On your device, and nowhere else.
Your words, your sessions, your settings live in your browser. By default, nothing is sent to us. Not your words. Not your patterns. Not an account. The free core doesn't create one.
This reads your actual on-device storage as you look at it. Export writes it to a file you keep. Delete clears it from this device.
Don't take our word for it. Check it yourself →
How this compares
Many wellness apps require an account and collect usage by default. Dodecave's free core is built differently. Here is the difference, in plain terms.
| A typical wellness app | Dodecave | |
|---|---|---|
| Account required | Usually yes (email, sometimes more) | None for the free core. Membership uses a minimal account you restore with a passkey (no password); passwordless email sign-in is coming |
| Collected by default | Device id, usage, mood logs | Your words and patterns stay in your browser; the only thing kept is a minimal record that you accepted the Terms (see note 3) |
| Third-party trackers | Commonly present | None |
| Data sold or shared | Sometimes, per their own policy | We don't sell or share your data; the free core keeps only the record that you accepted the Terms, and membership details only run your membership |
| Cookie-consent wall | Usually | None; analytics are opt-in and off unless you turn them on |
| Can you verify it? | Trust the policy | Watch the network tab; read the policy that lets the code send nothing |
Three honest edges, because under-claiming beats over-claiming. (1) When the app loads, your browser does fetch static files from us (the word library, the voices, the audio), the same way any website serves its pages; that request carries no words, patterns, or account, only which file you asked for. (2) The app itself never sends your words or practice data to anyone. The feature you choose to use that reaches a named processor is payment, completed through Stripe. When passwordless email sign-in ships, its email will be delivered through Scaleway, as the Privacy Policy describes. (3) When you accept the Terms, we keep a minimal record that you agreed, using the same hashed IP as analytics (never your raw IP) and your browser type, never your words or practice; it is our proof of the agreement, described in the Privacy Policy (§2.11). The optional analytics, if you turn them on, go only to dodecave.com.
Verify it yourself
You do not have to believe a privacy page. You can watch what the app actually does.
- Watch the network. Open your browser's developer tools, go to the Network tab, and
use Dodecave normally without turning analytics on. Nothing you type or do leaves your device. The only
requests you will see are the app fetching its own files from
dodecave.com. - Read the rule that lets the code send nothing. Our Content-Security-Policy sets
connect-src 'self'. In plain terms: the browser will only let this app talk back tododecave.com, and nowhere else. We cannot collect through a channel the code is not allowed to open. You can read this header in the same Network tab, on the document response.
A signed build manifest, so a third party can confirm the running app matches an audited build, is a planned next step, not a claim we are making today.
Read the full Privacy Policy → · Security & verification
Dodecave™ · this page shows what is already true; it adds no new data collection.