Privacy Policy - Decision Dolls

Effective date: 2026-07-30

Decision Dolls ("the app," "we," "us") is made by Liuto Apps. This policy explains what happens to your information when you use Decision Dolls. In short: everything you write stays on your device. The app collects a small amount of anonymous usage and crash data - never the content of your dilemmas - so we can see what's working and fix what breaks. Here's exactly what that means.

The short version

• Decision Dolls has no account and no sign-in, and we run no server that stores your content. We can't read your dilemmas, and we never will - they're never transmitted anywhere.
• Every dilemma, gut snapshot, journal entry, and setting you create is stored locally on your phone or tablet, in the app's own local storage.
• The app sends a small amount of anonymous diagnostic data: usage statistics (which screens and features get used), collected by an analytics server we run ourselves, and crash reports, handled by Sentry, so we can fix bugs. Neither ever includes anything you typed. You can turn this off entirely in Settings. Details below.
• No ads, no data selling. Decision Dolls shows no ads, includes no ad SDK, and we never sell or share your data with anyone for advertising.
• Notifications (the "your doll is ready" reminder) are scheduled and delivered entirely on your device by the operating system. No notification content or scheduling data is sent to us or to any third party.
• In-app purchases (the one-time "Doll House" unlock) are charged entirely by Apple's App Store or Google Play - we never see your card, your billing address, or your store account. RevenueCat checks the receipt with Apple or Google on our behalf, so we know an unlock is genuine and so "Restore purchases" works on a new phone. They see that a purchase happened, never who you are.
• If you delete the app, everything you wrote is deleted with it, because it only ever existed on your device. The anonymous usage data is not linked to you, so there is nothing we could look up or delete for a specific person (see "Your rights" below).

What data the app stores, and where

Decision Dolls still has no backend server for your content - nothing you write is ever stored anywhere but your device. The only data that leaves your device goes to our own self-hosted analytics server, to Sentry, and to RevenueCat for purchase verification, as described below - and none of it ever includes your dilemma titles, notes, options, or journal content, because the app simply never sends those anywhere.

The one exception is entirely in your hands: the Journal's "Export as PDF" action builds a document from your own entries and passes it to your device's share sheet, so you can send it wherever you choose. That file never passes through us.

Analytics (self-hosted)

Decision Dolls' usage analytics run on an Aptabase instance that Liuto Apps operates itself - not a third-party analytics vendor. The server runs on a virtual private server hosted by STRATO AG, Germany, which acts only as our infrastructure sub-processor; Liuto Apps remains the controller of this data throughout. Here is the full picture:

• What is collected: a fixed catalog of app-interaction events covering onboarding, the dilemma hand-over-and-decide loop, the paywall and purchase funnel, notifications, and an occasional product feedback survey. Every parameter attached to an event is a catalog id, an index, a count, an enum name, or a 0/1 flag - never a dilemma title, note, option text, or journal entry. That includes the fact that a purchase started, finished, was restored, or failed, along with which product it was - there is only one - but never the receipt, the price you paid, or anything tying it to your store account.
• What each event is stamped with: a debug flag, OS name and version, device locale, app version and build number, our SDK version, and a country and region derived as described next. There is also a short-lived session id: a random string generated when you open the app, held only in the app's memory, and thrown away when the app closes or after a stretch of inactivity. It lets us tell "one person tapped this five times" apart from "five people tapped it once." It is never written to your device, never reused, and cannot be matched to an earlier or later session.
• What happens to your IP address: your device's IP address is used only in memory, for a moment, to look up a country and region from a local database on our server - we don't even store the city, and the IP address itself is discarded immediately afterwards. We do not log or keep it.
• The one thing we do store that's derived from it: a one-way hash of your IP address and user-agent, salted with a value that's regenerated for this app every calendar day and deleted after two days. Once that salt is gone, the hash can no longer be recomputed or matched back to your IP, so after 48 hours there is no way for us, or anyone, to connect that value to you or to itself over time. We use it only to get a rough, same-day sense of distinct app installs - never to identify or track you. We're not overstating this: it's a genuinely anonymous, short-lived value, not a hidden user ID.
• What is never collected: there is no device identifier, no advertising identifier, no cookie, and no persistent identifier that follows you across sessions. There is no account, so none of this data is - or can be - linked to your identity. It is not used for advertising and never sold or shared. (RevenueCat's anonymous customer id, described under "Purchases" below, is separate: it exists only to verify your purchase and is not connected to anything in this section.)

