Privacy

This policy applies to Retold, the iOS app, and to this website. Retold is made by Reboot the Future, referred to below as “we” and “us”. You can reach us at hello@example.com.

It is short because the app is built so that there is little to say. Privacy claims are cheap; this one is checkable. The app’s own privacy screen lists the frameworks linked into the binary and what each is for, and that list is reproduced on this site. If a framework is added or removed, both change with it, or the claim stops being auditable.

We collect no personal information, no usage data, and no diagnostics. Not in an anonymized form, not in an aggregated form, not for a legitimate interest. There is no mechanism in the app by which we could.

Because we collect nothing, there is no sale of data, no sharing with third parties, no advertising or profiling, no cross-app tracking, and no automated decision-making about you. Those sentences are not a policy position we could change quietly; they are a description of a binary with no way out to the network.

Retold stores what you give it, in its own container on your iPhone, under the protection iOS gives app storage:

All of it is processed on the device: microphone capture, speech recognition, the second transcription pass by the bundled model, and the writing of observations. No part of that pipeline involves a server, ours or anyone’s. It works in Airplane Mode, and it works the same way with no signal at all.

The app marks its audio folder as excluded from iCloud device backup. The rest of the app’s container is included in whatever backup of your iPhone you have turned on in iOS — that is Apple’s system backup of your own device, encrypted and held under your Apple Account, and not something Retold sends or can read.

We hold no copy of any of it, so we set no retention period. It stays until you delete it.

Three things can move data off the phone, and each one is a button you press:

In every case the app hands a file to iOS and stops. It never opens a connection of its own, because it has no code that could.

The optional backup is encrypted with AES-GCM using a key derived from a passphrase you choose. The passphrase is never stored — not in the app, not in the file, not with us. Restoring asks for the same passphrase and opens the archive on the device.

This has a consequence worth stating plainly: if you lose the passphrase, the backup cannot be opened, by you or by anyone, including us. There is no reset, because there is nowhere a reset could come from. That is the point of it.

Nobody else holds a copy and nobody else can open it.

Three prompts, all optional except the first, and all revocable in iOS Settings at any time:

Recording, transcription, typed entries, search, export and backup are free. The observer, the weekly review and the observation library are unlocked by a purchase. That purchase is handled entirely by the App Store using StoreKit. Retold runs no backend of its own and no payment code of its own.

We never see your payment details, your Apple Account, your name, or your email address. What Apple provides to any developer is aggregated sales and download reporting, which identifies nobody. Apple’s handling of your purchase is covered by Apple’s privacy policy, not this one.

Whether you have purchased is recorded on your own device so the app knows what to unlock. That flag stays on the device.

iOS itself can send Apple anonymous diagnostic and usage reports, and can share some of them with the developers of the apps involved. That is a system setting you control, under Privacy & Security → Analytics & Improvements in iOS Settings, and it applies to every app on the phone, not only this one.

Retold contains no analytics code and adds nothing to those reports. We mention it because a policy that claimed the phone sends nothing, ever, would be describing something other than an iPhone.

Retold includes third-party work, but no third-party services. Each of these ships inside the app and runs on your device. None of them is a network client, and none of them receives anything:

Data protection law gives you the right to ask an operator what it holds about you, to correct it, to have it deleted, to take a copy elsewhere, and to object to its use. Those rights apply to us in full. They simply arrive at an empty room: we hold no data about you, so a request to access, correct, delete or export it would return nothing.

What you can do, without asking anyone, is exercise the same things directly on your phone:

Retold collects no personal information from anyone, of any age. There is no account, no profile, and no way for us to learn who is using it.

If you would still like to put a request to us in writing, write to hello@example.com and we will answer.

No cookies, no analytics, no tracking pixel, no embedded video, and not one line of JavaScript. Every byte it needs — the typeface, the stylesheet, the icon — sits in the folder next to it. It ships a Content-Security-Policy that forbids the browser from opening a connection at all. Read the source; it is short.

Like any web server, whoever hosts these files may keep ordinary access logs. We add nothing to them and use them for nothing.

If this policy changes, the new version is published here with a new effective date, and the app’s privacy screen is updated in the same release. A change that meaningfully altered what the app does with your journal would be described in the release notes rather than left to be discovered.

Superseded versions do not silently disappear from the record: the file that produces this page is kept in the project’s history, dated.

Effective 5 August 2026 · Reboot the Future