Trust & AI Transparency
Last updated: August 1, 2026
plottwist is a daily planner built around your family’s real life, which means it holds some of the most personal information there is: your days. This page explains, in plain words, what the app does with that information, where our AI runs, and every outside company involved. When any of this changes, this page changes in the same release.
Junie is an AI, and she says so
Junie, the assistant inside plottwist, is an artificial intelligence. She is not a person, and if you ask her, she will tell you exactly where her thinking runs. Junie proposes; the app’s tested, deterministic code executes. She cannot silently change your plan: ambiguous requests get a question, deletions ask first, and conflicts are named out loud.
Where Junie’s AI runs
Junie’s language model runs on DigitalOcean’s serverless AI inference, in the United States. When Junie’s server brain is active, the message you type and a structured summary of that day’s tasks (titles, times, and status) travel over an encrypted connection, through our own backend, to that inference service, produce a reply, and come back. That content is used to answer you and for nothing else.
DigitalOcean runs this inference under a no-training, zero-retention policy: your content is not used to train any model, and it is not stored after your reply is generated. On our side, our backend logs only counts and status codes, never what you wrote. In plain terms, that means we ourselves cannot read your conversations with Junie, by design.
On iPhones that support Apple Intelligence, some of Junie’s understanding can also run entirely on the device. If neither brain is available, plottwist still works: a simpler built-in rules engine takes over, fully offline.
What stays on your phone
- Your tasks, days, and energy history are stored on your device.
- Calendar events are read through Apple’s EventKit with your permission, and plottwist never writes to your calendar. There is no code path that can change, move, or delete a real calendar event.
- Removing a synced event inside plottwist only hides it from your plottwist day: the calendar copy is untouched, it will not re-sync, and Settings lists every hidden event with a Show again button. Only today and future days sync; past days remain your record of what actually happened.
Every provider we use
The complete list, in the spirit of the subprocessor pages published by companies far bigger than us. If a provider is not on this list, we do not use it.
| Provider | What it does | Sees your Junie messages? | Their security |
|---|---|---|---|
| DigitalOcean | Runs Junie’s AI inference (serverless) and hosts the plottwist.day web backend (US) | Yes, to generate replies. Not trained on or retained, per their zero-retention terms, and never logged by us | DigitalOcean Trust |
| Cloudflare | DNS, network edge, and encrypted tunnel to our backend | In transit only, as encrypted traffic | Trust Hub |
| Apple | App distribution, and optional on-device AI (Apple Intelligence) | On-device processing never leaves your phone | Platform Security |
| Resend | Sends waitlist confirmation emails for this website | No. Handles only your email address if you join the waitlist | Resend security |
| Supabase | The database behind this website’s waitlist and our support desk (US) | No. Holds waitlist records only, never anything from your day in the app | Supabase Trust Center |
| RevenueCat | Tracks whether a membership is active | No. Receives an opaque Sign in with Apple identifier and a subscription status, with no name, email, or anything you write | RevenueCat Trust Center |
| Meta | Measures ads for this website’s waitlist campaign | No. Website analytics only, never app content | Meta privacy |
| GitHub | Stores our code and builds the app | No. Holds no user data | GitHub Trust Center |
What the waitlist database actually holds
Your email address is encrypted before it is written, with AES-256-GCM and a key that lives in our server’s environment rather than in the database, so it cannot be read from a copy of the database alone. The rest of the row is not encrypted: your IP address, the approximate location derived from it, your browser’s user agent, and the answers you gave on the waitlist form. We would rather say that plainly than imply the whole record is unreadable.
Resend is the only provider here that holds your email address in the clear, because delivering a message requires it. It sent your confirmation, and it will send the one announcing the app.
Whether plottwist has an account for you
The planner works without signing in. Signing in with Apple is what carries your membership between devices and lets Junie use her full brain, and it does create one record on our side. That record holds the identifier Apple gives us, whether you are a member, when you accepted the terms, and any chat you chose to send us as feedback. It holds no name, no email address, and nothing from your day.
We would rather say that plainly than claim we keep nothing. What matters more is that you can end it: Settings › Delete my data erases that record and the feedback with it, and disconnects Sign in with Apple at Apple, so plottwist disappears from the list in your Apple Account settings. It takes under a minute and needs nothing from us.
What we are, and are not
plottwist is a small team. We are not SOC 2 or ISO 27001 certified, and we will not imply otherwise. What we do instead is run on infrastructure from companies that are audited for exactly that, keep as little as possible ourselves, and encrypt the one piece of directly identifying data we store. The links in the table above go to each provider’s own documentation so you can check them rather than take our word.
Questions
Ask us anything about this page at [email protected]. Short answers, from a human.