Your information, explained.
App privacy policy.
This policy explains how the Doubtful app, iCloud sync, backups, App Store distribution and app support handle information. The developer is Aleksei Melnik, an individual in California, United States. Contact: hello@alekseimelnik.com. This policy covers the app and its related services, not browsing the marketing website.
Effective September 25, 2026. Last updated September 25, 2026.
1. Who is responsible and what this covers
“I” and “the developer” mean Aleksei Melnik. This policy distinguishes data stored on your device and in your private iCloud database from support messages and information Apple makes available to me. I am responsible for the processing whose purposes and means I determine; Apple and other service providers also have responsibilities for their own services.
Doubtful is intended for an international audience except France. This states the intended distribution scope; it does not confirm a technical block on access from France. It does not remove obligations in other EU countries or rights that apply to people who use the service.
2. What happens to your information
Your tasks and app settings are stored on your device. There is no separate Doubtful account. With iCloud sync enabled, task records are also stored in your private iCloud database. The app’s ordinary task workflow does not send task content to my website or a developer-operated server.
Task data includes titles, notes, subtasks and their completion and order, task states, priority inputs, templates, identifiers and related dates. Settings support preferences such as language, appearance and sync. You choose what to write; avoid including information you do not need for a task.
The app also stores achievement-view state locally: the date and time of the most recent view and the highest badge level viewed for that day. This is a single updated state, not a history of every visit. The app uses it only to determine whether to show the “New achievement” indicator. With iCloud sync enabled, this state is also synchronized as described below.
The current app has no third-party advertising or analytics SDK and does not send task content to a developer-operated server during ordinary use. Apple handles iCloud and App Store information under its own policies, and I receive information you choose to include in support messages and feedback.
3. iCloud sync and its switch
iCloud sync is on by default. When enabled and available, the app sends task records, including subtasks, states, priorities, templates, identifiers and dates, to the private CloudKit database associated with your Apple account. It uses these records to synchronize supported devices; this is not a public task database.
When iCloud sync is enabled and available, Doubtful saves achievement-view state in iCloud Key-Value Store, separately from task records in CloudKit. The timestamp and viewed badge level are synchronized through your iCloud account between devices using the same account so that the “New achievement” indicator reflects what you have already viewed. These values are not sent to the developer or a developer-operated server, and Doubtful does not use them for analytics, advertising or tracking. Apple provides the iCloud service under its own terms.
When sync is off, Doubtful records new achievement views locally and does not initiate writes or apply incoming changes for this state through its achievement-sync feature. Turning sync off does not delete a value already saved in iCloud or undo service work already started. When you turn sync on again, local and cloud states are merged and the result may be uploaded. For views on the same day, the latest time and highest viewed badge level are retained; for different days, the more recent state is retained.
Turning sync off leaves existing cloud records in place. A task first deleted while sync is off is deleted only locally: that action is not silently queued as a future cloud deletion. Turning sync back on can download and merge cloud records, so a task deleted only locally can return.
The app does not start new task-sync operations while sync is off. It cancels scheduled sync work where the API permits and uses session checks to prevent late results from a cancelled session being applied locally. An operation already accepted by the server cannot be undone retroactively. Cloud deletions recorded before switching off remain stored, are paused, and resume after sync is enabled for the corresponding Apple account.
Apple push notifications, the iCloud service change marker and the transfer of task content are different mechanisms. Push registration follows the sync switch, and app-initiated iCloud change-marker calls are guarded by sync settings. Already-started service work may still finish. The switch does not promise complete network isolation, disable Apple’s internal services or telemetry, or control the system’s analytics-sharing settings.
Apple processes iCloud service data under its own terms. This policy does not promise end-to-end encryption, that Apple cannot access any data, or a particular storage country. Cloud copies may remain until they are actually deleted through the relevant app or Apple service processes.
4. Deleting tasks and cloud copies
Moving a task to the app’s trash changes its state; it is not permanent deletion. Permanently deleting an item removes the corresponding task or user template locally. “Delete All Data” removes local tasks and user templates, but keeps app settings and does not delete exported files. With sync off, it performs local deletion only.
Deleting tasks or choosing “Delete All Data” does not clear achievement-view state from local settings or iCloud Key-Value Store. The app keeps the latest state between sessions and updates it when achievements are viewed or synchronized; it does not automatically erase it at the start of a new day. There is no separate in-app control to erase this state. The CloudKit task-deletion queue described below does not cover this separate KVS value. Contact support for questions about this data; this policy does not promise that the developer can directly erase it from your iCloud account.
With sync on, deletion requests cover only the CloudKit record identifiers known to the app on that device. For permanent deletion and “Delete All Data”, the app stores the intent to delete those cloud records before removing the local task or tasks. Unconfirmed requests are saved between restarts. Local removal and a pending cloud request are distinct from confirmed cloud deletion; Settings shows the number of pending cloud deletions.
