Privacy

There is no account, nothing is measured, and we have no copy of your tree. Below is the whole of it: what stays on the phone, what can leave it, and what has to happen first.

Last updated 31 August 2026.

what stays on your phone

The tree lives in the storage of the phone you grow it on. There is no account and no sign-up, so we do not know who you are, and there is no copy of your tree on our side to lose, hand over or be asked for.

Nothing you do in the app is measured. No analytics, no crash reporting, no advertising identifiers, no third-party trackers of any kind. We do not know how many habits you keep, when you open the app, or whether you kept today.

These never leave the phone at all, under any setting: the names of your habits and identities, your cues and hours, your pin, and your secret phrase.

what can leave, and only if you ask

Three things, each behind a switch you have to turn on yourself.

• A public page for your tree. Turning the link on sends the shape of the tree to our server, so the page can draw it: the seed number, which days were kept or missed, the schedule, and the name you sign it with, if you sign it. Never the names of your habits or identities, never your pin, never your phrase. The address is random, it is the whole lock, and it is kept out of search engines. Turn the link off and the page is empty again.
• A picture you share. It is drawn on the phone and handed to the system share sheet. Where it goes from there is your choice, and we are not part of it.
• A copy for moving to a new phone. On an iPhone with iCloud turned on, the copy goes to your iCloud: Apple holds it under your own account, and it never touches our server. Without iCloud, the whole tree — names and all — is encrypted on the phone before it leaves, with a key made from your secret phrase, and only the encrypted block is uploaded. The phrase itself is never sent. We cannot read that copy, and neither can anyone who takes it from us. That is arithmetic, not a policy.

reminders

Reminders are scheduled by the phone itself, through the operating system, and never leave it. There is no push server here. When a pin is set, a notification stops naming the habit — the phone on the table says that something is due, not what.

payments

Anything you buy goes through the App Store. Apple tells the app that a purchase exists; your name, your card and your address stay with Apple and never reach us. What you bought is remembered by your App Store account, which is why it comes back on a new phone even though the tree does not.

this website

The demonstration tree on the front page and any public tree page load their drawing engine and fonts from Google’s static hosts (gstatic.com), which means those hosts see that a browser asked for a file. Nothing about your tree goes with that request. There are no cookies here and no analytics script on any page of this site.

The app itself carries everything inside it and asks nothing of those hosts.

what our server holds

Only what the two switches above put there: the shape of a published tree, under its random address, and an encrypted block for a tree in transit between phones. Both are removed the moment you turn the switch off. There are no logs kept of who read a public page.

children

RIPEN is not directed at children, and it collects nothing about anyone, of any age.

if you want it gone

Turn the public link off and the page stops existing. “Start over” in the app erases the tree on the phone, for good. There is nothing else anywhere to erase, and nothing to write to us for — though you can: hello@ripen.day.

changes

If this ever changes, the date at the top changes with it, and the app shows the same text as this page. One document, two places to read it.

---