Privacy

Last updated: October 12, 2026 · Product preview

NotiBuddy is provided by Yourbit, LLC. It connects paired AI assistants, apps, and services to your iPhone. This notice describes the current implementation, including the information needed to deliver messages and recover interrupted exchanges.

Your questions and replies are encrypted

The paired sender encrypts question text, choices, form content, and activity details before sending them to the delivery service. Your iPhone decrypts that content. Replies are encrypted for that sender. The delivery service does not have the private keys needed to read that message content.

Before connection, the app asks permission for relay delivery and reply sharing. New computers require approval in Connect. You can pause sharing on one phone in Settings or disconnect a computer in Connect. Requests marked sensitive, including those requiring authentication, use private notification and Live Activity previews. You can hide all content previews in Settings.

A connected AI app or service is a participant in the conversation: it creates the requests and can read the replies addressed to it. If you connect a hosted service, that service handles your messages under its own privacy policy. Encryption protects message content from the NotiBuddy relay; it does not hide it from the sender you paired.

Encrypted messages are stored on the service so requests and replies can survive connection interruptions. Encryption does not hide all delivery information: the service can see identifiers, request types, timestamps, expiration times, and delivery state.

Files you choose to share

You can send one file up to 10 MB to a connection whose receiving key you have approved. The phone encrypts the file, filename and file type for that connection before uploading. The relay sees the file size, connection identifiers, timestamps and delivery state, but cannot read the file or its name. Apps using the receiving connection can read the saved file; a connected AI provider may process it under its own policy.

The relay stops downloads after confirmed delivery, cancellation, revocation or a 24-hour deadline, and actively deletes the encrypted copy. Delivery is confirmed only after the receiver verifies, decrypts and saves it. Storage failures can delay physical deletion; a durable cleanup queue retries failed deletions, including after account deletion. Minimal file status records can remain until the original deadline plus a day. Cancelling cannot recall a copy already saved by the receiver.

What the service stores

• Encrypted content: requests, replies, activity-control messages, and user-selected files.
• Connection records: a paired account identifier, device and sender identifiers, public keys, sender labels, pairing-verification records, and Apple push notification tokens.
• Delivery and usage records: request identifiers, timestamps, expiration times, activity routing, device allowances, and request counts used to enforce the free limit.
• Purchase records: verified Apple transaction information, product and account identifiers, subscription status, expiry or revocation information, and paid phone-slot records when purchases are enabled. The phone supplies Apple’s device verification identifier to verify that its signed purchase belongs to that device. The service stores a purchase-specific cryptographic hash for slot allocation, not that raw identifier.

Pairing does not ask for your name, email address, phone number, or location. The website and app do not include advertising or third-party analytics SDKs. Apple handles payment details; NotiBuddy does not receive your card number.

How long information stays

The relay schedules deletion of expired requests and their associated replies and events after a 10-minute retention window. Completing a question does not immediately erase its stored record. Activity-routing records can remain for an hour after activity expiry, and usage records cover a rolling 24-hour window. Cleanup runs in the background.

Device registrations, sender records and pairing-verification records remain until you delete the account, independently of request expiry. Deletion removes that account’s paid phone-slot association. A separate minimal purchase ledger retains product, verification dates, expiry/refund status and active slot associations to enforce device allowances and restore paid access. After all associated accounts are removed, no device keys, account identifiers, device-verification hashes, message data or full receipts remain in that purchase ledger. Its purchase status persists while the service supports restoration, including lifetime purchases, so deletion cannot reset a refund or duplicate a paid allowance.

What stays on your devices

The iPhone stores credentials in Keychain and keeps local session and response records to support retries and recovery. Device signing uses the Secure Enclave when available, with a software-key fallback. The encryption key is stored in Keychain; not every key lives inside the Secure Enclave.

Recent requests on the iPhone keep up to 100 read-only receipts for 24 hours, including short request summaries and text replies. Form receipts record that a form was submitted, without keeping its field values in recent history. Expired receipts are removed during the next session refresh. The session storage is excluded from device backups. Use Sessions → Clear Recent to remove these receipts sooner; this does not erase records on the relay or the sender.

A replacement phone creates new keys and requires fresh computer pairing. Restore Purchases can restore paid access after Apple verifies the purchase, without restoring old messages or deleted accounts. There are no user-managed recovery codes.

The paired computer stores configuration, sender keys, file-receiving keys, pending-reply keys, and received files in its local NotiBuddy directory. Received files remain until you delete them. The phone stages encrypted uploads and small local file-name/status records in storage protected by iOS and excluded from backup; transfer records are pruned when viewed after their expiry and retention window. Your AI app may also retain the questions and answers in its conversation history under its own settings and privacy policy.

Apple and Cloudflare

Cloudflare hosts the website and delivery service, including storage of encrypted messages and connection records. Apple delivers push notifications and processes purchases. These providers may process network, security, and delivery information to operate their services. Their handling of provider logs is governed by their own policies.

Read Cloudflare’s privacy policy and Apple’s privacy policy.

Your controls and deletion

Connect → a connection → Disconnect revokes that sender identity and cancels its pending work. Keep your original pairing bundle private: disconnecting a sender key alone does not invalidate every copy of that bundle.

You can disable notifications in iPhone Settings and remove the NotiBuddy MCP connection from your AI app to stop that integration from sending new requests. These actions do not delete the service’s connection or purchase records.

Settings → Delete account removes the account’s active relay records, including devices, senders, encrypted requests and replies, usage, local purchase records and that account’s paid-slot association. The separate minimal purchase ledger described above remains for restoration and refund enforcement. It clears this phone’s credentials, saved requests, and notifications, and prevents its old connections from being used again. A failed file deletion can retain an opaque object identifier in a cleanup queue until deletion succeeds. A minimal marker remains in the account’s opaque routing location to reject old credentials and late events; it contains no message content, device keys, purchase record, or contact details. Cloudflare’s recovery backups may retain deleted data for up to 30 days. If deletion is interrupted, connections pause and Settings lets you retry.

Deleting the account does not cancel an Apple subscription, erase Apple’s transaction records, or remove files on your computer or history in your connected AI app. Manage subscriptions in Settings, remove the computer’s NotiBuddy configuration, and use the connected service’s history/deletion controls separately. Any phones sharing that exact connection lose its relay access and remove their local account data when they next check the service. Other phones with separate connections using the same Apple purchase keep their own accounts. Deleting the iPhone app alone does not delete relay records and may leave Keychain items behind.

Privacy questions

For privacy questions or a deletion request, contact contact@notibuddy.app. Do not send pairing bundles, private keys, or message content.