Eligible pending deletions are retried when the app can run and sync, including after a restart, a return to the app or recovery from a network problem. Retries account for temporary errors, rate limits and CloudKit’s recommended delay. Results are handled per record: confirmed deletions leave the queue, an already-absent record counts as confirmed, and unconfirmed records remain for a later attempt. An unavailable account or a persistent permission or configuration error can require action before deletion succeeds; there is no promise of an immediate retry or completion while the app cannot run.
The deletion queue and service state are associated with the verified Apple account and CloudKit zone. A queue assigned to one account is not processed as another account’s queue. Requests recorded before an account can be identified wait for account association. While an identifier remains pending for the relevant account on this device, the app filters that identifier out of fetched tasks, subsequent uploads and both backup-import modes. An upload already accepted by the server is not retroactively cancelled. These checks are not complete protection against every race or later re-upload.
The app does not maintain a shared, permanent deletion record across all devices. A device that still holds a task or a later restoration can reintroduce content. The pending-deletion checks described here reduce that risk on this device but do not guarantee that a deleted task can never return.
Neither the single-item action nor “Delete All Data” guarantees a wipe of the entire private CloudKit database, zone or container, and they do not delete records unknown to the device. Exported files and other backups remain separate. Restoring can bring back previously deleted tasks; the pending-identifier filter is described in the next section.
I cannot directly delete records in your private database through my developer portal. You can contact hello@alekseimelnik.com for help with a deletion request or a task that reappears. Apple’s assistance may also be needed for data held by its services. Do not send your Apple account password.
These technical limitations do not restrict your rights under applicable law. Describing a failed deletion does not fix it or make an unfulfilled legal obligation acceptable. This policy does not promise physical secure erasure or complete removal of every cloud or backup copy.
Tasks completed before the current local calendar day move from Resolved to Trash at midnight while the app is active, or when it next starts or becomes active. This changes the task’s state; it does not permanently delete its content. With sync enabled, the change is sent to iCloud. These tasks remain in Trash until restored or permanently deleted. Restoring to an active section clears the completed-step checkmarks.
5. Exporting and restoring backups
Export and import use the system file picker. You can choose storage on your device or a connected cloud provider. That provider handles the file under its own terms. The exported file exists separately from the app; deleting tasks does not delete files saved, downloaded or shared elsewhere.
Backup files use AES-GCM with a shared key built into the app, not an individual password. Someone who obtains a file can open it in a compatible version of Doubtful. Do not treat a backup as accessible only to you; choose where to save or share it accordingly.
Before restoring, you choose whether to merge with or replace local tasks. Import can bring back previously deleted content, and imported tasks may be uploaded to iCloud when sync is on. Both modes skip an identifier that is still pending cloud deletion for the relevant account on this device. This is not a permanent list of all previously deleted tasks: after an identifier leaves the pending queue, a backup can restore it. Deleting an exported file and its provider-held copies is separate from deleting tasks in Doubtful.
A backup contains its format identifier, export date and tasks, including whether steps are required or optional. When reading a backup without the required-or-optional field, the app treats that step as required. The shared-key protection described above applies to exported backups.
The app’s task export does not include achievement-view state. Importing a task backup does not restore or clear that state. It is stored separately in local settings and, when sync is enabled, in iCloud Key-Value Store.
6. App Store and Apple diagnostics
Apple handles App Store downloads and updates under its own terms and privacy policy. Apple may make aggregated store information, such as download totals, available to me. This is separate from your task content and private iCloud records.
If your device’s analytics-sharing settings allow it, Apple may provide me with crash information and app-usage statistics, aggregated or in a form that does not personally identify you. Manage these choices in the device’s Settings under Privacy & Security → Analytics & Improvements; available options can vary by system and region.
I use diagnostic information available through Apple to investigate faults and improve the app’s reliability, not for advertising or tracking. Doubtful has no third-party analytics or advertising SDK. I keep any diagnostic copies I save from Apple only while needed to investigate and resolve the related issue, and delete them when they are no longer needed for that purpose. Apple controls the collection and retention of records in its services under the policies linked below. Diagnostic details or screenshots you choose to email are handled as support correspondence under the next section.
7. Messages you choose to send
If you email hello@alekseimelnik.com, I receive your sender address, name if supplied, message and attachments. Incoming mail is forwarded through Porkbun to my personal Gmail mailbox, not Google Workspace. I use it to respond and investigate your request. The app does not send these emails automatically.
I retain ordinary support correspondence for no more than 12 months after the request is closed and delete unnecessary attachments sooner. You can request earlier deletion. Only specific information needed for an identified legal obligation or to establish, exercise or defend a particular legal claim may be kept longer, for the necessary period and with the reason documented.
