Privacy

There is no account, and the app does not measure what you do. Below is all of it: what stays on your phone, what can leave it, what our server holds, and how to delete it.

RIPEN is made by Anton Kozionov — one person, not a company. “We” in this document means exactly that one person. Write to hello@ripen.day.

Last updated October 17, 2026.

what stays on your phone

Your tree lives on your phone. There is no account and no sign-up, so we do not know who you are. The app does not measure what you do: no analytics, no crash reporting, no advertising, no advertising identifiers and no third-party trackers.

Your pin and your recovery secret never leave your phone. The names of your habits and identities, “after what” and “at what time” leave it only inside the online copy described below.

Even with a pin, the app switcher may show a snapshot of what was on the screen when you left the app.

what can leave the phone

Five things. The public page, a picture or film, a problem report and ideas and feedback leave only when you turn them on or send them. The online copy is made by itself.

• A public page for your tree, only while “public link” is on. It sends our server the shape of the tree, everything the page needs to draw it: your shape’s number, the day the tree was planted and the day each identity and habit was started, which days were marked or missed, the schedules, break days and whether you asked to be reminded when a break ends, when fruit grew and when habits were rooted or cut, when fallen leaves were swept, the day you last opened the app, and the name on the page if you typed one. Never the names of habits or identities, “after what”, “at what time”, the pin or the recovery secret. The link is random, and it is the only thing that protects the page: anyone who has it can open it, nobody can find the page without it, and search engines do not list it. Turn the link off and the page stops existing.
• A picture or a film of your tree, when you share one. The app makes it on your phone and hands it to the phone’s share menu; where it goes from there is up to you, and it does not pass through our server.
• The online copy, for moving your tree to a new phone. It is made by itself, with no switch, and updated after your changes. It holds the whole tree, names included, but never the pin or the recovery secret. It is encrypted on your phone with a key made from your recovery secret, and only then uploaded to our server, together with a label for the phone that saved it (the kind of phone and 3 random characters, such as “iPhone · 3fa”) and the time. The recovery secret itself is never sent, so neither we nor anyone who takes the copy from us can read it. On an iPhone with iCloud on, it also goes to your iCloud: Apple keeps it under your own account, and the app does not encrypt it there.
• A problem report, only if you send one with “report a problem” in “more”. It opens an email to us with a table you see before sending: the app version, the system version, the screen size and the height of the system bar at its bottom, the text size, the phone’s language and region, the tree’s age, how many identities and habits it has and how many of those habits are growing, your shape’s number, whether Pro, “public link”, sound and “still mode” are on, and errors from this session — only their type, where in the app’s code they happened and the time, never their text. It has no habit or identity names and no recovery secret. The app keeps that error list only in memory while it is open, and it leaves only in this email. Like any email, it shows us the address you send it from.
• Ideas and feedback, only if you send them with “ideas & feedback” in “more”: your text, the app language, the app version, whether the phone runs iOS or Android, and your email address only if you type it in, so that we can reply. Nothing else goes with it: no name, no tree, habit or identity names.

reminders

Reminders are scheduled by the phone itself and never leave it: no server of ours sends them. When a pin is set, a notification does not name the habit; it says “It is time for one of your habits.”

purchases

Purchases go through the App Store or Google Play. The store tells the app that something was bought; your name, card and address stay with the store and never reach us. Purchases belong to your store account, not to the tree: they stay when you erase the tree, and on a new phone in the same store “restore purchases” in “more” brings them back. A purchase made in the App Store does not come back in Google Play, or the other way round.

the website

The front page of ripen.day, its demo tree and public tree pages come from our own site, fonts included: no page loads anything from Google or any other outside server. This site sets no cookies and has no analytics script on any page.

The app itself carries its fonts inside it and loads none from outside.

what our server holds

Five kinds of record, and nothing else.

• A published tree’s shape, under its link: the list above — and a picture of that tree, used as the preview when the link is shared. Your phone draws that picture and stamps it with the day it was drawn, so an old preview is dated, not wrong. Both are there only while “public link” is on. Turning the link off or erasing the tree deletes both.
• The online copy, from every phone: the encrypted block, the phone label, the time it was saved and a version number. It is kept under an address worked out on your phone from your recovery secret, until you erase the tree. We cannot read it.
• A record for each link that was ever turned on: the random part of the link, a random salt and a hash worked out from your recovery secret. It proves which tree the link belongs to, so nobody else can take it. It stays after the page is gone; see below.
• Ideas and feedback you sent: the text, the app language, the app version, iOS or Android, the time it arrived and, if you typed it in, your email address. We use that address only to reply to that message. A message without it points to no one, so we cannot reply to it or tell who sent it.
• An address on the launch list, if you left one on our website: the address and the day it arrived, and nothing else. We use it for one message — the day RIPEN is in the stores — and the whole list is deleted once that message is sent. Write to us before then and yours goes sooner.

Our site and server run on Cloudflare, so every request, with the IP address it comes from, passes through Cloudflare. Our server code stores no IP address and does not record who opened a page or saved a copy.

children

RIPEN is not directed at children. It asks no one, of any age, for their real name, age or location. It asks for an email address in two places, and both are optional: “ideas & feedback” in the app, and the launch list on our website.

deleting your data

There is no account here, so there is no account to delete. You delete your tree, its online copy and its public page yourself, inside the app, as soon as your phone can reach our server. Only ideas and feedback are deleted by asking us, as described below.

Turn off “public link” (in “more”, or with “link” in “tree”) and the public page stops existing: that link never works again, and turning it on later makes a new one. Offline, the page stays up until you try again.

“erase the tree”, at the bottom of “more”, erases the tree from your phone for good. At the same moment it deletes the online copy, from our server and from your iCloud, and takes the public page down. Our server can only be reached online: offline, the app erases nothing and tells you, because once the recovery secret is gone, nobody could remove what is left there. Then you can connect and try again, or choose “erase anyway”. Your pin and purchases stay.

Deleting the app is not enough. It removes the tree from your phone, but the online copy, on our server and in your iCloud, and the public page stay where they are. Use “erase the tree” first.

One thing stays, on purpose: the record for each link described above, with a random salt and a hash worked out from your recovery secret. It is what stops anyone else from taking that link after you leave it. It holds no names, no days and no recovery secret, and nothing can be recovered from it.

You can also ask us. Email hello@ripen.day from any address and say what you want deleted. We answer within 24 hours. We can delete a public page if you send its link, but while “public link” is on in the app, the page comes back with your next change, so turn it off too. We cannot find an online copy on our server by hand: it is kept under an address worked out from your recovery secret, which we never see. To delete it, use “erase the tree”.

Ideas and feedback cannot be deleted inside the app. If you sent them with your email address, email hello@ripen.day from that same address, and we delete every message that carries it. A message sent without an address points to no one, so we cannot tell which one is yours.

changes

This policy is the same in the app, under “privacy” in “more”, and on ripen.day/privacy. When it changes, the date at the top of the web page changes too.

---