Privacy policy · Dockleaf

Dockleaf is a skin diary that helps you notice patterns in eczema, skin flares and possible food links, for yourself or for someone you care for. It is not a medical device and does not diagnose anything. This policy explains what information Dockleaf handles, where it goes, and the choices you have.

Dockleaf is run by Nathan Hutchinson, an individual developer based in the United Kingdom, who is the data controller. Contact: [email protected].

The short version

By default your diary stays on your phone, in an encrypted database.
If you choose Cloud Sync, your diary is also stored in our database in the EU so it can sync between devices.
To turn your notes into diary entries and write summaries and pattern reports, the relevant diary text is sent to our AI provider (Anthropic) for processing. Names are never sent. It is not used to train AI models.
Local weather is optional and off by default. If you switch it on, a rough location (rounded to about 10 km) is sent to our server to look up the day’s weather. We never store or log your location.
Sharing a diary is your choice. If you use Cloud Sync you can invite one person to see, or add to, diaries you pick. They see everything in those diaries; you can stop sharing at any time.
We never sell your data, never use it for advertising, and never track you across other apps or websites.
You can export all your data, and delete your account and everything in it, from inside the app.

What we handle and why

Information	Why	Where it’s kept
Your account: email address (or an Apple private relay address), and a sign-in ID from Apple or Google if you use them	To let you sign in and keep your diary tied to you	Supabase (EU)
Two-step sign-in, only if you switch it on: the secret your authenticator app uses to make codes, and your recovery codes	To ask for a code as well as your password when you sign in, and to let you back in if you lose your phone	Supabase (EU). Recovery codes are stored only as one-way scrambled versions (hashes), never as the codes themselves
Diary content: food, skin, symptoms, treatments, environment, mood, sleep and notes you log; allergen and favourite-food lists; the diary’s name, who it is for and an optional date of birth	This is the diary itself	On your phone (encrypted). Also in Supabase (EU) only if you turn on Cloud Sync
Sharing, only if you share a diary or accept an invite: the display name and colour you choose, which diaries are shared with whom and at what level, and invites (a scrambled version of the link’s secret, never the link itself)	So the other person sees who wrote each entry, and so access can be given, changed and taken away	Supabase (EU)
The email address you type when inviting someone, if you choose to email the invite	To send them the invite link	Passed through our server to our email provider (Resend) to send that one email. We don’t store it
Diary text sent for AI processing	To structure what you type or say into entries, and to write daily summaries, weekly pattern reports and clinician reports	Passed through our server to Anthropic for the request, not stored by our server
Rough location, only if you switch on “Log local weather” (off by default)	To look up the day’s local weather and add it to your diary and reports, as context	Your phone’s approximate location is rounded to about 10 km on your phone before it is sent. Our server uses it for the lookup and does not store or log it. If you type a town or postcode area instead of allowing location, only the rounded area is kept, encrypted on your phone
Daily weather (temperature, humidity, UV, wind, rain)	Shown on your diary’s timeline and used in pattern reports and clinician reports	On your phone (encrypted). Also in Supabase (EU) only if you use Cloud Sync. Weather records never include a location
Voice input	To let you speak instead of type	Transcribed on your phone by iOS. Audio is never sent to us
Subscription status	To know whether your subscription or trial is active	RevenueCat and our database. Apple handles payment; we never see your card details
Notification token	To send reminders and “your weekly report is ready” notifications. Notifications never contain health details	Our database, for Cloud Sync users
Crash reports	To find and fix bugs	Sentry. Reports are scrubbed of diary content and personal details and are not linked to your account

We process this information to provide the service you asked for (the contract between us). Because diary content is health information, we process it only with your explicit consent, which you give when you choose to use the app and its AI features and which you can withdraw by deleting your account.

AI processing

Dockleaf uses Anthropic’s Claude models through Anthropic’s commercial API. Our server sends only the diary text needed for the request you made (for example, one note to structure, or a summary of recent days for a report). The name of the person the diary is about is never sent. Anthropic does not use this data to train its models and keeps it only for a limited period under its commercial terms. If you use local weather, pattern reports and clinician reports also include each logged day’s weather figures (never your location). Daily summaries never include weather. Our server does not store the text or the AI’s reply; the result is saved in your diary on your phone (and in the cloud if you use Cloud Sync).

If you use Cloud Sync, you can invite one other person (for example a partner or another carer) to a diary or two of your choosing, by an emailed link or a QR code. An invite link works once and expires after 48 hours. You choose what they can do: view only; add and edit; or add, edit and delete. Only you can change the diary’s settings, approve changes to its allergen list, see its suggestions or share it further.

The person you invite sees everything in the diaries you share with them, including entries written before they joined: the diary’s name, who it’s for and date of birth if you added one, entries and their edit history, the allergen and favourite-food lists, daily summaries and weekly reports, and the diary’s daily weather. They see the display name and colour you chose, never your email address, and nothing from your other diaries or your account. Each entry shows who wrote it.

When they use AI features inside your diary (for example turning their note into an entry), the request is handled exactly as described above and counts towards your plan, not theirs. The person you invite doesn’t need a subscription.

