Privacy policy

The short version

Dumper is local-first. Your tasks, notes, journals, habits, brain dumps and settings live in the app on your device, and nothing leaves it unless you ask it to. If you create an account, a copy of your content is stored so your devices stay in sync, and the AI composer sends the text you explicitly choose to a language model. We do not sell your data, and we do not run advertising or tracking networks in the app or on this website.

Who we are

Dumper is developed and operated by Ibrahim Turan (hello@ibrahimturan.com), whose postal address is the one listed in the developer contact details on the Google Play listing. This policy covers the Dumper mobile and desktop apps and the website at dumperapp.com. "We", "us" and "our" mean Ibrahim Turan.

What we collect

What we receive depends on which parts of Dumper you use.

• Data that stays on your device.Your content — tasks, notes, brain dumps, journal entries, habits, bookmarks, reminders and app settings — is stored in the app's own database on your device. We never see it, and it is not uploaded anywhere, unless you turn on cloud sync.
• Account data.If you create a Dumper account, we store the email address you verify, your first and last name and, if you add them to your profile, a postal address. Accounts sign in with a six-digit code sent to your email — we do not store passwords. Your email is used to identify the account, to deliver sign-in codes, and for essential service emails only; we do not send marketing email.
• Synced content.If you subscribe to Premium and enable cloud sync, the content you chose to sync — the same kinds of data listed above — is stored on our servers so your devices can share it, along with the files you attach. Sync records carry an anonymous device identifier and a change version so each device knows what it has already received.
• AI composer content.The AI composer is optional and Premium-gated. When you use it, the text you explicitly hand it — for example a brain dump you asked to be turned into tasks — is sent to our service, which forwards it to a third-party language model provider and returns the result. Content you did not send to the composer is not sent to the model.
• Technical and usage data.Our servers keep the minimum needed to run the service: the session token that authenticates a request, the subscription state attached to your account, the IP address of a request when it is rate-limiting or blocking abuse, and standard short-lived request logs that our hosting provider (Cloudflare) keeps for security.
• Website data.The website stores your sign-in session in a secure, httpOnly cookie, and remembers your light/dark theme and accent colour in your browser's local storage. It uses no advertising or analytics cookies. Pages load their typefaces from Google Fonts, which sees the request when a page is loaded.

App permissions

• Internet — used for account sign-in, cloud sync, attachments and the AI composer, and only when those features are used.
• Notifications — used to show the reminders you schedule in the app. Notifications are delivered locally on your device; we do not send you push notifications.

How we use data

We use what we collect to: run your account and keep it secure; deliver sign-in codes; sync and back up your content when Premium sync is on; process AI-composer requests you send; maintain your subscription; rate-limit and prevent abuse; and reply to you when you contact us. We do not use your content to advertise to you, and we do not sell or rent personal data to anyone.

Who data is shared with

We share data only with the providers that operate the service, and only as needed to run it:

• Cloudflare — hosts the website and the sync, account and AI services (including the database and storage that hold account records, synced content and attachments).
• Resend — delivers sign-in codes and other service emails on our behalf. It receives the email address a code is sent to and nothing else.
• AI model provider — processes the text you send through the AI composer, through an intermediary gateway, to return the completion you asked for.
• Google — if you buy Premium through Google Play, Google processes the payment under its own terms; we learn that an active purchase exists but never see your card details. Google Fonts serves the typefaces used by the website.

We may also disclose data where the law requires it, or to protect the rights, property or safety of our users or others, and if the service is ever transferred to a new owner, account data would move with it under this same policy.

Retention and deletion

Content stored only on your device stays there until you delete it. Deleting the app deletes it permanently. If you delete a synced item, it is removed from the sync store for all of your devices.

You can delete your account at any time — the account page in the app or on the website, or an email to hello@ibrahimturan.com, both reach us; thedelete-account pageexplains what that removes. Deleting your account removes your account record, sessions and synced content and attachments from our servers, normally within a few days and no later than 30 days. Backups may retain data for up to 30 days further before they age out. Sign-in codes and challenge records expire on their own within minutes to hours; request logs age out within weeks.

Security

Data travels over TLS. Sessions are random tokens stored server-side, the website keeps its session cookie httpOnly, and sign-in codes are short-lived and single-use. Synced attachments are stored under identifiers derived from your account, not in public buckets. No service is perfectly secure, so please also protect your devices and email account — they are the keys to your data.

Children

Dumper is a general-audience productivity app and is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has created an account, contact us athello@ibrahimturan.com and we will remove it.

Your rights

Depending on where you live — for example under the EU/UK GDPR, Swiss law, or California's privacy laws — you may have rights to access, correct, export, restrict or delete your personal data, and to object to certain processing. The account page lets you view and edit your profile and subscription, and account deletion is always available; for anything else, email hello@ibrahimturan.com and we will help. We do not discriminate against you for exercising these rights.

International transfers

Our providers process data in data centres in various regions, including the United States. Where required, we rely on recognised transfer mechanisms such as the European Commission's standard contractual clauses with our providers.

Changes to this policy

We will update this page as Dumper and the law change, and change the "last updated" date above. If a change meaningfully reduces what we do with your data or how you control it, we will tell you in the app or by email before it takes effect.

Contact

Questions, requests or reports about this policy:hello@ibrahimturan.com