Maitland Privacy Policy

Effective date: October 10, 2026

Maitland Desk LLC (“Maitland,” “we” or “us”) is a New York limited liability company, c/o Registered Agents Inc., 418 Broadway, Ste R, Albany, NY 12207. You can reach us at support@maitland.app. Maitland is offered only in the United States, and our server is in the United States.

The short version

Maitland is a personal to-do list, planner and notebook. What you write is encrypted on your device before it reaches our server, with a key we do not hold. We store it, but we cannot read what it says. Maitland collects analytics: content-free error reports, and counts made from our own server records, such as how many accounts used the app this week. None of it includes what you write. We do not run advertising or tracking.

Nothing you write is sent to an AI company. Sorting happens on your own device: on the iPhone, with Maitland’s own rules and Apple’s on-device model; on the web, with the same rules in your browser.

The Security Page at maitland.app/security explains how the encryption works and what it does not protect.

What we collect, and why

Your account. We store your email address. If you use Sign in with Apple, we also store the identifier Apple gives us, and the app asks Apple for your email address. Apple lets you share your own address or a private relay address that forwards to it, and we keep whichever one Apple gives us so that we can write to you. We use these to sign you in and to know which files are yours. If you use a password, we do not receive the password itself. Your device converts it into a separate sign-in value, and we store a scrambled form of that value. For an account made before September 7, 2026, we also hold a scrambled form of the old password until it is reset. We also store a locked copy of your encryption key. Only your password can unlock it, and we cannot.

What you write. Your tasks, pages, notebooks, documents and settings are stored on our server in encrypted form. We cannot see what any file says. We can see each file’s name, its size and when it last changed, how many files there are, and the IDs of items you have deleted. Most names show only when something was made: a task or a page is named for its date and random characters, and handwriting and hand corrections to the app’s sorting are named for their page or the moment they were made. A document, letter or request keeps its own filename, and a web page you keep is named after its title. Your settings, list names, labels and contacts are inside one encrypted file.

Sign-in sessions. When you sign in on the web, we keep a record so that you stay signed in. The record holds a scrambled form of your session token, the account it belongs to, whether you chose to stay signed in, and when it expires. The sign-in page has one checkbox, “Keep this browser signed in,” which is off unless you tick it. If you leave it unticked, your sign-in ends when you close your browser; while the browser stays open, the session lasts 30 days from your last visit. If you tick it, you stay signed in for 90 days, and the 90 days start again each time you open the web app. The web app sets cookies only to sign you in.

Sync notices. If you use the iPhone app, Apple gives us a token that lets us send your phone a silent notice that there is something new to sync. The notice carries none of your words and shows nothing on your screen. It is separate from the reminders described below, which never involve our server. We store the token.

Reminders. If you ask for a reminder on a task, your iPhone schedules it and shows it. The reminder is never sent to us or through our server, and we do not know that you set one. The app asks for permission to show notifications the first time you ask for a reminder. A reminder shows the words of your task, and it can appear on your lock screen. Your iPhone’s notification settings control that.

The AI assistant. The AI assistant does not look into cards or answer questions at present, and nothing you write is sent to Anthropic or to any other AI company. If we offer that again, we will update this policy first, and the app will tell you before the first time any of your words are sent.

Tasks you send to another user. When you send a task to a contact, your device encrypts it so that only the recipient’s devices can open it. Our server holds the encrypted task, with which account sent it, which account it is for and when, until the recipient’s app collects it, and erases it 30 days later except its ID. We cannot read the task. The copy on the recipient’s devices is theirs, and it stays even if you delete your account.

People you block. If you block someone from sending you tasks, our server keeps a list of the accounts you have blocked so that it can turn their tasks away. The list holds account IDs only, up to 1,000 of them. It is stored with your account record and is not encrypted, because our server has to read it.

Accepting the Terms. When you accept the Terms of Use and this policy, we record which version of each you accepted and when. We do not record your IP address or your device with it.

Server logs. The web server in front of our application records each request’s IP address, time, address requested, result and browser or app identifier, with credentials, account IDs and file names removed. Error reports are not logged. Our application writes errors and account events, such as sign-ups, deletions and subscription changes, to the server’s system log, sometimes with an account or item ID, and holds recent IP addresses in memory to stop abuse. We use these records to keep the Service running and to stop abuse, and we delete the logs after 30 days.

Error reports. When the app shows you a failure, such as a change that could not be saved or a sync that did not finish, it sends our server an error report. A report contains only the kind of failure, chosen from a fixed list; the platform (iPhone or web); the app’s version and build number; and the date. It never contains your words or any other content, the name of a file or item, your account, your email address, a device identifier, the time of day, or the text of the error itself. It carries no sign-in cookie or sync key, and our application does not link it to you or to your account. The app sends each kind of report at most once a day. Our server does not keep the reports themselves: it adds each one to a count of how many times that kind of failure was reported that day, for that platform and version, and keeps only those counts. Reports are not shown to you, and the app works the same whether or not one is sent.

Email you send us. If you write to support@maitland.app, we keep the correspondence so that we can answer you. It is received through Apple’s iCloud Mail and our email delivery service. Settings → General → “Write to the developer” in the app opens a new, empty email to that address in your own mail app. Reporting a sender opens an email that includes the task’s words and the sender’s account ID. Nothing is sent unless you send it.

Email we send you. We send email to your account address when there is a reason to: the code for creating your account, the code for resetting your password, and other messages about your account. An email delivery service sends these for us. It receives your address and each message, and it keeps copies of the messages it sends for a period set by its own policies.