Crash reporting (Sentry)

If the production app crashes, we use Sentry, a third-party error-monitoring service, as our processor to help us find and fix the bug. Here is the full picture:

• What is collected: the stack trace from the crash, standard device and app-version context (including your device model), and a trail of the same anonymous usage events listed above - the same ids, counts and flags, never anything you typed - so we can see what led up to the crash. Development builds don't report crashes at all.
• Where it's stored: our Sentry organization stores event data (and backups) in Sentry's EU data region, in Frankfurt, Germany, and we've accepted Sentry's Data Processing Addendum. Sentry itself is a US-headquartered company, so limited account, billing, and operational data may still be processed outside the EU - but the crash event data stays in the EU region.
• What is never collected: no personal information, no screenshots, and no view-hierarchy dumps. Session Replay is switched off entirely. We've also turned on Sentry's "Prevent Storing of IP Addresses" setting organization-wide, plus an additional rule that scrubs IP addresses before they're stored.

Purchases (RevenueCat)

The one-time "Doll House" unlock is paid for through Apple's App Store or Google Play. We use RevenueCat (RevenueCat, Inc., United States) as our processor to check with the store that a purchase is genuine, and to make "Restore purchases" work when you reinstall or move to a new device.

• What RevenueCat receives: the product id, the store's receipt, your country, basic device, platform and app-version information, and a random anonymous customer id that their SDK generates on your device. Never your name, your email address, your card details, or anything you wrote in the app.
• About that customer id: unlike the analytics described above, this one does persist on your device between sessions - it has to, or restoring a purchase could never work. There is still no account behind it, so it identifies a purchase, not a person, and it is used for nothing else.
• What we never receive: your payment card details, billing address, or Apple/Google account identity. Apple and Google handle the payment itself under their own privacy policies and terms; all we ever learn is whether an unlock is active.
• Not covered by the diagnostics toggle: turning off "Anonymous diagnostics" stops analytics and crash reporting, but purchase verification keeps working - otherwise the app could not tell whether you had paid. RevenueCat's own policy is at revenuecat.com/privacy.

Legal basis, retention, and opting out

• Legal basis (GDPR): where the law in your country treats this kind of measurement as needing your consent, the "Anonymous diagnostics" toggle in Settings is that consent - freely given, and freely withdrawn whenever you like. Where consent is not the applicable basis, we rely on our legitimate interest (Art. 6(1)(f)) in understanding, in aggregate, how the app is used and in finding and fixing crashes. We weighed that against your privacy before switching it on: the data is anonymous, it's the minimum that still answers "is this feature working," it contains nothing you wrote, it's never used for advertising or sold, and you can switch it off in two taps. Purchase verification rests on a different basis again: it is necessary to give you what you bought (Art. 6(1)(b)).
• How long it's kept: analytics events are kept for 14 months from the day they're recorded, then deleted automatically - long enough to compare one year against the next, and no longer. The salted hash described above is deleted after two days regardless. Crash reports are deleted at the end of our Sentry organization's retention window. If we ever need to keep something longer, we'll say so here first.
• You don't have to give us anything. No law and no contract requires you to share diagnostic data with us. Turn the toggle off and the app works exactly the same - every feature, no nagging, no reduced version.
• Opting out: Settings has a single toggle, "Anonymous diagnostics," that covers both analytics and crash reporting together. It's on by default, and you can turn it off at any time - from that moment on, nothing new is collected. A handful of events or crash reports that were already recorded before you turned it off and hadn't finished uploading yet may still be delivered; nothing recorded afterwards is ever sent.
• Deletion: analytics events are anonymized and are not linked to your name or any other identifiable information, so we have no way to look up or delete the specific records tied to one person or one installation - there's no account and no identifier that connects them back to you, and after two days even the salted hash described above can no longer be matched to anything. Turning off "Anonymous diagnostics" stops new data from being sent, but doesn't retroactively delete data already recorded. Questions about any of this are always welcome at info@liuto-apps.com.

Third parties

• Apple (App Store) / Google (Google Play): process your purchase of the Doll House unlock under their own respective privacy policies and terms. We do not receive your payment card details, billing address, or Apple/Google account identity - only a purchase confirmation/entitlement flag.
• RevenueCat, Inc. (United States): checks purchase receipts with Apple or Google on our behalf, as our processor, as described under "Purchases" above.
• STRATO AG (Germany): hosts, in Germany, the virtual private server our self-hosted analytics runs on, as an infrastructure sub-processor. Liuto Apps remains the controller of the analytics data itself.
• Sentry: processes crash reports on our behalf, as described above, with event data stored in Sentry's EU data region. No other analytics or crash providers are used inside the app.
• No advertising networks. Decision Dolls shows no ads and includes no ad SDK.
• Nobody else. Apple, Google, RevenueCat, STRATO and Sentry are the complete list. We don't share data with anyone else, and we never sell it.

