Zitto privacy policy

Last updated 14 November 2026.

Zitto is a private AI assistant for iPhone. The model runs on your iPhone, your chats are stored on your iPhone, and nothing you type is sent anywhere. This policy describes what the app does; it is short because the app does little.

What Zitto collects

Nothing. Zitto has no account, no sign-in, no analytics, no crash reporting, no advertising and no server of its own. We do not receive your messages, your chats, your device identifiers or your usage.

What stays on your iPhone

• Chats. Stored in the app's own storage, protected by iOS Data Protection whenever the iPhone is locked. They are never synced to iCloud. You can keep them out of iCloud backups (on by default), auto-delete them after 7, 30 or 90 days, delete any chat, or erase everything.
• The model. The AI model you choose is downloaded once and stored on the iPhone. It is excluded from backups because it can always be downloaded again.
• Photos. A photo or screenshot you attach is shrunk, stripped of camera metadata and stored with the chat, under the same protection as the text. The model looks at it on the iPhone. Deleting the chat deletes the photo.
• Voice. Dictation uses Apple's speech recognition with on-device recognition required, so audio is never sent to a server; on an iPhone that cannot recognise speech locally the feature is not offered. Read-aloud uses the voices built into iOS. Zitto does not record or keep audio.
• Documents. A PDF or text file you attach is read on the iPhone; the text the model saw is stored with the chat and deleted with it.
• Shared items and Shortcuts. Something you share to Zitto from another app, or pass with the "Ask Zitto" shortcut, is placed in a private folder shared only between Zitto and its own extension on this iPhone, and removed as soon as the app picks it up. A web page shared from Safari arrives as its text; Zitto does not fetch anything itself.
• Instructions and memory. What you write under Instructions (how to answer, facts about you) is stored on the iPhone and placed in the prompt of every chat. It is removed by "Erase everything".
• Export. The chat export you make is a file on your iPhone; where you send it is up to you.
• Settings and the free-use counter. Kept in the app's preferences on the iPhone. "Erase everything" removes them along with chats and models.

When Zitto uses the network

Once: to download the model you choose, from Zitto's own file storage (a Cloudflare R2 bucket, served at models.zittoai.com). That request carries no chat content, no account and no identifier; like any web request it reveals your IP address to the storage provider (Cloudflare) for the duration of the download, and Cloudflare's own privacy policy applies to that. Zitto has no server of its own and keeps no server-side record of who downloaded what. Every file is checked against a fingerprint built into the app before it is used. Zitto keeps a record of each download on its Privacy screen, so what you see there is what the app did. After the download, Zitto works fully in airplane mode.

Web search, only if you turn it on. In Privacy you can switch on web search; it is off by default. When it is on and you tap the globe before sending a message, the text of that message is sent to Zitto's search relay at search.zittoai.com, a small service run by Zitto on Cloudflare that forwards the text to the Brave search engine and returns the results. The engine sees the relay, not you. The relay sees your IP address for the duration of the request, like any web request, and keeps no logs and no cookies. To keep the service within its allowance it keeps two counts: how many searches were made this month in total, and how many were made today from your connection address, stored under a code that changes every day and is deleted at midnight, so your address itself is not kept and the code cannot be traced back to you later. Nothing else from the chat is sent, the photo is never sent, and the reply is still generated on your iPhone. Each search is recorded on the Privacy screen. Brave's privacy policy applies to the query once it reaches their service.

Zitto Plus purchases and restores go through Apple's App Store using your Apple Account. Apple handles payment; Zitto never sees your payment details. Apple's privacy policy applies to that transaction.

Face ID

If you turn on "Lock with Face ID", Zitto asks iOS to verify you before showing chats. Zitto never receives biometric data; iOS only tells the app whether the check passed.

This website

zittoai.com uses Cloudflare Web Analytics to count visits. Cloudflare describes it as privacy-first: it sets no cookies, uses no local storage and no fingerprinting, and does not track people over time by IP address or browser details. It records page views and visits (counted by referrer), the country, device type, browser and operating system of the visit, and page load timings. The site itself sets no cookies.

Children

Zitto is not directed at children under 13.

Changes

If this policy changes, the new version will ship with the app update that changes the behaviour, and the date above will change.

Contact

Contact details will be published here before the App Store release.