Privacy

Last updated: October 18, 2026 · Product preview

NotiBuddy is provided by Yourbit, LLC. It connects paired AI assistants, apps, and services to your iPhone. This notice describes the current implementation, including the information needed to deliver messages and recover interrupted exchanges.

Your questions and replies are encrypted

The paired sender encrypts question text, choices, form content, and activity details before sending them to the delivery service. Your iPhone decrypts that content. Replies are encrypted for that sender. The delivery service does not have the private keys needed to read that message content.

Before connection, the app asks permission for relay delivery and reply sharing. Senders can be agents, apps, or scripts. Programs using the same approved connection share its permissions; a display label does not create a separate identity or private inbox. You can pause sharing in Settings or disconnect a sender in Connect. Requests marked sensitive, including those requiring authentication, use private notification and Live Activity previews. You can hide all content previews in Settings.

Creating a private, ten-minute setup code allows the first eligible new sender that uses it to connect automatically while the app is open and online. Additional new senders using that setup require manual approval in Connect. Keep every setup copy private; see the setup guide for code cancellation and manual approval.

A connected AI app or service is a participant in the conversation: it creates the requests and can read the replies addressed to it. If you connect a hosted service, that service handles your messages under its own privacy policy. Encryption protects message content from the NotiBuddy relay; it does not hide it from the sender you paired.

Encrypted messages are stored on the service so requests and replies can survive connection interruptions. Encryption does not hide all delivery information: the service can see identifiers, request types, timestamps, expiration times, and delivery state.

Files you choose to share

You can send one file up to 10 MB (10,000,000 bytes) to a connection whose receiving key you have approved. The phone encrypts the file, filename and file type for that connection before uploading. The relay sees the file size, connection identifiers, timestamps and delivery state, but cannot read the file or its name. Apps using the receiving connection can read the saved file; a connected AI provider may process it under its own policy.

The relay stops downloads after confirmed delivery, cancellation, revocation or a 24-hour deadline, and actively deletes the encrypted copy. Delivery is confirmed only after the receiver verifies, decrypts and saves it. Storage failures can delay physical deletion; a durable cleanup queue retries failed deletions, including after account deletion. Minimal file status records can remain until the original deadline plus a day. Cancelling cannot recall a copy already saved by the receiver.

What the service stores

• Encrypted content: requests, replies, activity-control messages, and user-selected files.
• Connection records: a paired account identifier, device and sender identifiers, public keys, sender labels, pairing-verification records, and Apple push notification tokens.
• Delivery and usage records: request identifiers, timestamps, expiration times, activity routing, device allowances, and request counts used to enforce the free limit.
• Purchase records: verified Apple transaction information, product and account identifiers, subscription status, expiry or revocation information, and paid phone-slot records when purchases are enabled. The phone supplies Apple’s device verification identifier to verify that its signed purchase belongs to that device. The service stores a purchase-specific cryptographic hash for slot allocation, not that raw identifier.

Pairing does not ask for your name, email address, phone number, or location. The website and app do not include advertising or third-party analytics SDKs. Apple handles payment details; NotiBuddy does not receive your card number.

App-download verification and restrictions

The app obtains an Apple-signed app-download record (AppTransaction) through StoreKit, including for Free accounts. It sends that full record and Apple’s device-verification identifier to NotiBuddy’s relay over HTTPS. Unlike encrypted messages, these verification details are readable by the relay. We use them to verify the app and device and apply app-download restrictions, including withdrawal of parental consent reported by Apple.

The relay stores an association between the verified download and your device/account, with information about changes to its status. A protected hash lets the service recognize the same verified download across different devices or accounts. The association and restriction records do not store the full signed Apple record or the original device-verification identifier.

A verified withdrawal leaves a separate minimal restriction record linked to that download hash, with event dates and verification references. It remains after account deletion and has no automatic expiry. Deleting and recreating an account does not remove that restriction.

How long information stays

The relay schedules deletion of expired requests and their associated replies and events after a 10-minute retention window. Completing a question does not immediately erase its stored record. Activity-routing records can remain for an hour after activity expiry, and usage records cover a rolling 24-hour window. Cleanup runs in the background.

