Plainly
What is stored, where it lives, and what can leave.
Your check-ins are on your device, there is no account to make, and nothing you write is uploaded to be understood. Below is the whole of what can leave the phone — including the two things you cannot turn off.
The whole list
What can leave the device
Six entries, and the order is worst-case first. Two of them happen without you turning anything on, and this page names them before it names the ones you control — a list that leads with the optional things is a list arranged to be reassuring.
- Nothing you write
- Check-ins, notes and your safety plan stay on the phone. The safety plan is encrypted there and never leaves in readable form. There are three switches that could ever change this, and every one of them is off until you move it.
- A feature check, on every launch — no switch
- Moorwell asks our own database which features are switched on, and carries on regardless of the answer. It sends nothing about you. There is no switch because it is how something harmful gets turned off without waiting for an app-store review.
- Error reports, when it breaks — no switch
- A failure type, where it happened, and the chain of code that led there. No message text, no identifier, and no clock finer than a date. The Settings toggle for this was removed, and the preference behind it stays on.
- Anonymous usage counts — on, and one tap turns them off
- Counts of which activities were opened and finished, never a word you wrote. They are on when you install and the first screen says so, which is the only honest way to ship a default-on switch. One tap in Settings stops them, after which nothing is written at all.
- Cloud help — off until you turn it on
- Off by default. With it on, the app names exactly what is about to be sent before it sends it.
- Nothing else
- No analytics package, no advertising identifier, and no third-party script — in the app or on this site.
There is no account, and that is a fact about this version
Not a vow. Stating it as a permanent principle would be the kind of promise a later release quietly breaks, so it is written as what it is: no sign-up exists in the build you can open today, at any age and at any setting.
-
Today: none
No sign-up exists. Nothing identifies you, so there is nothing to ask us for.
-
The cost of that
Lose the phone and the history goes with it. We would rather say so than dress it as a feature.
-
If it changes
Any way of keeping your weeks across devices will be optional, off by default, and deletable — and this page will say so before it ships rather than afterwards.
Plainly
What is never done
- No advertising
- No ad library, no advertising identifier, no third-party script.
- No selling, and no sharing
- Not to advertisers, not to a university, not to an insurer.
- No profile is built about you
- What you say you are interested in steers what gets offered. It is read on the device, it is never shown back to you as a summary of who you are, and it is deleted with the app.
- Nothing you wrote reaches a model that composes
- The two small models that run on your device choose between lines that already ship in the app. Neither writes one.
What you can do about any of it
Erasing everything on the device and turning the counts off are each one screen inside the app, and neither needs permission or an email to us. Uninstalling does the same thing with no warning and no recovery.
If you would rather ask a person what is held about you, there is one address — and the honest answer is short, because there is nothing to look you up by.
This page is the readable version. The policy is the document. Everything above is a summary of a longer text that is generated from the project's own privacy document, so the two cannot drift apart — a test compares them and fails the build when they do.