anyone else’s) into stories you send to the assistant.

8. iOS app: AI voices and voice notes

AI voices turn text into speech, in a voice you choose from our voice directory. Designing a voice of your own is not offered in the app: we make the voices of the directory. You type what is said, or the AI assistant writes it for you. They use credits (see the Terms).

• What is sent: our server sends ElevenLabs (ElevenLabs, Inc.) only what it needs to make the audio: the text to speak, with the chosen voice and its settings; and when you use speech-to-speech, the recording you chose to re-voice. Nothing else from your story is sent, and neither your account id nor anything else about you. ElevenLabs processes it to generate the audio, under its own terms and privacy policy.
• What we keep: the audio ElevenLabs makes (the clips) is stored on our server (Cloudflare R2) under your account. It is private: only your account, or a link the app gets for it that expires after a few hours, can read it. The app also saves each clip in the project, so it is backed up with it (section 5). We don’t keep the text of a clip or the recording you re-voiced on our server, apart from your backup.
• Voices: you choose voices from our directory. You can’t design or save a voice of your own in the app, so no voice is made from your descriptions or stored with your account.
• Usage and credits: for each AI voice request we record its size (characters or seconds), the voice, the model, the credits it cost, how long it took and whether it worked, and we keep a history of your credits (monthly credits, credit packs with their App Store transaction ids, spends and refunds), linked to your account. We use them to run your balance and plan limits and to watch costs.
• Voice notes: you can record your own voice with the microphone (only after you allow access) or pick an audio file. Voice notes are stored in your project on your phone and in your cloud backup, like photos (section 5). They are only sent to ElevenLabs if you use speech-to-speech on one.
• The voice directory: the voices offered in the app are made by us and hold no data of our users.

Only re-voice recordings of yourself, or of people who agreed to it.

9. Support messages

When you write to us with the form on the support page, we store your email address, the topic, your message, the app version if you give it, the page’s language and your browser’s user agent, in our database on Cloudflare. We use them only to answer you and to fix what you report. We keep them as long as needed to handle your request and follow up, and delete them earlier if you ask.

10. Technical data and security

Our server runs on Cloudflare. Like any website, it receives technical data with each request, such as your IP address, the approximate location derived from it, your browser or app version and the page requested. We use it to deliver the service and to protect it from abuse:

• To stop spam and abuse, we count requests per IP address (or per account or purchase) with per-minute and daily limits. These counters only hold numbers and are deleted after a day.
• Our server writes short technical logs (events such as “share created” or errors, never the content of stories, assistant conversations or voice clips). Cloudflare keeps them for a few days.

11. What we don’t do

• We don’t show ads and we don’t track you across other companies’ apps or websites.
• We don’t sell or rent personal data, and we don’t share it for advertising.
• We don’t use third-party analytics, advertising or crash-reporting SDKs. Firebase is only used for sign-in, through its API, with analytics turned off.
• We don’t use your stories, conversations, recordings or voices to train AI models.

12. Who processes data for us

We use a few service providers, only for the purposes above:

• Cloudflare, Inc. hosts the website and our server and stores share links, backups, AI voice audio, usage and credit records and support messages.
• Google LLC (Firebase Authentication) runs the app’s accounts.
• Apple Inc. provides Sign in with Apple, App Store purchases and speech recognition.
• OpenRouter, Inc. and the AI model provider it routes to (today OpenAI) process AI assistant requests.
• ElevenLabs, Inc. makes the speech of AI voices: it turns text into speech and re-voices recordings for speech-to-speech.

These providers may process data in other countries, including the United States and the European Union. When personal data leaves Türkiye or the European Economic Area, we rely on the safeguards the law requires, such as the providers’ standard contractual clauses.

13. Why we may process it (legal bases)

• To provide the service you asked for (performance of a contract): accounts, backup, share links, purchases, the AI assistant, AI voices and credits, and answering support messages.
• Our legitimate interests: keeping the service secure, preventing abuse and spam, and keeping costs under control with usage limits.
• Your consent: access to your contacts, photos, microphone and speech recognition is asked for by iOS and only used when you allow it. You can withdraw it at any time in iOS Settings.
• Legal obligations, when the law requires us to keep or disclose data.

These match the GDPR (Art. 6) and Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK, Art. 5).

14. How long we keep data, and deleting it

• Web app: your stories stay in your browser until you delete them or clear the site’s data.
• Share links: until you stop sharing or we remove them (section 3).
• iOS account and backup: your account and its backup stay until you delete the account in the app (Settings › Account & backup › Delete account) or ask us to delete it through the support form. This deletes your cloud backup (projects, media including voice notes, and assistant conversations), the links between your account and your purchases, your own AI voices (on ElevenLabs too), the AI voice audio stored for your account, your credit balance (bought credits included), our record of your account and your Firebase account. Usage records of the assistant and of AI voices, and the history of credits, are kept for statistics and accounting with your account id replaced by “deleted”: only amounts, kinds and dates stay, and for credit packs the App Store transaction id, so a pack can’t be redeemed twice. Very large backups finish deleting in the background shortly after. You can also choose to delete the projects on your phone.
• AI voice audio stays on our server until you delete your account. Voice notes stay in your project and its backup until you delete them, the project or your account.
• Not deleted with the account: your purchases belong to your Apple ID, and a subscription keeps renewing until you cancel it in your Apple ID’s subscription settings. Share links aren’t tied to the account: stop sharing them first if you want them gone.
• Daily counters are deleted after a day; technical logs after a few days; support messages when no longer needed (section 9).

15. Children

dotdotdot is not directed at children under 13, and we don’t knowingly collect personal data from them. If you believe a child has given us personal data, contact us through the support page and we will delete it.

16. Your rights

Depending on where you live (for example under the GDPR or KVKK, Art. 11), you have the right to:

• know whether we process your personal data and get a copy of it,
• have it corrected if it is wrong, or deleted,
• restrict or object to its processing, and withdraw a consent you gave,
• receive it in a portable format,
• learn who it was shared with, including abroad,
• and complain to a data protection authority: in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, the authority of your country.

Most of this you can do yourself in the app (your projects are on your phone; Delete account removes the rest). For anything else, write to us through the support page with the topic “Privacy or data request”. We may ask for details that show the account or link is yours. We answer within 30 days.

17. Changes to this policy

If we change how we handle data, we will update this page and its effective date. If a change matters, we will also tell you in the app or on the website before it takes effect.

18. Contact

Batuhan KATIRCI, Istanbul, Türkiye. Write to us through the support page.