Dola

Is Dola safe?

Dola is a reasonable assistant to install, and a weak one for privacy. It is ByteDance's chatbot for the world outside China, published by SPRING (SG) Pte. Ltd. in Singapore and known until recently as Cici. We found no breach and no fine. But Apple's label says identifiers may be used to track you across other companies' apps, the privacy policy lets ByteDance's wider group use what you type, and your chats train its models unless you find the switch. We score it 49/100, a little above its Chinese sibling Doubao (46) and below ChatGPT (57).

Dola and Doubao are different apps

ByteDance runs two assistants. Doubao is the Chinese one: a Beijing company runs it, it stores data inside China, and it is only in Chinese stores. Dola is the export version. Its privacy policy, updated on 31 July 2026, names SPRING (SG) Pte. Ltd. as the data controller and says personal data may be stored on servers in Malaysia, Singapore and Japan. EU users have a GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary representative in Dublin.

That is a real difference, but not a clean break. The same policy says Dola shares your data "globally within our Corporate Group" for storage, security, research and analytics, and that group companies outside the country where data was collected may get "limited remote access". It does not list which companies or countries. If keeping your data away from ByteDance's Chinese operations is what you care about, the policy does not promise that.

When we checked Apple's storefronts in October 2026, Dola was listed in the UK, Germany, France, Japan, Korea and Brazil, but not in the US or India. In the UK it ranked sixth in Productivity.

What Dola collects and shares

The UK App Store label lists identifiers as data used to track you. Linked to your identity are your email, phone number, chat content, user ID, device ID and crash data. Audio and how you use the app are listed as not linked to you. Google Play's data safety section says photos and files you upload are shared with other companies to make features work.

The privacy policy goes further than the label, and we score on the broader of the two:

• Inferred traits. Dola "may infer your likely preferences and other attributes, such as gender, age and hobbies".
• Ad partners. Advertising and measurement partners receive automatically collected data to promote Dola on other platforms, and Dola receives data about you from them.
• Outside AI models. For its standard chatbots, chat content may be sent to third-party developers of AI tools, "including LLMs such as Gemini (Google)".
• Training. Your inputs are used to train and improve AI models unless you switch that off in account settings.
• Retention. Data is kept as long as needed for the service or a "legitimate business purpose". One regional section mentions five years after you stop using the service.

Compared with Doubao, the label is lighter: no precise location, no photos linked to you. Compared with ChatGPT, the tracking and ad-partner sharing are heavier.

Security and your account

We found no breach, leak or open database reported for Dola or Cici, and Have I Been Pwned lists none. Google Play says data is encrypted in transit and that you can ask for it to be deleted. Like other mainstream chatbots, Dola does not encrypt chats end to end, so the company can read them, and its policy says it scans user content for rule breaks. We found no public bug bounty for Dola. The remote access granted to group companies is the main reason security sits below 50.

Content and younger users

Dola writes, translates, searches the web, and makes images and short video. There is no public feed of strangers, which keeps scam and harassment risk low. The terms ban content that sexualises minors and anything that impersonates a real person without a clear "unofficial" or "parody" label. The minimum age is 13; the policy says under-18s get extra safeguards and lose some features, and that Dola may infer a user's age and ask for proof.

How to use Dola more safely

1. Open account settings and switch off model training and enhanced personalisation.
2. On an iPhone, tap "Ask App Not to Track" when Dola asks, so its identifiers are not linked across apps.
3. Do not paste work documents, ID numbers or health details into chats. Remember that some requests go to Google's models.
4. Delete the account from the settings page when you stop using it; deleted accounts cannot be restored.
5. Download only the app published by SPRING (SG) Pte. Ltd.

How we scored it

Privacy (32) is the weakest factor: tracking identifiers, inferred traits, ad partners and sharing across the ByteDance group. Security (48) reflects a clean breach record but no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, no public bug bounty and remote access from abroad. Transparency and control (58) is the strongest of the scored practices, thanks to the training switch and in-app deletion. The regulatory record (87) shows no fine or order, for a young app that no regulator has publicly examined.