Privacy Policy

Who this covers

This policy applies to the Grounded iOS app (the "App"), published by Alexie Aristides, an independent developer based in Queensland, Australia ("we", "our"), and to the marketing and support website at getgrounded-app.vercel.app (the "Site"). Alexie Aristides is the data controller for the purposes of the EU/UK GDPR and Australian Privacy Act 1988. It is written in plain English and is the only privacy policy we publish; Apple's own Privacy Policy covers the App Store and the underlying Apple frameworks the App relies on.

Data the App handles

The table below lists every piece of personal information the App touches, where it lives, and whether it ever leaves your device. Nothing in this list is sent to a server we operate, because we don't operate one.

Your display name

Whatever you type on the onboarding screen. Stored in iOS UserDefaults on your phone, with a copy in the iOS Keychain alongside the device identifier below. Never transmitted.

Local device identifier

A random UUID generated once on first launch and stored in the iOS Keychain. Used only so the App can tell your installs apart on the same device. Never transmitted.

Step count

Read on request from Apple HealthKit on your device, with your permission — Health access is optional, and the App works without it (you simply earn through focus sessions and nature check-ins instead). Converted to credits locally. All processed on-device. Never transmitted.

Workouts

With the same optional Health permission, the App reads workouts you've logged in Apple Health — their activity type, start/end time, and duration — to convert eligible non-step workouts (cycling, swimming, strength training, HIIT, yoga, rowing, elliptical, stair climbing) into credits. Walking and running workouts are ignored (steps already cover them). Processed entirely on-device. Never transmitted.

Mindful minutes

When you complete a Mindfulness focus session, the App writes a Mindful Session entry to Apple HealthKit so other apps that read HealthKit can see it. Stored by Apple on your device, not by us. No write happens for Deep Focus or Movement sessions.

Location

Used while the App is in use — and in the background if you grant "Always" — to detect arrival at a park or nature spot for a check-in. Live coordinates are never sent to us or any server we operate. The App calls Apple MapKit to find nearby parks; that nearby-search request is processed under Apple's Privacy Policy, not ours. If you save a custom nature spot (Premium), the coordinates you pick are stored locally in SwiftData on your iPhone — not transmitted off-device by Grounded. The App also keeps a local record of the spots you check in at — name, coordinates, visit count and last visit — in SwiftData on your iPhone, so it can enforce the once-per-spot-per-day rule and show your history. Not transmitted.

Selected blocked apps

Picked from Apple's Family Activity Picker. iOS gives us opaque tokens we cannot decode. Stored in an App Group container on your device for the DeviceActivity extension.

Focus sessions, streaks, credits

Stored in SwiftData on your device. Never transmitted.

Emergency unlock reasons

When you use the once-a-day emergency unlock, the App asks what it's for. The words you type are saved on your iPhone (the last 30 are kept) so you can look back at them in Settings › Unlocking. Never transmitted, never included in usage statistics, and wiped by Delete Account & Data.

Analytics identifier

A separate random UUID, minted on first launch and stored in UserDefaults, used only for the anonymous usage statistics described below. It is one-way hashed on your iPhone before any signal is sent, and it is wiped by Delete Account & Data.

Settings passcode

If you set a passcode for Grounded's settings, only a SHA-256 hash of it is stored, in the iOS Keychain. Never transmitted.

Friend Key

From version 1.9 you can let a friend hold your passcode instead. Grounded generates a 6-digit code on your iPhone and you send it yourself, through whichever app you pick in the share sheet, as a link to getgrounded-app.vercel.app/key. The code sits in the part of the link after the #, which browsers never send to any server, so it never reaches us; the page decodes it in your friend's browser. On your iPhone only a SHA-256 hash of the code and the link itself are kept, in the iOS Keychain, and both are deleted when you turn Friend Key off or use Delete Account & Data.

Diagnostics

Apple's MetricKit may hand the App crash and hang reports about the App itself; the App keeps at most twenty of these as files on your iPhone for on-device troubleshooting. They are never sent anywhere by the App.

Subscription purchase

Purchases, renewals, refunds and billing are processed by Apple via the App Store and StoreKit 2 — those flows touch Apple's servers under Apple's Privacy Policy. Once purchased, Grounded checks your entitlement locally using Apple's Transaction.currentEntitlements API. We do not run a receipt server and never see your Apple Account, payment method, or order history.