Device registrations, sender records and pairing-verification records remain until you delete the account, independently of request expiry. Deletion removes that account’s paid phone-slot association. A separate minimal purchase ledger retains product, verification dates, expiry/refund status and active slot associations to enforce device allowances and restore paid access. After all associated accounts are removed, no device keys, account identifiers, device-verification hashes, message data or full receipts remain in that purchase ledger. Its purchase status persists while the service supports restoration, including lifetime purchases, so deletion cannot reset a refund or duplicate a paid allowance.

What stays on your devices

The iPhone stores credentials in Keychain and keeps local session and response records to support retries and recovery. Device signing uses the Secure Enclave when available, with a software-key fallback. The encryption key is stored in Keychain; not every key lives inside the Secure Enclave.

Recent requests on the iPhone keep up to 100 read-only receipts for 24 hours, including short request summaries and text replies. Form receipts record that a form was submitted, without keeping its field values in recent history. Expired receipts are removed during the next session refresh. The session storage is excluded from device backups. Use Sessions → Clear Recent to remove these receipts sooner; this does not erase records on the relay or the sender.

A replacement phone creates new keys and requires fresh computer pairing. Restore Purchases can restore paid access after Apple verifies the purchase, without restoring old messages or deleted accounts. There are no user-managed recovery codes.

The paired computer stores configuration, sender keys, file-receiving keys, pending-reply keys, and received files in its local NotiBuddy directory. Received files remain until you delete them. The phone stages encrypted uploads and small local file-name/status records in storage protected by iOS and excluded from backup; transfer records are pruned when viewed after their expiry and retention window. Your AI app may also retain the questions and answers in its conversation history under its own settings and privacy policy.

Local diagnostics and support

Builds with Settings → Diagnostics save limited performance measurements and crash summaries on the iPhone or iPad. These contain app versions, report periods, numeric measurements, diagnostic types, and code locations in NotiBuddy. They exclude request content, keys, sender names, filenames, exception messages, and account or device identifiers. NotiBuddy does not automatically upload these reports.

The local store is protected by iOS, excluded from backup, and limited to 100 reports and 512 KiB. Reports older than 14 days are removed when the app next opens or processes diagnostics. Settings → Diagnostics lets you clear the reports or turn collection off, which also clears them. Completing in-app account deletion clears and disables this local collection. Apple’s own system diagnostics and reporting settings are separate.

You can review a report and choose to share a copy using Apple’s share sheet. Shared copies round reporting periods to calendar days. Your chosen recipient can retain that copy; clearing the app cannot recall it. If you send diagnostics to support, we use what you provide to investigate the problem, along with your support message and contact details. Do not add pairing credentials or private request content.

Within Yourbit, access to support conversations is limited to the company owner. We delete support conversations and diagnostic attachments from our support records 30 days after the issue is resolved. Copies held by email providers or other recipients are managed under their own policies.

Concern reports you choose to send

Current test builds let you prepare a concern report from a request or sender’s details. The draft stays in that screen’s memory until you close it. You write the description, optionally include the displayed connection references, and review the exact report before choosing email, copying or sharing. Connection references can include an account reference derived from its identifier, a sender-key ID and a request ID; they are not access credentials.

NotiBuddy does not send the report automatically or attach sender names, request content, replies, files, purchase receipts or diagnostics. Include only information you want the recipient to receive. Do not send pairing messages, private keys or harmful images or files. The reporting guide explains the available controls and the alternative when no email app is configured.

If you send a report to Yourbit, support receives the description and references you selected, plus contact details or signatures your email or sharing service includes. We use this information to investigate the concern and respond. That support conversation is separate from encrypted relay traffic: the service you choose and its recipient can read and retain the shared copy. Opening an email or copying a report does not confirm delivery to support.

Deleting your NotiBuddy account or closing the draft does not delete email or other copies already shared. For questions about information you sent to Yourbit, contact contact@notibuddy.app; copies held by other services or recipients need to be managed there. Support messages do not follow the relay’s message-expiry schedule.

Availability notification

If you choose to use the website signup form, Yourbit stores your email address, chosen language, signup time and consent version with our hosting provider to send you one email when NotiBuddy is available. This does not subscribe you to a newsletter or create an app account. These details are separate from encrypted messages: Yourbit can read the email address to send your notification.

Our hosting provider processes your IP address to limit abuse; we do not save it in the signup list. We do not sell or publish the list. We keep your signup until we send the notification or you request removal at contact@notibuddy.app. We will delete the active list after sending the notification. Deleted records may remain in the database recovery history described below.

