Toldwell — Privacy

Toldwell is a family memoir app from Zehavi Works LLC. It helps you record, organize, share, and preserve family stories. Zehavi Works does not operate a story-content server and does not receive readable copies of your stories through normal app use.

Your stories and family information

Toldwell stores information you create or choose, including written stories, voice recordings, transcripts, photos, reactions, family-tree details, questions, display names, and preferences. Saved story contents are encrypted on your device before cloud sync or encrypted-backup export. Decrypted content is used locally when you read, listen, search, edit, or create a readable export.

When iCloud is available, Toldwell uses your private CloudKit database for same-Apple-Account sync. With explicit household-sharing consent, it also uses a private household owned by the Organizer. CloudKit processes encrypted content and service metadata, including record identifiers, pseudonymous author identifiers, encrypted key wrappers, media-presence flags, participant details, and delivery, size, and timing information.

Sharing with family

Cross-account household sharing is available in the controlled TestFlight beta. Pairing, verification, and archive-sharing consent are separate steps. Each invitation starts private and read-only. Toldwell verifies that the accepted Apple Account matches the person you paired with before granting shared archive access. Verified members are trusted editors who can receive and change shared family content. Only the authenticated Organizer can delete a shared household story for everyone.

The Organizer can send a custom question to one or more verified storytellers. Each selected person receives a separate encrypted request; their answer joins the verified household archive. Delivery occurs when Toldwell syncs and is not promised to be immediate.

Stories, the family tree, and sent questions show local upload status. Queued for iCloud means an upload is waiting; Saved to iCloud means iCloud accepted that copy. Sync Needs Attention or Locked on This Device explains a problem and offers a retry where appropriate. These are not read receipts. Toldwell keeps only content-free status codes, random item identifiers, ciphertext-version digests, and times in a device-local status file excluded from backup; it does not put story text or raw cloud error messages there.

Removing a person through Toldwell revokes that person’s household access while preserving other members. Toldwell checks that the Organizer retains recovery access to the archive before removing the participant. Membership changes create fresh encryption protection for subsequently published shared stories and the family tree, including their audio and photos. Removal cannot erase stories, screenshots, exports, or backups the person already received. Separate people need separate Apple Accounts and pairings for independent access and removal.

A member can leave a household and choose to keep or delete that household’s copies on this device. An offline departure remains pending; Toldwell blocks automatic household sharing while the request finishes. Kept copies stay local when you later join another household. Kept family trees appear separately under Family Tree > Kept Family Trees as read-only local copies. Deleting these device copies does not delete the Organizer’s archive or other people’s copies.

Apple services and permissions

Toldwell uses CloudKit and iCloud Keychain, StoreKit for purchases, Apple’s system Photos picker, and system sharing services. The app’s identity key can synchronize through iCloud Keychain to your other devices. Apple handles its own account, purchase, participant, device, delivery, and service information under Apple’s privacy policy.

Toldwell requests microphone permission to record your voice, speech-recognition permission for on-device transcripts, and camera permission on iPhone or iPad to scan an in-person pairing code. Audio export requires device authentication, such as Face ID, Touch ID, or a passcode. Photo selection uses Apple’s system picker without requesting broad Photo Library access. You can change app permissions in system Settings.

Transcription requires on-device recognition. Toldwell does not send your audio to Zehavi Works for transcription. Availability varies by device and language.

Encrypted backups and your backup key

An encrypted .toldwellbundle can include story content, family-tree information, authenticated deletion history, and password-protected recovery information. Backups that include retained local copies use bundle version 3 and preserve their local-only restrictions when imported by a compatible Toldwell version. Older app versions must be updated to read those backups. A backup does not grant new household membership or permission to automatically share kept copies. Keep both the backup file and your eight-word backup key. The words alone do not recreate a missing backup or missing stories. The recovery information protects the current and historical identity keys needed by your archive, so key changes do not intentionally discard older access. Older backup-key setups may ask you to verify your saved words before relying on a new backup.

Zehavi Works cannot reconstruct a lost backup key. Never send your eight words to support. Protect your devices, Apple Account, exported files, and backup key.

Readable exports and retention

Memoir PDFs and audio archives are readable exports; they are not encrypted Toldwell backups. Temporary copies are kept in Toldwell’s private cache and excluded from device backup. They expire within 24 hours. Closing an audio export’s sharing screen shortens its expiration to ten minutes; closing a memoir preview normally removes that temporary PDF immediately. Expired copies are removed while Toldwell runs or the next time you open it if the app was closed or suspended. This cleanup does not remove copies you saved or shared elsewhere.

Encrypted .toldwellbundle exports remain in the app’s Documents folder until you remove them. Files you send through AirDrop, Messages, Mail, Files, or another service are also subject to that service’s handling of participants, filenames, file size, delivery, and retention.

You can delete personal stories in Toldwell. Shared-story deletion for everyone requires the Organizer. The app retains encrypted or authenticated deletion history to prevent deleted stories from returning during sync or restore. Importing another family member’s backup does not authorize them to delete stories already in your library. A verified backup of your own identity can restore your own deletion history. Copies previously exported or held by other people remain under their control.

Tracking and support

Toldwell has no advertising or third-party analytics SDKs. Zehavi Works does not use Toldwell to track you across other companies’ apps or websites or sell your personal information.

If you contact support, Zehavi Works receives the email address and information you choose to include and uses it to respond. Send the version, device, operating system, action attempted, and error message; do not attach private stories, audio, encrypted backups, pairing codes, or backup keys.

Children and contact

Toldwell is a general-audience family-history product and is not directed to children under 13. A parent or guardian should decide whether and how a child uses the app or appears in family content.

For privacy questions, email support@zehaviworks.com. Zehavi Works LLC may update this policy as Toldwell changes and will revise the effective date on this page.