Anonymous usage statistics (from version 1.6)

From version 1.6 the App sends a small set of anonymous, aggregate usage counts to TelemetryDeck (a privacy-focused, GDPR-compliant analytics service): app opened, paywall viewed, paywall dismissed, purchase started, purchase completed — and, from version 1.8.5, one daily summary per day you use the App. Nothing is sent until you have seen the privacy notice during onboarding. Each signal carries a random identifier that is one-way hashed on your iPhone before sending — it is never your Apple Account, email, name, device identifier, or anything else that could identify you, and TelemetryDeck hashes it again on arrival. Signals also include the app version and build number, a timestamp, which screen showed the paywall, a random per-launch session identifier (so sessions can be counted), a test-mode flag, and — for the two purchase events — which plan was chosen (monthly, yearly, or lifetime). The daily summary holds whole-number totals for the day just ended: credits earned (overall and per source — steps, workouts, focus, nature), unlock minutes used, repeat-unlock fees paid, how many unlock windows, quick checks and emergency unlocks you started, the credit balance left at midnight, whether you reached your daily unlock limit, whether you were on Premium, and the daily limit you set yourself (if any). It never includes step counts, places, which apps you unlocked, when during the day you unlocked them, or the reasons you type for an emergency unlock. We use these totals only to check that the credit system is fair — for example, whether the daily caps are too loose or too tight. No Health data, no location, no app list, no content ever leaves your phone. You can turn this off any time in Settings › Privacy › "Share anonymous usage statistics" — the switch takes effect immediately, and your choice survives even "Delete Account & Data".

These signals are received and stored by TelemetryDeck GmbH, Augsburg, Germany. TelemetryDeck's Data Processing Agreement (part of its Terms of Service, telemetrydeck.com/dpa) records that it handles only anonymised data and therefore acts neither as a processor nor as a joint controller under the GDPR; TelemetryDeck's own privacy policy is at telemetrydeck.com/privacy. We only ever see aggregate counts and charts. Because each signal is tied to a one-way hash of a random identifier rather than to you, we hold nothing that links a signal to a person and so cannot identify which signals are yours — the practical way to stop them is the in-app switch above, which stops any further signal immediately.

Data we never receive or transmit

For clarity: nothing in the "Data the App handles" table above is sent to us. Beyond the anonymous counts described above, we do not receive or store your name, email address, Apple Account, phone number, contacts, photos, device identifiers (IDFA/IDFV), advertising identifiers, diagnostics, crash reports, or usage analytics. We do not use Firebase in the iOS app, Google Analytics, Amplitude, Mixpanel, Adjust, Facebook SDK, or any other third-party analytics or advertising SDK. We do not fingerprint devices. We do not run a backend that could receive any of this even if it wanted to. Apple may also provide aggregated, opt-in App Analytics and crash reports to developers via App Store Connect under Apple's Privacy Policy; we do not use those reports for tracking.

If you email support, your message arrives in a Gmail inbox operated by Google — that is the one place we do receive personal data (your sender address, message content, timestamps, mail-provider metadata). Support emails are kept only as long as needed to handle your enquiry; we don't sell, share, or analyse them, and you can ask us to delete a thread at any time.

A note on Apple's privacy manifest. Apple's PrivacyInfo.xcprivacy manifest declares data an app collects — Apple's word for data transmitted off your device. Ours therefore declares only the anonymous analytics described above: a hashed random identifier ("User ID"), product-interaction counts, and which plan a purchase event referred to ("Purchase History") — all marked not linked to you and not used for tracking. Your Health data, location, and display name are processed strictly on your iPhone, are never transmitted, and so are not "collected" under Apple's definition.

Tracking

Grounded does not track you across apps or websites owned by other companies. The App's privacy manifest declares NSPrivacyTracking=false. The App Store "Data Used to Track You" label is empty. We do not participate in any ad network.

Third-party services used by the App

Apart from the TelemetryDeck usage counts described above, the only external services the App integrates with are Apple's own frameworks:

• Apple HealthKit — reads step count and workouts; writes mindful minutes. Optional. Governed by Apple on your device.
• Apple Family Controls / DeviceActivity — applies shields to apps you chose to block. The screen-time figures on the Progress tab (including the week-over-week comparison) are drawn by an Apple-managed report extension on your iPhone — that data never leaves the extension and we never see it.
• Apple MapKit — locates nearby nature spots.
• Apple Core Location — detects nature check-ins.
• Apple StoreKit 2 — processes and validates your subscription locally.
• Apple UserNotifications — schedules local reminders (end-of-window alerts, daily nudges). No remote push is used.

HealthKit, Family Controls, Core Location, and UserNotifications all execute on-device. MapKit and StoreKit are network-backed Apple services — they round-trip to Apple servers under Apple's Privacy Policy when finding nearby places or processing a purchase. In every case the data flows from your iPhone to Apple, not to us — we do not receive a copy.

