The short version
- No account. No email, no password, no sign-in, no profile. Nothing identifies you to us, because nothing ever asked.
- Your taps live on your phone, and, if you leave iCloud on, in your iCloud. They are never uploaded to us, and we could not read them if they were.
- Six fields and a random key leave the phone when a tap is counted, listed in full below. None of them is your name, your email or your Apple ID.
- A few anonymous app events, such as "the price page was opened", so we can tell whether the app makes sense to people. Listed in full below; no taps, no times of day, nothing about you.
- No tracking, no advertising, no analytics SDKs. Nothing here follows you to another app or website.
- Export or delete everything in Settings, at any time, without asking anyone.
What leaves your phone
When you tap a button that has presence turned on, the app sends one small request. This is all of it:
| The action | Which of the forty-six shared actions it was — coffee, woke. Never a name you typed yourself. |
|---|---|
| Your clock offset | How far your time zone is from UTC, rounded to fifteen minutes. This is what lets the app say "people on your clock". |
| Your country | A two-letter code like vn. It starts as the country of your App Store account, or your phone's region if there is none, and you can pick another in Settings. If you tap "Use my location", the phone takes one approximate position, asks Apple's map service which country that is, keeps the country and drops the position. This happens only when you tap it, never in the background, and the position never reaches our server. |
| The time | When you tapped, to the second. |
| A catalogue version | A number, so the server knows which list of actions your app uses. |
| The platform | The word ios. |
| A random key and a signature | The first time the app is used, your phone makes an Apple App Attest key and sends its id, with a signature, alongside each tap. This is how the server knows a tap came from a real copy of the app, and how it stops one phone from counting a thousand times. The id is random: it is not your Apple ID, not an advertising id, and not tied to your name. |
| A random tap id | Only for taps from the widget: a random id made for that one tap, so a retry is not counted as a second tap. |
That is the entire request. No name, no email, no advertising id. The key id is the one thing two of your taps have in common. The server keeps it as a public key and a counter, apart from anything you did, with two short exceptions. Both delete themselves.
- To take a tap back. For the five minutes in which a tap can be undone, the key id is kept next to that tap, so that only your phone can undo it.
- To count you once. So that tapping the same thing twice counts one person, not two, the server keeps a one-way fingerprint made from your key id and the action, for under an hour. It holds no time, no place and no count, and it cannot be turned back into your key id.
Apart from these two, nothing on the server ever puts your key id next to a tap you made.
A few app events
Separately from taps, the app sends a short list of moments to our own server, a few at a time, signed with the same App Attest key. Each is a name and one word of detail, nothing else:
| Getting started | That a step of the first-run introduction was finished (its number), and that the example rhythm was tried. |
|---|---|
| Meantime+ | That an offer was seen, that its price page was opened, that it was closed, or that a trial or purchase started, with the screen it happened on (for example settings). Never the price, the plan, or anything from Apple about you. |
The server adds each one to a daily total, and to an estimate of how many phones sent it that day, which it keeps as a mathematical sketch that cannot be turned back into keys. Nothing is stored per phone. At most two hundred events a phone a day are accepted, and the totals are deleted after a hundred days. These are sent whether or not your buttons share their taps; they say nothing about what you did or when in your day.
What is never counted, and never reaches us
- Sensitive actions. Medication, alcohol, cigarettes, intimacy, bathroom, pain and mood are never counted with other people and never reach our server. There is no switch that sends them to us, and the server refuses them if anything ever tried. Like the rest of your dots, they are copied to your own private iCloud if you keep iCloud on (see below), and nowhere else. They carry a crossed-out eye in the app so you can see it at a glance.
- Buttons you named yourself. A custom button with no shared action behind it can never be counted — there is nothing to count it with.
- Anything imported from a file. It already happened, so counting it again would be counting it twice.
Notifications
They are off until you turn them on. If you do, the app plans at most one a week on your phone, from your own dots: a note on Sunday evening about your week, or one line after a few quiet days. Nothing is sent to us to make them, and no notification ever names Meds or another private button, because it shows on your lock screen.
Your own iCloud, not our server
A year of dots that a dropped phone can erase is not worth keeping. So your buttons and your taps are mirrored to your iCloud account, using Apple's CloudKit private database — the same place your Notes and your Photos live.
Turn it off in Settings → Where your dots live at any time, and the app goes back to keeping everything on the one device. Signing out of iCloud does the same. Sensitive actions are mirrored exactly like the rest — to your account only, never to ours.
