We do not track you.
There is nothing
to opt out of.
This is the privacy policy for legitimateapps.com and for the iOS applications published by Legitimate LLC. The plain-English summary is first; the same commitments hold in the formal sections that follow.
In one paragraph.
We do not run analytics, attribution, or marketing pixels on this website. We do not embed third-party scripts other than Cloudflare Turnstile, which exists only to keep robots out of the contact form. There are no cookies set on this site. Most of our applications run entirely on your device and never talk to a server we operate. One of them — Command — is different by design: it keeps your plan on a server so the same plan can reach your phone, your iPad, and your Mac, which means it has accounts and it stores what you write. Where an application departs from the local-only baseline, we say so plainly in its own section below rather than burying it.
What this site collects.
When you load a page, our hosting infrastructure (Cloudflare and our origin server) records standard request metadata — IP address, page requested, user-agent string, timestamp — for the limited purpose of operating the site, defending against abuse, and meeting platform security requirements. These records are retained for no longer than thirty days and are not joined with any other data.
We do not set first-party cookies. We do not load Google Fonts, Google Analytics, Meta Pixel, Mixpanel, Segment, Amplitude, Hotjar, or any equivalent tool.
When you write to us.
The contact form sends your message to [email protected] over an authenticated SMTP connection. Before sending, the server validates a Cloudflare Turnstile token (used only to confirm you are a human) and computes a one-way SHA-256 hash of your email address. The hash is stored for seven days strictly to prevent the same person from submitting the form repeatedly within that window. The hash cannot be reversed to recover your email address.
The body of your message lives in our mailbox the same way any other email exists in any other inbox. We retain it as long as is reasonable to handle the matter you wrote about, and no longer.
What our applications collect.
Each Legitimate-published iOS application ships with a privacy nutrition label visible on the App Store before download. Every application we publish:
- does not include third-party analytics SDKs
- does not include advertising SDKs
- does not include attribution or fingerprinting SDKs
- does not sell your data, and never will
Beyond that, our applications are local-first by default: they do not require an account and they keep what you write on your device, optionally synced through your own iCloud. Command is the exception, because a plan you delegate has to reach other devices and other people. It requires an account and stores your content on a server we run. Its section below sets out exactly what that means; it is the one place where "it stays on your phone" is not the whole story, and we would rather say that here than let you discover it later.
Where an application offers an optional in-app purchase or subscription, the transaction is processed by Apple under Apple's terms; we receive only what Apple discloses to all developers. We never see your card.
Per-app notes — Command.
Command is a planner you delegate from, so unlike the rest of our applications it is not local-only. It has an account, and what you write is stored on a server we operate. We think that trade is worth being explicit about.
The account. You choose a username and a password. The password is never stored — we keep only a bcrypt hash of it, which cannot be turned back into your password. A session is stored as a hash of its token. We do not ask for your real name, your phone number, or your email address to use the app.
What is stored on the server. The things the app exists to hold: your notes, your goals, your assignments and their schedules, the people and AI models on your roster (whatever names you give them), your logged activity, and your conversations with the assistant. This lives in a SQLite database on a server we run, reached over HTTPS. Your data is scoped to your account; one account can never read another's.
Your voice does not leave the phone. Dictation is transcribed on-device — by NVIDIA Parakeet, by Apple's SpeechTranscriber, or by Apple's speech recognizer, depending on your device. We never receive audio. Only the text you keep is sent, and only because it is the note you asked us to store.
The assistant sends text to a third party. This is the most important sentence on this page. When you use the AI assistant, the content it needs — the notes, tasks, and messages relevant to your request — is sent through OpenRouter to the vendor of the model you picked, which processes it and returns a reply. That text leaves our server and is handled under their terms, not only ours. The assistant is off until you turn it on: the app asks for your consent first, and you can simply not use it. Items you have redacted are excluded from what the assistant is shown by default.