Every company listed here works for us under a written data processing agreement, and each is contractually held to protect your data to at least the standard this policy describes. None of them is allowed to use it for their own purposes, and none of them may pass it on.

Where in the world your data goes

Almost nothing leaves Europe. The analytics server is ours, in Germany. Sentry stores crash events in its EU region, in Frankfurt.

Three companies we work with are US-based, so some data does cross the Atlantic: Sentry (limited account, billing, and support data - not the crash events themselves), RevenueCat (purchase receipts), and, on this website only, Google Analytics. For each of them we rely on the safeguards the GDPR provides for transfers outside the EU - the EU-US Data Privacy Framework where the company is certified, and the European Commission's Standard Contractual Clauses otherwise, in each case as set out in the data processing agreement we've signed with them. Email us and we'll tell you exactly which applies to which company, and send you a copy.

Website analytics

This is a policy for the Decision Dolls app. This website is separate: it uses Google Analytics 4 to see whether visitors find the page useful. We'll be precise about how that works, because "we only load it if you agree" would not be true. The Google tag loads for every visitor, with analytics storage switched off by default. Before you choose, Google receives a limited, cookie-free measurement request that includes your consent state and page information such as the page address and title, and, as with any web request, your IP address reaches Google's servers. No analytics cookies are written and we cannot pick you out of it, but we won't claim it is impossible for anyone to. If you say yes to the banner, analytics storage switches on and Google Analytics measures your visit more fully. Google operates this from the United States, under the transfer safeguards described above. None of this runs inside the app.

Changed your mind? There's a Cookie settings link at the bottom of every page on this site. Use it and the banner comes back, so saying yes is never permanent. Whichever choice you make is remembered in your browser's local storage so we don't ask again - that's the only thing this site stores on your device, and it holds nothing but the word "granted" or "denied." Because it exists purely to honour what you told us, it isn't something we ask permission for. Our hosting provider also processes standard server-log information, including your IP address, to deliver the page.

Children's privacy

Decision Dolls contains nothing objectionable, but it's built for people working through everyday grown-up decisions - it isn't made for children and we don't market it to them. It is not directed to children under 13, and we don't knowingly collect personal information from anyone under 13. In the EU, we don't knowingly collect personal data from children under the age of consent in their country (13 to 16, depending on where you live).

That's a low-risk promise to keep here, because the app collects no personal content from anyone of any age: everything written in the app stays on the device, and the anonymous usage data described above cannot identify or profile any user, child or adult. If you're a parent or guardian and you're worried a child's information has reached us through diagnostics, email info@liuto-apps.com and we'll look into it and tell you what we find.

Your rights (GDPR and similar frameworks)

Everything you write in Decision Dolls lives only on your device, under your control: you can view, edit, or delete it at any time directly in the app (including deleting individual journal entries, or uninstalling the app to remove everything). There is no external database of your content for us to export, correct, or delete, because none exists.

For the anonymous usage and crash data held by our analytics server and by Sentry, you have the full set of GDPR rights: to ask what we hold about you, to have it corrected, to have it deleted, to have us pause using it, to get a copy in a portable form, and to object to us using it at all. You can also withdraw consent wherever we've relied on it, without that affecting anything we did lawfully beforehand. And you have the most direct control of all: turn off "Anonymous diagnostics" in Settings and no further diagnostic data is sent, from that second onward.

Email us (see Contact) about access or erasure and we'll review your request; because this data is anonymized and isn't linked to your name, email, or any other identifiable information, we're often unable to locate the specific records tied to one person or one device, so we may not be able to fulfill an access or deletion request the way we could for account-based data - we'll explain what's possible either way. Liuto Apps is based in the Netherlands; if you're in the EU and unhappy with how we handle a request, you can complain to your local data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

No robots deciding things about you. Decision Dolls does no profiling and makes no automated decisions about you. The app helps you decide; it never scores, ranks, or categorises you, and nothing in the analytics feeds any such system.

California (CCPA/CPRA): we do not sell or share personal information, and we collect no sensitive personal information. California residents can use the same contact address for access or deletion requests, and we'll never give you a worse app for exercising any of these rights.

Changes to this policy

When Decision Dolls changes in a way that affects your data - as it did with the addition of the anonymous analytics described above - we update this policy first and describe clearly what changes and why. For anything that changes what leaves your device, we'll say so in the app too, not just here. Where required by law, we will ask for your consent before any new collection begins. The effective date at the top of this page always reflects the latest version.

Contact

Liuto Apps is the controller of the data described here - meaning we're the ones responsible for it, and the ones to come to with questions. We're small enough that we're not required to appoint a Data Protection Officer, and we haven't; privacy questions go straight to the person who wrote the app.

Questions about this privacy policy or Decision Dolls' data practices can be sent to: info@liuto-apps.com