Privacy & Data Handling

Local sorting

Local sorting runs entirely on this iPhone after its model is downloaded. Your capture text, View names, and sorting instructions are not sent to us or an external AI service.

Cloud sorting

Cloud sorting sends the selected capture text and eligible View information through our systems and an external AI service so the sort can be completed.

What passes through our systems

• Cloud access credential used for authentication
• Selected sorting tier
• Capture ID and revision
• Capture text
• Eligible View IDs and names
• Positive and negative View sorting instructions
• Operation and duplicate-prevention identifiers
• App version, platform, and locale

What may be sent to an external AI service

• Capture text
• View names
• Positive and negative sorting instructions
• Prompt instructions required to perform the sort
• Opaque View identifiers needed to return the result

Unrelated captures, app backups, your cloud access code, and our provider credentials are not sent to the external AI service.

What we may collect and retain

• Pseudonymous account and access status
• Selected sorting tier
• Number of captures processed and Views considered
• Opaque operation, capture, and View identifiers used for reliability and result delivery
• Operation creation, start, completion, queue, and processing times
• Success, failure, cancellation, timeout, and partial-success counts
• Number of matched Views, without their names
• Retry and recovery counts
• Budget reserved and charged
• Input and output token counts when available
• Safe error category
• App version, platform, operating-system version, and locale
• Whether a result was applied, skipped, or rejected because a capture changed

What we do not retain after processing

• Capture text
• View names
• Positive or negative sorting instructions
• Raw prompts
• Raw external-AI responses
• Cloud access-code contents
• Provider credentials or authorization headers

Cloud infrastructure backups may temporarily contain data that was being processed when a backup was created. That data is removed as the backup expires or is replaced.

External AI services

We currently use DeepSeek Open Platform and Google Gemini API. Their retention, training, security, and international-processing rules differ, and their official policies govern their handling of submitted content. Review those policies before using cloud sorting.

We do not intentionally submit content to optional provider data-sharing programs.

Before you use cloud sorting

Do not submit content you do not want processed under these rules and the linked external-service policies. You can use Local instead.

Connected storage and external AI

Connected is optional. You can keep using Soggy Voodoo locally without connecting cloud storage or an external AI service.

Where a Connected library is stored

When you turn on Connected, Soggy Voodoo keeps one active canonical Connected library in the storage provider you choose: Google Drive appDataFolder or your private Apple CloudKit database.

Soggy Voodoo's connector gateway is not the canonical store for your Captures, Folders, or attachments. It accesses the active storage provider as needed to perform authorized Connected operations.

What may pass through our systems during Connected use

• Capture text and state
• Folder names, instructions, memberships, and Flagged state
• Stable Soggy object identifiers and revisions
• Attachment names, MIME types, hashes, metadata, and attachment bytes when needed for the requested operation
• The active storage binding and technical information needed to route, validate, secure, and recover the operation

This information is processed so Soggy Voodoo can read or update the library you authorized, enforce revision and conflict rules, verify attachment integrity, and return the requested result.

What we may retain for Connected

• A pseudonymous Soggy account identifier
• Your active storage-provider binding and Connected library identifier
• Encrypted credential or refresh material needed to access the storage provider you connected
• Soggy OAuth authorization, token, scope, revocation, and connection-state records for AI connections
• Content-free or privacy-bounded operational information needed for reliability, security, rate limiting, recovery, and troubleshooting

The connector infrastructure is designed not to keep a separate canonical copy of your Connected library.

Connecting ChatGPT, Claude, Grok, or another supported AI service

An external AI service does not receive access to your Soggy Voodoo library unless you authorize the connection.

When you approve a connection, Soggy Voodoo issues that service a Soggy OAuth authorization limited to the permissions you approved. The external AI service does not receive your raw Google Drive or Apple CloudKit credentials.

After authorization, the AI service can ask Soggy Voodoo to perform approved library operations. Depending on the request and permissions, information made available to that AI service may include Capture text and state, Folder names and instructions, Folder memberships, Flagged state, attachment metadata, attachment bytes when requested, and stable Soggy identifiers and revisions needed to safely read or modify the requested objects.

Soggy Voodoo returns information needed for the requested tool operation rather than intentionally including unrelated library content.

External AI service handling

Once information is provided to an AI service you chose, that service handles the information under its own terms, privacy policy, account type, and data-control settings. Retention, training, safety-review, security, and international-processing practices may differ by service.

Disconnecting and revoking access

You can disconnect supported AI connections without disconnecting your Connected storage provider. Revoking an AI connection prevents that authorization from continuing to use Soggy Voodoo tools, but it does not delete your Connected library from Google Drive or Apple CloudKit.

You can also disconnect or switch Connected storage separately from AI connections.

Storage switching and retention boundary

Soggy Voodoo uses one active canonical storage provider at a time. When you switch storage providers, Soggy Voodoo copies and verifies the library before cutover. The previous provider copy is intentionally preserved after a verified switch rather than being automatically destroyed.

The production connector is designed as a thin, replaceable gateway rather than a canonical user-content store. It may transiently handle requested content and attachment bytes while an operation is running, but normal connector operation does not create a separate permanent canonical Soggy Voodoo library on connector infrastructure.

Operational logging is designed to avoid Capture text, raw attachment bytes, credentials, authorization headers, and other private payload content.