Who we are
Driff is an app for Android, Windows, macOS and Linux, with watch apps for Wear OS and Garmin, and this website. In this policy, “we” means the people who make Driff. You can reach us at help@driffapp.com.
What Driff keeps, and where
Your areas and weekly amounts, sessions, journal, photos, the songs you add, everything in plugins (flashcards, workouts, meals, sleep and the rest) and your settings are kept on the device you use them on: in a database inside the app on a phone or computer, and in the browser’s own storage in the browser demo. Photos are copied into the app, so clearing your camera roll doesn’t remove them.
Unless you turn on Sync (below), none of it is sent to us, and Driff works without a connection either way.
Backups
When you back up, Driff writes your data and photos to a folder you choose: on the device, on a USB drive, or a folder another service keeps in sync, such as Google Drive. That copy is yours. Driff never uploads it anywhere itself; if the folder lives with another service, that service’s terms apply to it.
Health Connect (Android)
Health Connect is Android’s store for health data on your phone. Garmin, Fitbit, Samsung and other apps write to it. If you connect it in Driff (Health → Settings → Health Connect) and allow each kind, Driff reads and writes only the following. It reads at most the last 30 days, only while Driff is open, and never your location or routes.
What Driff reads, and what for
| Sleep | The night on Today: when you slept and its stages, and the regularity and sleep need worked out from them. |
| Heart rate | Your heart rate overnight, and over a workout. |
| Resting heart rate | Shown with the night. |
| Heart rate variability, blood oxygen, breathing rate | Overnight, shown with the night. |
| Weight, body fat | Your weight and how it’s trending. |
| Workouts, with their calories, distance, climb and speed | Workouts from your watch in Fitness’s history, and as time toward an area. |
| VO2 max | Shown above Fitness’s history. |
| Steps, floors | A line on Today with the day’s steps, distance and floors. |
What Driff writes, if you choose to share it
| Meals | Each meal’s energy, protein, carbs, fat, fiber, sugar and sodium, with the meal and its name. |
| Water | Each day’s water. |
| Weight | Weight you type into Driff. |
| Workouts | Workouts you finish in Fitness, as strength training. |
Each kind is off until you turn it on. What Driff reads from Health Connect stays on your phone, in Driff’s own database. It is never sent to us or anyone else, never sold, never used for advertising, and used only to show it to you in Driff.
Stopping, and deleting
- Disconnect in Health → Settings → Health Connect stops it on that phone. What already came in stays in Driff until you delete it.
- Permissions can be taken back at any time in Health Connect, under App permissions → Driff.
- What came in goes when you delete those entries in Driff, or everything with Settings → Erase everything.
- What Driff wrote leaves Health Connect when you delete it in Driff, or you can remove it in Health Connect. Turning a kind off in Driff leaves what’s already there.
Watches
The Wear OS and Garmin apps talk only to Driff on your phone: the Wear OS app through Google’s link between a phone and its watch, the Garmin app through the Garmin Connect app on your phone. They carry your areas’ names, today’s minutes, the running session and your taps. Watches keep no history and never talk to a server of ours.
On a Garmin, Driff’s watch app can also bring over, once a day, what the watch measures and keeps to itself: Body Battery, stress, intensity minutes, recovery, resting heart rate, VO2 max, blood oxygen and breathing. It stays on your phone like the rest.
When Driff goes online
Driff connects only when you do something that needs it, and then only to the service involved:
- Music. Pasting a link or searching asks Spotify, YouTube or Deezer about that song (the link, or your search words) and fetches its cover. Playing it loads that service’s own player, under its own privacy terms.
- Food. Scanning a barcode or searching packaged foods asks Open Food Facts (the barcode, or your search words). The foods that come with Driff work offline. Reading a recipe from a link fetches that page.
- Exercises. An exercise’s steps and picture come from the free-exercise-db project on GitHub.
- Health Connect. If it isn’t installed, Driff can open its page in Google Play.
- AI features, only with Plus: Driff’s relay and OpenAI, below.
- Accounts, Sync and paying: Driff’s server, and Stripe for payments, below.
Requests to those other services carry what they need, like a link, a barcode or search words, and your device’s ordinary network details, such as its IP address. We aren’t part of them and receive nothing.
AI
Driff’s AI features come with the Plus plan, and each is off until you turn it on. A request goes from your device to Driff’s relay, which checks your plan, counts the request toward your monthly allowance and passes it to OpenAI under its API terms, with an anonymous identifier made from your account so OpenAI can point out abuse without knowing who you are. The answer comes back the same way. Neither the relay nor Driff stores what was in a request or its answer: the relay keeps only which feature was used, how often and what it cost, by month. Under its API terms, OpenAI doesn’t train its models on what’s sent, and may keep it up to 30 days to check for abuse. AI requests can’t be end-to-end encrypted, because the model has to read them, so each feature sends only what it needs.