The website

The marketing site at getgrounded-app.vercel.app is hosted on Firebase Hosting (Google) — used only as a static-file CDN for the website; the iOS app itself does not use Firebase. Firebase Hosting serves the HTML and may log standard HTTP request data (IP address, user agent, requested URL) as part of normal web-server operation. We do not place cookies, embed analytics scripts, or run third-party trackers on the site. A full description of Firebase Hosting's data handling is in Firebase's Privacy and Security documentation. This is the only third-party service that the website touches.

Children

Grounded is intended for use by people aged 16 and over (see our Terms of Service). It is not a parental-control product. We do not knowingly collect information from anyone under 16, and the App Store age rating is 4+ only because the App contains no objectionable content — not because it is intended for children. If you are a parent and believe your child has used Grounded, open Settings › Privacy Settings › Delete Account & Data in the App to wipe everything locally.

Your rights

Because we never receive your personal data, there is nothing on our side to access, correct, export, or delete. You control everything directly on your iPhone:

• Access / export: all data is visible inside the App. You can take screenshots or use iOS's own "On My iPhone" storage view.
• Deletion: open Grounded, go to Settings › Privacy Settings › Delete Account & Data — this wipes all local SwiftData, UserDefaults, App Group data, and the Keychain UUID. Note: the in-app delete also removes the Mindful Session entries Grounded wrote to Apple Health (as long as Health access hasn't been revoked); if you ever revoked Health access first, you can remove them manually via Apple Health › Browse › Mindfulness › Show All Data. Uninstalling Grounded usually removes the rest, but iOS Keychain items can persist across reinstall — use the in-app delete for a guaranteed wipe.
• Revoke permissions: Health, Location, Notifications, and Family Controls can all be revoked from iOS Settings at any time. The App degrades gracefully.
• Cancel subscription: Settings › your name › Subscriptions › Grounded Premium on iPhone.

If you are in the EU, UK, California, Australia, or another region with specific data-protection laws (GDPR, UK GDPR, CCPA/CPRA, the Privacy Act 1988), you have additional statutory rights including access, rectification, portability, erasure, and objection. Because we don't hold any of your data, the practical answer is the same: delete on-device and you're done.

Legal bases (EU/UK GDPR)

Where the GDPR or UK GDPR applies, the limited processing described in this policy rests on the following bases: the anonymous usage statistics are processed under our legitimate interest (Article 6(1)(f)) in understanding whether the App works, whether the paywall is seen and whether the credit system is fair — an interest we keep proportionate by collecting no identifying data at all and by giving you an in-app switch that stops it immediately; purchases and entitlement checks are processed by Apple, and locally by the App, because they are necessary to provide the Premium features you bought (Article 6(1)(b)); and support email is processed under our legitimate interest in answering you (Article 6(1)(f)). Health, location, and Screen Time data never leave your iPhone and are used only under your explicit iOS permission, which you can withdraw at any time in iOS Settings.

Complaints

If you think we have handled your personal information in a way that breaches this policy or the law, please email alexiedemo1@gmail.com with the word "Privacy" in the subject line. We will acknowledge your complaint within five business days, investigate it, and reply with our findings within thirty days. If you are not satisfied with our response you can complain to the regulator for your region: in Australia the Office of the Australian Information Commissioner (oaic.gov.au); in the EU your national data-protection authority; in the UK the Information Commissioner's Office (ico.org.uk); in California the California Privacy Protection Agency.

Data residency and retention

Your data lives on your iPhone. There is no data-residency question because there is no server. If you enable iCloud device backups, iOS may include Grounded's on-device data in your encrypted iCloud backup, managed by Apple. The anonymous usage signals described above are the one exception: they are stored by TelemetryDeck in aggregate, cannot be traced back to you, and are retained in accordance with TelemetryDeck's privacy policy; we do not keep our own copy.

Security

Local data is protected by iOS's file-system encryption (Data Protection). The local device UUID lives in the Keychain, which is hardware-backed on Apple Silicon devices. We do not transmit user data and therefore do not manage TLS, key storage, or access controls on a backend — because there is no backend.

Changes to this policy

If this policy changes, we will update the "Last updated" date above. If we ever add a feature that changes how data is handled — for example adding an optional cloud sync — we will update this policy and, where appropriate, ask for your explicit consent inside the App before the new feature is enabled.

Contact

Questions, concerns, or requests? Email alexiedemo1@gmail.com. We aim to reply within five business days.