What Apple does with it is covered by Apple's iCloud privacy notice.
Proving the app is real, without knowing who you are
Without accounts, anyone could send ten thousand fake taps and the number, the only thing this app offers, would become a lie. So a tap sent from inside the app is signed using Apple's App Attest. A tap sent from the Home Screen widget cannot be signed by anyone, because Apple does not allow App Attest inside an app extension. So the widget sends its tap unsigned, the server refuses it, and iOS wakes the app, which signs the same tap and sends it again. Nothing unsigned is counted while this check is on.
Your iPhone's secure chip holds a key that never leaves the hardware. Apple vouches that the key belongs to a genuine copy of this app on real Apple hardware. The server checks that signature and stores two things: a public key, and a counter.
What it cannot show: who you are, where you are, or what you have tapped. The budget counter holds a number and nothing else — no action, no time, no place — and it expires by itself. The server can know that a device tapped sixty times this hour. It cannot know what that device tapped.
What the server keeps, and for how long
The server holds counts, not people. There is no table of users, because there are no users to put in one.
| Tap counts | Totals per action, per fifteen-minute bucket, per clock band or country. They expire after about four hours. |
|---|---|
| Typical-hour medians | A rough shape per action, used to spot a count that has gone wrong. Expires after about a week. |
| One-person fingerprints | A one-way fingerprint of a key id and an action, so that one person is counted once. No time, no place, no count. Gone in under an hour. |
| App Attest keys | A public key and a counter per install. Kept apart from what you do, except for the two short windows described above. |
| App event totals | A count per event per day, and a sketch estimating how many phones sent it. No list of phones. Deleted after a hundred days. |
No request bodies are logged, and no IP address is stored alongside a tap.
On the way there: Cloudflare. Requests reach our server through Cloudflare, which carries them over its own network so they arrive quickly and reliably, and keeps floods of traffic away from the server. Cloudflare opens the encrypted connection on our behalf, so it passes along what is listed above and sees your IP address, as any network in between does. It handles that under its own privacy policy and keeps none of it for us. Our server gets your IP address from Cloudflare only to slow down a flood of new installs from one place: it keeps a one-way hash of it for less than an hour, never next to a tap.
Paying, if you choose to
Meantime+ is optional and everything in the free app stays free. Purchases go through Apple: we never see your card, your name or your Apple ID.
Subscription state is handled by RevenueCat, which is given an anonymous identifier it makes up itself. To check a purchase it receives the App Store's record of it (which product, when it was bought and renewed, the price and the App Store country) under that identifier. It is never given a name, an email address, or a single one of your taps. RevenueCat handles this under its own privacy policy.
Your data is yours — take it, or destroy it
- Export everything. Settings → Where your dots live. A readable JSON file of every button and every tap, handed to you.
- Import from a file. A new phone, or an old export. The same file can be read twice without counting anything twice.
- Delete everything. Settings → Where your dots live. Removes every tap and button from the phone and from your iCloud copy. There is nothing on our server to delete, because nothing there was ever yours individually.
- Delete the app. That removes the copy on the phone. If iCloud was on, use Delete everything first, or the copy stays in your account until you remove it in iOS Settings → your name → iCloud.
There is no account to close. What the server does hold is pseudonymous: the random App Attest key id, the country and time that come with a counted tap, and, for less than an hour, a one-way hash of an IP address. Under the GDPR that can still count as personal data, even though nothing in it says who you are. We cannot look any of it up by your name or email, because we never have either, and what comes with a tap expires within hours. If you are in the EU or UK and want to use a right under the GDPR (access, correction, erasure, objection), write to us and we will do what we can with what the server actually holds. You can also complain to your data protection authority.
Children
The app is rated 13+, because a few of its actions (alcohol, cigarettes, intimacy) are for adults. It asks for no email and no age. It offers to use a first name in its greeting, which you can skip, and which never leaves your phone. It has no messaging, no user-generated content, and no way for one person to reach another.
Who we are
The controller of the data described on this page is Manh Cuong Do, the developer named as the seller on the App Store, who makes In the Meantime. Write to support@inthemeantime.app about anything on this page.
Changes, and how to ask
If this policy changes, the date at the top changes with it, and anything that would newly leave your phone will be said plainly in the app before it does.
Questions: support@inthemeantime.app.