There is no account, nothing is measured, and we have no copy of your tree. Below is the whole of it: what stays on the phone, what can leave it, and what has to happen first.
Last updated August 31, 2026.
The tree lives in the storage of the phone you grow it on. There is no account and no sign-up, so we do not know who you are, and there is no copy of your tree on our side to lose, hand over or be asked for.
Nothing you do in the app is measured. No analytics, no crash reporting, no advertising identifiers, no third-party trackers of any kind. We do not know how many habits you keep, when you open the app, or whether you kept today.
These never leave the phone at all, under any setting: the names of your habits and identities, your cues and hours, your pin, and your secret phrase.
Three things. Two are behind a switch you turn on yourself; the third, the encrypted backup, happens by itself — see below.
Reminders are scheduled by the phone itself, through the operating system, and never leave it. There is no push server here. When a pin is set, a notification stops naming the habit — the phone on the table says that something is due, not what.
Anything you buy goes through the App Store. Apple tells the app that a purchase exists; your name, your card and your address stay with Apple and never reach us. What you bought is remembered by your App Store account, which is why it comes back on a new phone even though the tree does not.
The demonstration tree on the front page and any public tree page load
their drawing engine and fonts from Google’s static hosts
(gstatic.com), which means those hosts see that a browser
asked for a file. Nothing about your tree goes with that request. There
are no cookies here and no analytics script on any page of this site.
The app itself carries everything inside it and asks nothing of those hosts.
Two things. The shape of a published tree, under its random address — that one is there only while the public link is on, and turning the link off removes it. And an encrypted block for moving a tree to a new phone, which is kept for as long as the tree exists: there is no switch for it, because a copy you have to remember to turn on is a copy you will not have when you need it. We cannot read it — the key is made from your secret phrase, and the phrase never leaves the phone. There are no logs kept of who read a public page.
RIPEN is not directed at children, and it collects nothing about anyone, of any age.
Turn the public link off and the page stops existing. “Start over” in the app erases the tree on the phone, for good — and asks our server to drop the encrypted copy at the same time, while the phrase that addresses it still exists. After that there is nothing of yours left with us, and nothing left to write to us about — though you still can: hello@ripen.day.
If this ever changes, the date at the top changes with it, and the app shows the same text as this page. One document, two places to read it.