You can change their level or stop sharing at any time; they lose access straight away and the copy on their phone is removed the next time it syncs. They can also leave at any time. What they wrote stays in your diary, with their name, because it is part of your diary’s record. Only you can export the diary. If you delete your account, the shared diary is deleted too and the other person is sent a short email saying a diary shared with them has closed (it doesn’t say which or whose).

Local weather

“Log local weather” is off until you switch it on in Settings, and you can switch it off at any time. When it’s on, Dockleaf asks iOS for your approximate location only while you are using the app (never in the background), rounds it to an area of about 10 km on your phone, and sends that rounded area to our server. Our server rounds it again and asks Apple’s weather service (WeatherKit) for that area’s weather. Apple receives the request from our server, so it never sees your phone or internet address. To avoid repeat lookups, our server keeps a shared copy of each area’s weather for up to 30 days; that copy is not linked to you or your account. Your location is never stored with your diary or your account, and never logged.

If you’d rather not share your location, you can type a town or postcode area instead. iOS’s built-in location service (provided by Apple) turns it into a map point, which is rounded at once; only the rounded area is kept, encrypted on your phone, and never what you typed. This also applies if you keep your diary on your phone only: with weather switched on, the rough area is still sent to our server for each lookup.

Switching weather off forgets the area and deletes your saved weather, on your phone and, if you use Cloud Sync, in our database.

Beta invite requests (website)

During the beta, this website has a form to request a TestFlight invite. It asks for your email address (required), an optional first name, confirmation that you have an iPhone, and, if you like, how you heard about Dockleaf.

The website doesn’t store your request. When you send it, a small program on Cloudflare (a Cloudflare Pages Function) checks it with Cloudflare Turnstile, which protects the form from spam, and then sends it by email to [email protected] using Resend, an email delivery service.

Turnstile runs a check in your browser to tell people from bots. To do this, Cloudflare processes your IP address and details about your browser.
Resend processes the contents of the email so it can deliver it to us.

Nathan Hutchinson, as data controller, uses your request only to decide on your invite and to send it to you. The email is deleted once your request has been handled, or after 90 days at most. It is never used for marketing. We handle your request because you asked us to (taking steps at your request) and because it’s in our legitimate interests to run a small, fair beta. The form will be removed when the app launches on the App Store.

Website analytics

This website uses Cloudflare Web Analytics to count page views and see which sites people came from. It works without cookies and doesn’t build profiles of visitors. To serve the website and produce these overall counts, Cloudflare processes basic request data, such as the page asked for and your browser’s details.

The website has no other analytics, trackers, advertising pixels or third-party cookies, which is why there’s no cookie banner.

Only these service providers, each acting on our behalf, and only for the purposes above:

Supabase — sign-in and the Cloud Sync database (EU region).
Railway — hosts our server (EU region).
Anthropic — AI processing, as described above.
RevenueCat — subscription status.
Sentry — crash reporting, with diary content removed.
Resend — sends a few emails: confirmation that your account has been deleted, a diary invite you ask us to send, and the note that a diary shared with someone has closed; and, from the website, beta invite requests to us.
Apple — the App Store, payments and push notification delivery; and, if you switch on local weather, weather data (WeatherKit, which receives only a rounded area from our server) and turning a typed town into a map point.
Cloudflare — hosts this website, runs the spam check (Turnstile) on the beta invite form, and provides the website’s analytics (Cloudflare Web Analytics).

Some of these providers may process data outside the UK and EU (for example in the United States). Where they do, they use recognised safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

How long we keep it

Diary data on your phone stays until you delete it, archive it, or delete the app or your account.
Cloud Sync data stays while you have an account. When you delete your account, it is deleted from our systems immediately, and within 30 days at most.
If you were invited to someone else’s diary and delete your account or leave, the entries you wrote there stay in that diary (it belongs to its owner); your display name is deleted with your account.
After deletion we keep only a record that a deletion happened (a one-way scrambled ID and two timestamps), so we can show we did it.

Your choices and rights

Keep it on your phone: choose “On this phone only” and your diary is never stored on our servers. (If you also switch on local weather, a rough area is sent to our server for each weather lookup, as described above.)
Local weather: off by default; switch it on or off at any time in Settings. Switching it off deletes your saved weather.
Export: Settings → Export gives you a copy of all your diary data.
Delete: Settings → Delete account removes your account and all its data. You don’t need an active subscription to do this.
Under UK and EU data protection law you also have the right to access, correct, restrict or object to how your data is used. Email [email protected]. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Children

Dockleaf is meant to be used by adults. A parent or carer may keep a diary about a child they look after; the child does not use the app themselves. If you believe a child has created an account, contact us and we will delete it.

Security

Your diary is encrypted on your phone. Data is encrypted in transit, and access to cloud data is restricted so that each account can only read its own diaries and any diaries shared with it. You can also switch on two-step sign-in (Settings → Account), so signing in needs a code from an authenticator app as well as your password, and switch on an app lock (Settings → App lock), so Dockleaf asks for Face ID, Touch ID or your phone passcode before showing your diary. The check happens entirely on your phone through Apple; Dockleaf never receives your face or fingerprint data. No system is perfectly secure, but we design Dockleaf to hold as little as possible.

Changes

If this policy changes, we’ll update the date at the top, and tell you in the app if the change is significant.