This retention rule covers received and sent messages and downloaded attachments and working copies under my control. Provider-held copies and backups follow the relevant provider’s processes and are not guaranteed to disappear immediately when I delete a message.
8. Recipients, purposes and legal bases
I use support messages to answer questions and investigate reported problems, and diagnostic information made available by Apple to investigate faults and improve Doubtful. Apple supplies iCloud, App Store distribution and system diagnostics. Porkbun forwards incoming support email and Google provides my personal Gmail mailbox. A file provider you select handles exported backups. Providers may also process data for their own service, security and legal purposes; their roles depend on the particular processing.
Where the GDPR applies, I rely on legitimate interests in responding to voluntary support requests and diagnosing and correcting app faults, only to the extent necessary and where your interests and rights do not override those interests. These purposes do not include advertising or profiling. Where processing is necessary to comply with a specific legal obligation, that obligation is the basis. You may object to processing based on legitimate interests by contacting me.
Where consent is required, it must be obtained separately and can be withdrawn; using the app or reading this policy does not itself provide consent. Apple’s legal basis for its services does not automatically establish mine. I use diagnostic information supplied by Apple for the purposes allowed by Apple and do not share it with third parties.
9. Your privacy rights and requests
Depending on the law that applies and its conditions, you may request access, correction, deletion, portability or restriction of processing, object to processing, and withdraw consent where processing relies on it. Withdrawal does not undo processing that was lawful before withdrawal. Not having a Doubtful account does not remove your rights.
Write to hello@alekseimelnik.com and explain the request. I can address information available to me, such as support messages and diagnostic records. Private iCloud records require the relevant app or Apple processes; I will explain that distinction and help identify the appropriate route rather than treating lack of direct access as an automatic refusal.
Identity checks should be proportionate to the request and use existing correspondence where possible. A passport or other identity document is not required by default. Do not send passwords or unrelated personal information.
Requests will be handled without undue delay within the applicable legal time limits. Under the GDPR, the usual period is one month after receipt; a lawful extension of up to two further months can apply to complex or numerous requests, with notice and reasons within the first month. Requests are generally free, subject to the law’s limited exceptions. Any refusal or restriction must be explained, including available complaint or review routes.
You may complain to the competent data-protection authority or seek an available judicial remedy. For GDPR matters, this can be the supervisory authority where you habitually live or work, or where the alleged infringement occurred. California residents may use applicable state complaint routes; living in California does not by itself make the CCPA apply to this developer.
10. International processing
I am based in California, United States, where I handle app support and diagnostic information available to me. Apple and the email services described above operate internationally, so processing may occur outside your country. This policy does not promise that all information remains in the United States or the European Union. Task content is stored on your device and, with sync enabled, in your private iCloud database; it is not routed through the marketing website’s server.
Apple, Porkbun and Google describe their own international processing in their privacy information linked below. Those statements apply to their services and are not a claim that I hold particular transfer certifications or contracts. You can contact hello@alekseimelnik.com about recipients, international processing and any safeguards applicable to your information. This policy is not consent to unrestricted transfers and does not remove protections required by applicable law.
11. Children and family use
Doubtful is a general-purpose task tracker suitable for different ages. This policy does not introduce a 13+, 16+ or 18+ age limit. I do not intentionally collect children’s personal information, and ordinary app use does not send me the content of anyone’s tasks, including children’s tasks.
Voluntary support messages, feedback and diagnostic information are separate from task storage. They can contain personal information, and I cannot assume the age of everyone who contacts me. I therefore do not promise that these channels can never include a child’s information.
If I learn that support or diagnostic records contain a child’s personal information, I will review the situation and take the steps required by applicable law, including deletion where required. A parent or guardian can contact hello@alekseimelnik.com to raise a concern or request access or deletion, subject to proportionate verification. I will not treat a child’s use of the app as a substitute for parental notice or consent where legally required.
12. Security, changes and contact
The app uses Apple’s private CloudKit database and system file-access controls. Local tasks do not have separate user-specific encryption added by Doubtful; this does not mean that iOS provides no system protection. The shared-key limitation of exported backups is explained above. No method guarantees absolute security.
Settings includes a Privacy Policy link selected by the app’s language: English, Russian or Spanish. It is available without iCloud and opens only when you choose it. The URL contains no task content, device identifiers or tracking parameters.
The effective and update dates appear at the top of this policy. Material changes will be described in a prominent notice on the Doubtful website and, where appropriate, in release notes. I cannot promise an email to every user because ordinary app use does not provide everyone’s email address. If new processing requires consent or another legal step, continued use alone does not replace it.
For privacy questions or requests, contact Aleksei Melnik at hello@alekseimelnik.com. This policy does not waive mandatory rights, add arbitration terms or exclude liability for a technical defect. Its translations are intended to provide equivalent information; no language version overrides protections under applicable law.