Hosting and Apple services

Our hosting provider hosts the website and delivery service, including storage of encrypted messages and connection records. Apple delivers push notifications and processes purchases. These providers may process network, security, and delivery information to operate their services. Their handling of provider logs is governed by their own policies.

For reliability, the relay records operation categories, outcomes, counts, timings and error codes. Our custom metrics exclude message and file contents, names, keys, and account or device identifiers. The hosting provider can separately attach request and execution context to diagnostics and process IP addresses, request paths and other network information to operate and protect its services.

Under our current hosting configuration, application logs are retained for seven days. Details of individual error occurrences are available for seven days, while issue summaries can remain afterward. Operational metrics are retained for three months. These periods are separate from message and file expiry and do not describe every provider security record.

Automatic visitor analytics is disabled on our websites. This does not erase any earlier analytics or disable the hosting provider’s separate network and security processing.

Our hosting provider’s database recovery feature can restore database contents to points within the previous 30 days. That recovery window is not a guarantee that all provider copies are physically erased within 30 days of deletion. Removing active app records does not immediately erase recovery copies or separate provider security records.

Read Apple’s privacy policy. For questions about our hosting providers and their handling of your information, contact contact@notibuddy.app.

Website language preference

On an initial visit to the bare homepage, the website uses approximate country information from our hosting provider to offer Mexican Spanish for visitors in Mexico and English otherwise. It does not ask for precise location or save the country in a NotiBuddy profile. A VPN or network routing can affect that estimate. Explicit page addresses, such as /mx/setup, keep their selected language.

Choosing English or Español in the website’s language menu saves the preference-only cookie __Host-notibuddy_language for up to 180 days. It contains only en or es-MX, is sent over HTTPS, and is not used for advertising or analytics. The saved choice takes priority over country selection. Change it with the same menu or remove it using your browser’s cookie controls. This website setting does not change the app’s language or your device settings.

If cookies are blocked, the language links still select the current page’s language. That preference will not be remembered for a later visit to the bare homepage.

Your controls and deletion

Connect → a connection → Disconnect connection withdraws access for that sender key and all apps or scripts using it. Current test builds first save a local block and retry intent, then ask the relay to confirm revocation. The app shows when confirmation is still pending; other devices can still receive requests until it succeeds. Retries run while the app is open. Copies already transmitted or received cannot be recalled. See disconnection status and retry steps.

The local pending record keeps a sender-key ID, bounded display name, account reference and retry identifier so disconnection can continue after pause or relaunch. After confirmation, the retry record is removed; the scoped key block remains through content clearing until account deletion. No request or reply content is needed for that retry. Keep your original pairing bundle private: disconnecting a sender key alone does not invalidate every copy of that bundle.

You can disable notifications in iPhone Settings and remove the NotiBuddy MCP connection from your AI app to stop that integration from sending new requests. These actions do not delete the service’s connection or purchase records.

Once confirmed, Settings → Delete account invalidates the account’s relay access and removes its active devices, senders, encrypted requests and replies, usage and cached purchase details. Deletion also removes the account’s app-download association and local restriction status, but not the separate download restriction record described above. That account’s paid-slot associations are released through a durable cleanup queue; opaque purchase/account references and revocation jobs remain until this work succeeds. The separate minimal purchase ledger described above remains for restoration and refund enforcement. Deletion clears this device’s credentials, saved requests, and notifications, and prevents its old connections from being used again. A failed file deletion can retain an opaque object identifier in a cleanup queue until deletion succeeds. A separate minimal marker remains in the account’s opaque routing location to reject old credentials and late events; the marker contains no message content, device keys, purchase record, or contact details. Database recovery and provider records follow the separate handling described above. If deletion is interrupted, connections pause and Settings lets you retry.

Deleting the account does not cancel an Apple subscription, erase Apple’s transaction records, or remove files on your computer or history in your connected AI app. Manage subscriptions in Settings, remove the computer’s NotiBuddy configuration, and use the connected service’s history/deletion controls separately. Any phones sharing that exact connection lose its relay access and remove their local account data when they next check the service. Other phones with separate connections using the same Apple purchase keep their own accounts. Deleting the iPhone app alone does not delete relay records and may leave Keychain items behind.

Privacy questions

For privacy questions or help with in-app account deletion, contact contact@notibuddy.app. An email alone does not prove control of an anonymous connection; use Settings → Delete account for the authenticated deletion flow. Do not send pairing bundles, private keys, or message content.