Subscriptions. Subscriptions are sold in the iPhone app, and Apple takes the payment. We never receive your card number, your other payment details or your Apple ID. Each account has a random code that the app gives Apple when you buy, so that the purchase can be matched to your account. It tells Apple nothing else about you. After a purchase, the app sends our server the purchase’s transaction number, and our server asks Apple about it directly. For your account we keep your plan and the date it ends, which subscription you bought, whether it came to you through Family Sharing, Apple’s number for the original purchase (up to ten, if you have bought more than once), whether the purchase was made in Apple’s live store or its test system, and when we last asked Apple. Each night our server asks Apple about subscriptions again, and Apple sends our server a notice when a subscription changes, for example when it renews, lapses or is refunded. Accounts created before the App Store launch are free through December 31, 2027, with no purchase. To tell which accounts those are, we record when each account was created.

Calendar, microphone, speech and camera. With your permission, the iPhone app writes the events you create to your iPhone’s calendar and reads that calendar in order to display it. It uses the microphone and Apple’s speech recognition when you dictate. On iPhones that support it, your speech is turned into text on the phone itself. On older iPhones, the recording goes to Apple’s speech service to be turned into text, under Apple’s terms. The app uses the camera only to read the code a web browser shows when you sign that browser in from your phone; the camera’s image stays on your phone and is not kept. In a web browser, dictation uses that browser’s own speech service. Apple’s permission settings control all of this. None of it is sent to us.

Analytics. Our analytics are the error reports described above and counts we make from our own server records, such as how many accounts signed in this week. To make them, our back office keeps a daily table of account activity under a scrambled form of each account ID. None of it includes what you write.

What we do not collect. We do not collect advertising identifiers or your location. We do not read your phone’s address book. Contacts you add inside Maitland are part of your encrypted files.

Who else receives information

Three companies help us run the Service. Each works under its own terms.

DigitalOcean, LLC hosts our server, which is located in New York. It holds your encrypted files, the account records described above, and nightly backups of both.
Apple Inc. provides Sign in with Apple, delivers the silent sync notices, receives email sent to support, and distributes the iPhone app. It takes payment for subscriptions bought in the app and tells us about them, as described under “Subscriptions.” On older iPhones, it turns dictation into text.
An email delivery service sends the email described under “Email we send you.”

We do not sell personal information, and we do not share it for advertising. We disclose it only to the three companies above as needed to run the Service; to a person you send a task to, with your account ID; to a successor if Maitland is merged or sold; and when the law requires it or to protect someone’s safety. Because we cannot read your files, the most we could give anyone is encrypted data and the account records described in this policy.

How long we keep things

Your files and your account: until you delete them. Your subscription records, your list of blocked accounts and the record of which versions of the Terms and this policy you accepted are part of your account and are deleted with it.
Deleted items: in your account’s trash for 30 days, after which only their IDs and dates remain.
Backups: our server keeps copies of changed and deleted files for 14 days, and we make a full backup each night and keep the newest fourteen. A deleted account is gone from the backups within fourteen days.
Sign-in sessions: until they expire or you sign out. If you delete your account, the scrambled session records stay until they would have expired, at most 90 days, but they no longer sign anyone in.
Deleted accounts: we keep a list of deleted account IDs and the date each was deleted, with no email address, for two years. It is how a device still signed in to a deleted account learns that the account is gone.
Server logs and the system log: 30 days.
Error reports: we keep no reports, only the daily counts described above, which contain nothing about any person.
Email we send you: the email delivery service keeps its copies for a period set by its own policies.
Tasks sent between users: 30 days after the recipient’s app collects them, except their IDs.
Your account ID on another person’s list of blocked accounts: until that person unblocks you or deletes their account.

Your choices

Export. You can export what you have written as plain text at any time.
Delete. You can delete any item, notebook or list. You can delete your whole account from Settings → Account. That removes your account record, the locked copy of your key, your files and your sync token from our server, and it signs out every session. Backups follow within fourteen days. Some records remain for a time, as described under “How long we keep things,” including your account ID on our list of deleted accounts, revoked session records, tasks you sent to other people, your account ID on other people’s lists of blocked accounts, the email delivery service’s copies of email we sent you, and the logs. Deleting your account does not cancel a subscription. Cancel it in your Apple account.
Correct. Everything you have written is yours to edit.
Ask us. Write to support@maitland.app with any question or request about your information.
Do Not Track. We do not track you across other sites, so we treat a browser the same whether or not it sends a Do Not Track signal.

Children

Maitland is not meant for children, and you must be at least 16 to use it. If you are under 18, a parent or guardian must agree to the Terms for you. We do not knowingly collect personal information from anyone under 16. If you believe we have, write to support@maitland.app and we will delete it.

Security

The Security Page at maitland.app/security describes how your files are encrypted, what our server can and cannot see, and what the encryption does not protect. No system is perfectly secure, and we do not promise that ours is.

We do not hold your encryption key. If you lose your devices, your password and your 24-word recovery phrase, no one can recover your files, including us.

If we learn of a breach that affects your account, we will tell you at your account email and as the law requires.

Changes

We will post changes here with a new effective date. For a material change, we will also tell you in the app or by email.

Disputes

This policy is part of the Maitland Terms of Use at maitland.app/terms. SECTION 15 OF THE TERMS REQUIRES MOST DISPUTES, INCLUDING DISPUTES ABOUT PRIVACY AND SECURITY, TO BE RESOLVED ONE AT A TIME, IN SMALL CLAIMS COURT OR BY BINDING INDIVIDUAL ARBITRATION. IT WAIVES JURY TRIALS AND CLASS ACTIONS. Sections 10 and 11 of the Terms limit our liability.

Contact

Maitland Desk LLC, c/o Registered Agents Inc., 418 Broadway, Ste R, Albany, NY 12207, support@maitland.app.