The short version
- No account. No email, no password, no sign-in, no profile. Nothing identifies you to us, because nothing ever asked.
- Your taps live on your phone, and, if you leave iCloud on, in your iCloud. They are never uploaded to us, and we could not read them if they were.
- Six fields and a random key leave the phone when a tap is counted, listed in full below. None of them is your name, your email or your Apple ID.
- No tracking, no advertising, no analytics SDKs. Nothing here follows you to another app or website.
- Export or delete everything in Settings, at any time, without asking anyone.
What leaves your phone
When you tap a button that has presence turned on, the app sends one small request. This is all of it:
| The action | Which of the forty-six shared actions it was — coffee, woke. Never a name you typed yourself. |
|---|---|
| Your clock offset | How far your time zone is from UTC, rounded to fifteen minutes. This is what lets the app say "people on your clock". |
| A metro name | Optional, only if you allowed location. A name like us-nyc, worked out on your phone. Coordinates never leave the device. Decline, and the app says "on your clock" instead. |
| The time | When you tapped, to the second. |
| A catalogue version | A number, so the server knows which list of actions your app uses. |
| The platform | The word ios. |
| A random key and a signature | The first time the app is used, your phone makes an Apple App Attest key and sends its id, with a signature, alongside each tap. This is how the server knows a tap came from a real copy of the app, and how it stops one phone from counting a thousand times. The id is random: it is not your Apple ID, not an advertising id, and not tied to your name. |
| A random tap id | Only for taps from the widget: a random id made for that one tap, so a retry is not counted as a second tap. |
That is the entire request. No name, no email, no advertising id. The key id is the one thing two of your taps have in common. The server keeps it as a public key and a counter, apart from anything you did, with one exception: for the five minutes in which a tap can be undone, it is kept next to that tap, so that only your phone can take it back. Then that link is gone.
What never leaves the phone at all
- Sensitive actions. Medication, alcohol, cigarettes, intimacy, bathroom, pain and mood are never counted with other people. There is no switch that sends them: they stay on your phone, and the server refuses them if anything ever tried. They carry a crossed-out eye in the app so you can see it at a glance.
- Buttons you named yourself. A custom button with no shared action behind it can never be counted — there is nothing to count it with.
- Anything imported from a file. It already happened, so counting it again would be counting it twice.
Your own iCloud, not our server
A year of dots that a dropped phone can erase is not worth keeping. So your buttons and your taps are mirrored to your iCloud account, using Apple's CloudKit private database — the same place your Notes and your Photos live.
Turn it off in Settings → Where your dots live at any time, and the app goes back to keeping everything on the one device. Signing out of iCloud does the same. Sensitive actions are mirrored exactly like the rest — to your account only, never to ours.
What Apple does with it is covered by Apple's iCloud privacy notice.
Proving the app is real, without knowing who you are
Without accounts, anyone could send ten thousand fake taps and the number, the only thing this app offers, would become a lie. So a tap sent from inside the app is signed using Apple's App Attest. A tap sent from the Home Screen widget cannot be signed by anyone, because Apple does not allow App Attest inside an app extension; those are rate-limited instead.
Your iPhone's secure chip holds a key that never leaves the hardware. Apple vouches that the key belongs to a genuine copy of this app on real Apple hardware. The server checks that signature and stores two things: a public key, and a counter.
What it cannot show: who you are, where you are, or what you have tapped. The budget counter holds a number and nothing else — no action, no time, no place — and it expires by itself. The server can know that a device tapped sixty times this hour. It cannot know what that device tapped.
What the server keeps, and for how long
The server holds counts, not people. There is no table of users, because there are no users to put in one.
| Tap counts | Totals per action, per fifteen-minute bucket, per clock band or metro. They expire after about four hours. |
|---|---|
| Typical-hour medians | A rough shape per action, used to spot a count that has gone wrong. Expires after about a week. |
| App Attest keys | A public key and a counter per install. No action, no time, no location attached. |
No request bodies are logged, and no IP address is stored alongside a tap.
Paying, if you choose to
Meantime+ is optional and everything in the free app stays free. Purchases go through Apple: we never see your card, your name or your Apple ID.
Subscription state is handled by RevenueCat, which is given an anonymous identifier it makes up itself. It is never given a name, an email address, or a single one of your taps.
Your data is yours — take it, or destroy it
- Export everything. Settings → Where your dots live. A readable JSON file of every button and every tap, handed to you.
- Import from a file. A new phone, or an old export. The same file can be read twice without counting anything twice.
- Delete everything. Settings → Where your dots live. Removes every tap and button from the phone and from your iCloud copy. There is nothing on our server to delete, because nothing there was ever yours individually.
- Delete the app. That removes the copy on the phone. If iCloud was on, use Delete everything first, or the copy stays in your account until you remove it in iOS Settings → your name → iCloud.
Because we hold no personal data, there is no account to close and no request to file. If you are in the EU or UK and want to exercise a right under the GDPR, the honest answer is that we have nothing of yours to give you, correct or erase — and this page explains exactly why.
Children
The app is rated 13+, because a few of its actions (alcohol, cigarettes, intimacy) are for adults. It asks nobody for a name, an email or an age. It has no messaging, no user-generated content, and no way for one person to reach another.
Changes, and how to ask
If this policy changes, the date at the top changes with it, and anything that would newly leave your phone will be said plainly in the app before it does.
Questions: contact@inthemeantime.app.