Which vendors, specifically. The model picker in the app decides who receives that text. Today the choices are Anthropic (Claude Opus, Sonnet, and Haiku), OpenAI (GPT), Z.ai (GLM), and Moonshot AI (Kimi). A model is sometimes served on its vendor's behalf by a cloud host — Amazon Bedrock, Google Cloud, or Microsoft Azure — in which case that host handles the text too. We instruct OpenRouter to route only to providers whose terms state they do not train on submitted prompts, and we do not sell your data or use it to train anything of our own.
Note titles use the same pathway. When you leave a note untitled, we ask a small model — Alibaba's Qwen, reached the same way through OpenRouter — for a two- or three-word title, sending it the beginning of the note. This runs only after you have given the consent described above. Decline, and your notes simply keep their first line as the title; nothing is sent.
Redaction is a veil, not encryption. A redacted note, task, or log entry is hidden behind an animated cover in the app and kept away from the assistant, and revealing it asks for Face ID or your passcode. Be clear about what that is and is not: it defends against someone glancing at your screen. It is not end-to-end encryption, and it does not hide the content from the server, which necessarily stores it to sync it.
Notifications. If you allow reminders, your device gives us an Apple push token, which we store so Apple can deliver a reminder to that device. The notification's text travels through Apple's push service.
The subscription. Assistant features require a subscription, sold through Apple. Apple processes the payment; we never see your card. Subscription status reaches us through RevenueCat, which tells us whether an anonymous identifier is entitled — not who you are or how you paid.
Access tokens. Command can also act as an MCP server, so a coding agent you run yourself can work with your own data. That uses a token tied to your account, and it reaches only your account. If you never use it, nothing is exposed by it; you can regenerate it at any time, which immediately invalidates the old one.
Command contains no analytics, advertising, attribution, or fingerprinting SDKs. We do not profile you, we do not build an advertising identity for you, and we do not sell or share your content with anyone beyond the processors named here.
Deleting it. You can delete your account from inside the app. Doing so removes your account and the content attached to it from the live database. Encrypted backups may retain a copy for up to thirty days before rotating out.
Per-app notes — SpeedRead.
SpeedRead is a local-first e-reader. Books you import (PDF, EPUB, RTF, TXT) are stored inside the app's iOS sandbox on your device and are not transmitted off it. Bookmarks, highlights, reading positions, and WPM preferences are likewise stored on-device using SwiftData and Apple's standard preferences storage.
If you pair an Apple Watch, SpeedRead can send a book and your reading position between your phone and your watch using Apple's WatchConnectivity framework. That communication is device-to-device over the encrypted channel Apple provides; it does not pass through any server we operate. The watch keeps its own small library file in its app sandbox.
SpeedRead does not require an account, does not collect device identifiers, does not display advertising, and does not contain third-party analytics, attribution, or crash-reporting SDKs. The application does not transmit your library, your reading positions, or the contents of any file you import to any server we operate. The App Store may collect aggregate, anonymous statistics about downloads and crashes under Apple's terms; we receive only what Apple discloses to all developers.
Third parties involved.
We use Cloudflare to terminate TLS at the edge, mitigate abuse, and route requests to our origin. Cloudflare's processing is governed by Cloudflare's own policies. We use Cloudflare Turnstile on the contact page; Turnstile is privacy-preserving by design and does not profile users across sites. Outbound mail is sent through the mailbox provider associated with our domain.
Your rights.
Because we collect almost nothing, there is little to give back, correct, or erase. If you have written to us via the contact form and you would like the correspondence deleted, write to us at the same address and we will delete it.
Children.
Our applications are not directed to children under 13. We do not knowingly collect information from children. If a parent or guardian believes their child has supplied us with information, they may write to us and we will remove it.
Changes.
If we change this policy, we will update the effective date at the top of this page and preserve a record of prior versions for at least one year. We will not retroactively apply broader collection to data we already hold under a stricter prior version.
Contact.
Privacy questions go to [email protected] or to Legitimate LLC, 8735 Dunwoody Place Ste N, Atlanta, GA 30350, USA.