Citta is a private place to write down what you are thinking and feeling. This page explains, in plain language, what leaves your device and what does not. We have tried to write it so that it is actually readable, rather than to bury the important parts.
The short version. Your entries are encrypted on your device before they are stored. Voice notes are sent to our server and transcribed via Alibaba Cloud NLS (see the "Voice notes" section). We do not show ads, we do not track you across other apps, and we do not sell your data.
But one thing matters and we want to be direct about it: several features — automatic tagging when you save an entry, and the AI-generated reports and reflections — require the plain text of your entry to be sent to our server and on to our AI model provider. If you would rather nothing of the kind ever leaves your device, you can turn AI features off in the app, or simply not use them.
1. Who we are
Citta is operated by the developer of the Citta app (the “we” below). For any privacy question, or to exercise any of the rights described here, write to support@citta.fyi.
2. What we collect
2.1 Account information
- An account identifier. When you create an account we store a username and a password hash. We never store your password itself.
- Your phone number. It is required to create an account — we send a verification code to it, and it is the only way to recover your password later — and it is stored in plain text on our servers, because we have to be able to read it in order to text you. Existing accounts can add one from the Profile screen. The app itself only ever shows a masked form such as 138****8000.
2.2 Your entries
The text of your entries and your dream notes are encrypted on your device with a key that is generated and held only on your device. Our servers receive and store the resulting ciphertext, which we cannot read. Mood ratings, assessment scores and bands, tags and timestamps are not in that category — we have to be able to read those metadata in order to draw your trends (see section 2.5). If you lose the key — for example by reinstalling the app without a backup — we cannot recover your entries for you. That is a direct consequence of the encryption, not a limitation we can remove on request.
2.3 Voice notes
If you record a thought by voice, the audio is sent to our server and transcribed into text via Alibaba Cloud NLS one-sentence recognition. The audio is used only within that request for transcription — it is not stored or retained, and is discarded once transcription completes. The resulting text is stored as an ordinary encrypted entry.
2.4 AI features — please read this section
Citta has AI features. To make them work, the relevant text has to be readable by a language model, which means it cannot stay encrypted end to end during that operation.
| What is sent |
The plain text of the content involved —
for automatic tagging, the entry you just saved; for a report, a sample of your entries from
that period; for dream interpretation or creative writing, the text you selected.
Boundaries, stated precisely: deep insight sends aggregate statistics only (entry count, average score, theme and mood distributions) and no source text; literature matching runs with a local algorithm on our server and sends nothing to any model. |
|---|---|
| Where it goes | Over HTTPS to our server, and from there to our AI model provider, Alibaba Cloud Model Studio (a service of Alibaba Group, located in mainland China), using the hy3 model. |
| Why | Solely to produce the result you asked for — tags, a report, or a reflection. |
| What we keep | We do not write your text to our database or logs. Our internal task log records only the type of task, whether it succeeded, token counts, and how long it took. |
| What we cannot promise | We cannot make commitments on behalf of the model provider about its own retention practices. If that is not acceptable to you, do not use the AI features — the app's core journal, timeline, tags and search all work without them. |
2.5 Mood and self-assessment scores
Your mood ratings and the scores from the self-assessment questionnaires (PHQ-9, GAD-7, and a short personality exploration) are stored in a form our server can read, unlike your written entries. We use them to show you trends over time. They are health-related information, so we treat them as sensitive: they are not shared with anyone, and they are never used for advertising.
2.6 Technical information
Our servers keep ordinary request logs (such as IP address and timestamp) for security and rate limiting. We do not use third-party analytics SDKs, advertising SDKs, or crash-reporting SDKs that profile you.
3. What we do not do
- We do not show advertising, and there are no advertising or tracking SDKs in the app.
- We do not track you across other apps or websites.
- We do not sell or rent your personal information.
- We do not read your encrypted entries. We cannot.
- We do not post anything on your behalf, and there is no social feed, no followers, and no public profile.
4. The self-assessment questionnaires
PHQ-9 and GAD-7 are widely used screening questionnaires. In Citta they are offered as a self-reflection aid, with an explanation of what each score range generally means. They are not a diagnosis and not a substitute for professional care. If a score is high, the app suggests talking to a professional and shows crisis helplines. We do not use your results to make decisions about you, and we do not contact anyone about them.
5. Where your data is stored
NianTou currently runs two deployments: niantou.wang (Chinese) is served from mainland China, and citta.fyi (English) is served from servers outside mainland China — whichever site you use decides where your data lands. The AI model provider described in section 2.4 is located in mainland China. If you use the app from another country, your information will therefore be transferred to and processed in those locations. By using the app you agree to that transfer, which is necessary to provide the service.
6. Keeping and deleting your data
- Deleting an entry in the app deletes it from your device and marks it for removal on the server.
- Deleting your account is done in the app, under Profile → Delete account, and takes effect immediately. We physically delete the entries, reports, assessment results and dream records held for you, and release your username and phone number so you can register again with the same number. Paid membership orders are kept as financial records but no longer contain anything identifying you. Deletion cannot be undone — export anything you want to keep first.
- Data on your device is removed when you delete the app. Note that where a password or key is required to decrypt your own content, we cannot delete or restore what we cannot read.
7. Children
Citta is not intended for children under 13, and we do not knowingly collect personal information from them. The app is rated for older audiences because it discusses mental health and includes a questionnaire that asks about thoughts of self-harm. If you believe a child has provided us with personal information, contact us and we will delete it.
8. Security
Traffic between the app and our servers uses HTTPS. Your entries are encrypted on your device before storage. No system is perfect, and we cannot guarantee absolute security — but we have deliberately designed the service so that the most sensitive thing you give us, the text of your thoughts, is the thing we are least able to read.
9. Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to certain processing. To exercise any of them, write to support@citta.fyi. The app also lets you export your own archive directly.
10. Changes to this policy
If we change this policy in a way that affects what happens to your data, we will say so in the app before the change takes effect, and update the date at the top of this page.
11. Contact
Questions, requests, or complaints: support@citta.fyi.