Privacy

Effective September 6, 2026

What is collected

To create a Ditty, the service receives your short message, optional sender name, selected feeling, selected English, Spanish, or instrumental route, selected expiry, a one-time anti-abuse token, and coarse request information needed for rate limiting. If you explicitly choose Hear hint, the service receives the visible message, one bounded pronunciation rule, selected feeling and English or Spanish route, a random browser attempt ID, and an anonymous browser identifier long enough to validate the phrase and apply separate abuse limits; it sends only the short spoken phrase to the selected voice. The retry record stores only salted attempt, request-fingerprint, browser, and network hashes, state, timestamps, and an unrelated opaque audio key—not the message or hint text. The phrase check creates no Ditty, private link, recovery record, or activity record. The live recipient preview, local route suggestion, Help me write fields, correction relationship, revision labels, send-readiness state, and QR card do not create separate server records. A recipient reaction or report category is stored when submitted, subject to network and per-note abuse limits. A reply may store the hash of its active parent link.

How private content is stored

Message text and sender name are encrypted before being stored. Share and deletion tokens use hashes for lookup, and a reply relationship stores only the parent share-token hash. The synthetic voice file is stored under an unrelated opaque key.

Retention

A Ditty and its voice file expire after the creator-selected one-, three-, or seven-day period. Deleting a Ditty removes the stored content sooner. Successful pronunciation-check audio is retained under an opaque key for no more than five minutes so a dropped response can be replayed safely; its hashed attempt record expires by the daily reset. Failed provider or storage attempts release that record. Short-lived salted rate-limit records and report records may remain as needed to prevent abuse. A report does not promise human review, global removal, or a response.

Providers

Cloudflare hosts the site, database, anti-abuse check, and the explicitly selected English or Spanish voice inference, including an explicit short pronunciation phrase check. Instrumental only skips voice inference. Pronunciation-check audio is returned privately and may be held under an opaque key for no more than five minutes solely to replay the same dropped response; it is not stored as a Ditty or exposed to recipients. The browser creates the final instrumental mix, local recipient preview, route suggestion, editable helper draft, QR image, and printable generic card locally. When you explicitly use a supported system share sheet, the browser may hand the locally created WAV and generic private-link invitation directly to the chosen app; Ditty does not upload that final WAV or QR card again. Ditty does not send your message to advertising networks and does not install third-party analytics on private listening pages.

Logs and analytics

Application code does not intentionally log message text, names, private share tokens, deletion tokens, or anti-abuse tokens. Ditty does not record delivery, opens, reads, listens, or playback completion. Share-sheet completion and reply attachment are not treated as recipient activity. Aggregate infrastructure logs may contain standard request metadata for security and reliability.

Your controls

Use Delete on the creator result to remove a Ditty. New message with the same settings, Make another like this, and Start fresh change only the local composer and do not delete the existing link. Edit words & make another may hold the earlier share token, expiry, a random local revision-group ID, and a bounded revision index in the current browser session; it does not duplicate the management key or private words there. Up to three local recovery records may keep opaque share/delete keys, feeling, voice state, voice route, expiry choice, expiry time, and the content-free revision group/index on this device; they do not store message, sender, pronunciation text, lyrics, title, audio, activity, or send-readiness state. The current-page readiness check is not recipient tracking. Forgetting that local list does not delete active links. Use Hide & report on a received Ditty for privacy, harassment, hate, sexual-safety, or spam concerns. Only a browser holding the independent creator-management key can explicitly check aggregate reactions and generic reply links or delete an earlier corrected link. Reply handoff uses a browser URL fragment that is validated and removed before creation; the parent token is not retained in draft or recovery storage. Because there is no account, the separate management token is the proof that you control a creation.

Daily service totals

Ditty keeps first-party daily totals of server-admitted creations, saved voice or instrumental results, failures after admission, prepared pronunciation checks, and attached replies. Each entry contains only a UTC date, a fixed event name, and a count. It contains no message, name, private URL or token, IP address, browser identifier, or session identifier. These totals use no browser beacon, cookie, or third-party analytics. They do not record reads, plays, opens, correction history, or delivery. Existing anti-abuse identifiers are separate and are never copied into these totals.

These best-effort totals may miss events during an outage and are not a record of individual users. They are retained for the current UTC date and the previous 30 dates, with daily bounded cleanup. Deleting a Ditty revokes its private access; it does not subtract from an unlinked service total.

Reading without audio

Read message instead reveals the encrypted message only after the recipient explicitly chooses it. The choice is handled in the recipient browser and is not stored as an open, read, listen, or completion event. If audio preparation fails after an intentional action, the browser may show the readable words as a recovery path.

Recovery when browser storage is unavailable

When browser storage is blocked or full, the current page can keep at most three opaque recovery records in memory. Recovery and deletion controls may be lost on reload or tab close, and a visible warning explains that limitation. A temporary failed restore does not remove a saved management key; a confirmed unavailable response or your explicit deletion can remove it. Retry identity uses a same-tab digest of the submitted input, not an additional copy of the text, and is cleared after a confirmed result. Already downloaded or shared audio copies are controlled by their recipients and cannot be recalled by link expiry or deletion.

International use

The service is operated online and may process data in locations where Cloudflare provides its services. Do not submit highly sensitive information.