The Focus coach, on a computer, checks whether the window in front fits the session you’re in. It sends only while a session runs, each window at most once a session:
- the session’s area, its part, and what counts for it, in your words;
- up to 12 windows you said count;
- the window’s app and title, with email addresses and long numbers taken out;
- a picture of that window, only if you turn on “Look at the window too”.
Never sent: Driff’s own windows, password managers and private browser windows. Driff keeps no record of the windows it saw, only how many minutes were on course, drifted or neither, and the windows you tell it count. If a build of Driff lets you enter your own OpenAI key instead, Focus sends the same items straight to OpenAI under your account, and the key stays on that computer: not in backups, and not synced.
Ask Driff, the chat, sends what Driff knows at the start of a conversation: today, your areas and their aims, this week, what’s coming up, the last 90 days day by day (time per area, and plugins’ lines such as sleep, workouts and meals) and each month’s time before that. Your journal entries and session notes go only if you share them; photos never. Then your questions.
The Focus tutor sends what you’re working on, with a picture of the page in front of you, and what you say to it.
Card artwork sends what the card covers (when, the time per area against its aims, what was finished, the songs), its journal and plugins’ lines only when they’re on the card, and up to two of your photos, made small, only when you choose them.
Meals from a photo sends that photo and which meal it is.
Anything new that would send something will be off until you turn it on, and this policy will say what it sends first.
Accounts, Sync and Plus
Sync and Plus are optional and paid, and need an account. You sign in with a code we email you; there’s no password. Our server doesn’t keep your email address, only a fingerprint of it (a keyed hash) that can’t be turned back into it, so it can email you only while you’re signing in, when you give the address again.
For an account, our server keeps a random id and that fingerprint; each signed-in device’s name, kind (iPhone, Mac…) and when it was last used; your plan and when it renews or ends; and, with Plus, how much AI each feature used each month and what it cost. To stop abuse, it also counts recent sign-in attempts, under fingerprints of the address and of the network address, for an hour at most.
Free trials. When an account starts its free Plus trial, our server keeps another fingerprint of the address, made from its plainest form (without a +tag, and with Gmail’s dots left out), and when the trial began. Unlike everything else here, it stays after the account is deleted, and it’s used only so the same address doesn’t get a second free trial.
Sync. Your devices encrypt everything before it leaves them, with a key only your devices and your recovery code hold. Our server keeps the copy it can’t read: your entries and photos as ciphertext under meaningless names, how much space they take and when they arrived, earlier versions for 30 days (a year with Plus), and your key, locked with your recovery code. It never learns what an entry is, what day it’s about, or which device wrote it.
Paying. On a computer or the web, you pay on Stripe’s own pages. Stripe keeps your card, billing email and address under its privacy policy, and tells us only your plan, its status and its dates; we never see your card. Emails about your plan (a trial starting or ending soon, a payment that didn’t go through, a plan ending) go to the address you gave Stripe. On iPhone and Android, paying will go through the App Store or Google Play.
Who handles it. Cloudflare runs our server, keeps the encrypted copies and sends our emails (sign-in codes, a welcome, news about your plan). OpenAI answers AI requests, with Plus. Stripe takes payments. Google hosts the help@driffapp.com mailbox, so what you write to us is kept there.
When a plan ends, your encrypted copy is kept 90 days in case you come back, then erased. Your devices keep their own data either way.
Deleting your account (Settings → Account in Driff, or at driffapp.com/account) erases at once everything our server holds for it: the encrypted copy and its files, your devices’ sign-ins, your plan and its AI use. A paid plan stops. Stripe keeps the payment records the law requires it to. Only the fingerprint that stops repeat free trials (above) stays.
This website
This site sets no cookies and runs no analytics scripts or ads. To know what’s read, its server counts page views: for each day, which page, the name of the site that linked to it, the country, and whether it was a phone, a tablet or a computer. It keeps nothing that could identify you: not your address, not your browser, and no record of a visit on its own. Its fonts and pictures come from the site itself, not from other companies. Signing in on the account page keeps you signed in for that browser tab only, in the tab’s own storage, and the browser keeps a random id so it shows once among your devices. Our server’s logs keep the page or request asked for, its result and the time, never your network address or what you sent; Cloudflare, which runs the server, handles visitors’ network addresses to protect the site from attacks.
Children
Driff is for a general audience and isn’t directed at children under 13, and accounts aren’t for them. We don’t knowingly hold anything about a child; if you think we do, write to us and we’ll delete it.
Your choices
Everything on your devices is yours to see, back up (Settings → Back up), change and delete (Settings → Erase everything, or uninstall). With an account, driffapp.com/account shows your plan, devices and AI use, and deleting the account there or in Driff erases what our server holds. To ask what we hold about you, or for a copy of it, write to us.
Changes
If this policy changes, the new version goes here with a new date at the top. Anything new that would send data off your device will be off until you turn it on.