Privacy

Ditto for iPhone (an iMessage app) · Effective October 24, 2026

The short version. Ditto has no accounts, ads, analytics or tracking. Your photo goes to our server only so that the one person who answers your ditto can see it, and only after you've both added yours. It's deleted on a short schedule. We never see your messages, contacts or phone number, and we never sell or share your data.

Who we are

Ditto is made by Round Trip Studios, an independent app studio in the United States. In this policy, "we" means Round Trip Studios. You can reach us at dittoapp@proton.me.

How Ditto works

Ditto lives inside Apple's Messages app. You pick a prompt, add a photo and send a ditto to a chat. The message bubble carries the prompt, the ditto's state and a random answer key. It travels through Apple's Messages service like any other message, so we can't read it. Your friend adds their photo, and then both photos are shown to both of you at the same time.

Photos

• Before a photo leaves your phone, Ditto re-encodes it. That removes location and camera details.
• The photo is uploaded to Ditto's server, which runs on Supabase, our hosting provider, and is stored in private storage. It is never public and never shown in any feed.
• Only the two people in a ditto can get its photos, and only once both photos are in. To answer a ditto you need the answer key that exists only inside that Messages bubble. Photos are delivered over short-lived links that expire after two minutes.
• We don't use your photos for advertising, profiling or training AI, and we don't look at them, except to handle a report (see "Reports" below).

How long we keep things

• A ditto nobody answers expires after 48 hours, and its photo is deleted within about an hour after that.
• After both photos are in, the pair is deleted after 7 days.
• If you unsend a ditto before anyone answers, it's deleted right away.
• You can delete a pair at any time, or use "Delete everything I've sent" in Ditto's Safety & privacy screen.
• If a ditto is reported, we keep it until we've reviewed the report, then delete it. We may keep it longer if the law requires (see below).

Identifiers

Ditto doesn't ask for your name, email, phone number or Apple Account. To prove which photos are yours, the app creates a random secret that stays on your phone (in the Keychain) and sends only one-way scrambled versions of it (hashes) with each ditto. We can't use these to identify you, and they aren't shared with anyone.

One of those scrambled values is the same for every ditto from your phone (a device tag), and our server scrambles it again before storing it. We use it for two things only: to limit how many dittos one phone can send in an hour or a day, and to turn Ditto off on a phone that broke the community rules. It isn't linked to your name, number or Apple Account, and it's deleted with your dittos unless that phone is banned.

Age

Ditto is for ages 13 and up. It uses Apple's Declared Age Range feature to ask whether you're 13 or older. Apple tells the app only an age range, never a birthday. That answer is kept on your phone and isn't sent to us. If we learn that we have photos from someone under 13, we delete them.

Sensitive photos

Ditto uses Apple's Sensitive Content Analysis, which runs entirely on your phone, to stop nude photos from being sent and to cover incoming photos that might be sensitive. It works when Communication Safety or Sensitive Content Warning is turned on. Apple turns Communication Safety on by default for ages 13 to 17. The check happens on your device, and its results are never sent to us.

Reports

You can report any ditto, even without answering it. A report sends us the ditto's ID, whether you sent it, answered it or received it, and the reason you picked. A person reviews every report within 24 hours and may look at the photos in that ditto to decide what to do. If it broke the community rules, we delete it and keep the sending phone's scrambled device tag on a ban list so Ditto stays off on that phone. As US law requires, we report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC), and we keep the related material only as long as the law requires.

On your phone only

Your blocked list, the dittos you've hidden, your drafts and which reveals you've already seen are stored only in Ditto's storage on your phone. Deleting Ditto deletes them.

What we don't do

• No ads and no ad networks, and no analytics or tracking SDKs.
• No access to your contacts, location or microphone, and no reading of your other messages.
• No selling or sharing of your data. The only other companies involved are Apple (Messages and the App Store) and Supabase (our server host), each for running the service.

Security

Everything travels over encrypted HTTPS connections. Photos are stored privately and can be reached only through Ditto's server checks. Answer keys and phone secrets are stored only as hashes. Like most services, our host keeps short-lived technical logs (such as IP addresses and request times) for security and reliability. We don't use them to identify anyone.

Your choices

You can pass on any ditto, unsend before an answer, delete a pair, block someone, or delete everything you've sent, all inside the app. You can also email us to ask about or delete anything related to your phone's dittos. Depending on where you live, you may have more rights, such as access or deletion; email us and we'll help.

Changes and contact

If this policy changes, we'll update this page and its date, and explain big changes in the app. Questions: dittoapp@proton.me.

This website

This site sets no cookies and loads no analytics, ads, or third-party fonts or scripts. Our web host may keep standard server logs for security.