On your device, and nowhere else.
Your words, your sessions, your settings live in your browser. By default, nothing is sent to us. Not your words. Not your patterns. Not an account, because there isn't one.
This reads your actual on-device storage as you look at it. Export writes it to a file you keep. Delete clears it from this device and asks our server to purge anything tied to it, though with no account there is little to key on.
Don't take our word for it. Check it yourself →
How this compares
Most of the industry shows more privacy than it practices. We practice more than we show. Here is the difference, in plain terms.
| A typical wellness app | Dodecave | |
|---|---|---|
| Account required | Usually yes (email, sometimes more) | None for the core; membership uses a passwordless passkey, no email, no password |
| Collected by default | Device id, usage, mood logs | Nothing you do is sent to us; your words and patterns stay in your browser |
| Third-party trackers | Commonly present | None |
| Data sold or shared | Sometimes, per their own policy | Nothing is collected, so there is nothing to sell or share |
| Cookie-consent wall | Usually | None; analytics are opt-in and off unless you turn them on |
| Can you verify it? | Trust the policy | Watch the network tab; read the policy that lets the code send nothing |
Two honest edges, because under-claiming beats over-claiming. (1) When the app loads, your browser does fetch static files from us (the word library, the voices, the audio), the same way any website serves its pages; that request carries no words, patterns, or account, only which file you asked for. (2) Features you choose to use, membership sign-in or the optional analytics, do talk to dodecave.com; none of them ever talk to anyone else.
Verify it yourself
You do not have to believe a privacy page. You can watch what the app actually does.
- Watch the network. Open your browser's developer tools, go to the Network tab, and
use Dodecave normally without turning analytics on. Nothing you type or do leaves your device. The only
requests you will see are the app fetching its own files from
dodecave.com. - Read the rule that lets the code send nothing. Our Content-Security-Policy sets
connect-src 'self'. In plain terms: the browser will only let this app talk back tododecave.com, and nowhere else. We cannot collect through a channel the code is not allowed to open. You can read this header in the same Network tab, on the document response.
A signed build manifest, so a third party can confirm the running app matches an audited build, is a planned next step, not a claim we are making today.
Read the full Privacy Policy → · Security & verification
Dodecave™ · this page shows what is already true; it adds no new data collection.