Privacy Policy

The short version

Your content is encrypted on your device before it leaves it. What our servers hold is ciphertext. We have no key, no decryption path, and no procedure by which we could produce your content — for you, for our own support staff, or for anyone who asks us with a document. That is not a policy we have adopted and could quietly change; it is how the software is built.

The honest cost of that design is stated in full in section 06, and we would rather you read it now than discover it later: if you lose your password and your recovery code, your content is gone, and we cannot get it back.

The rest of this document is the specific version. It is longer because being specific takes more words than being reassuring.

Who this covers

This policy applies to postappclarity.com and to the applications published by Post App Clarity, currently NutHub for iPhone. Where an app has behaviour that differs from what is described here, the app's own App Store privacy disclosure and its in-app documentation govern that app, and we will say so explicitly in this document rather than leaving you to find the difference.

This website itself is a static site. It sets no cookies, runs no analytics, embeds no third-party media, and carries no advertising or social tracking pixels. There is nothing here to consent to, which is why you were not shown a banner. The web fonts are served from this site rather than from a font CDN, so loading a page discloses your IP address to us and to nobody else. We request no third-party resource of any kind.

What we collect

We separate two things throughout this document, and the separation is the whole point: content, meaning the material you create and store in an app, and metadata, meaning the records that have to exist for an account to function.

Content

Notes, entries, attachments, photographs, video, and anything else you record in the app. We collect this only in encrypted form. It is encrypted on your device, before transmission, with a key we do not hold. On our infrastructure it exists as opaque bytes with no structure we can interpret.

Metadata

This does exist, in plaintext, and we would rather list it exactly than describe it as minimal:

• The email address associated with your account, or the private relay address Apple issues if you used Sign in with Apple.
• Row identifiers — the database primary keys and foreign keys that associate encrypted objects with your account.
• Timestamps: when a record was created, when it was last modified, when your account was created, and when it was last active.
• Your subscription tier and its status, as reported to us by Apple.
• Storage paths — the object keys under which your encrypted files are stored, and their byte sizes.

That list is complete as of the date at the top of this document. If we add to it, we will change this section and change the date.

Permissions the app asks for, and what happens to what you give it

NutHub requests a number of iOS permissions. Every one of them exists to make something work on your device, and none of them results in data reaching us. We would rather list them exactly, including the ones that sound alarming, than let you discover them in a permission prompt.

• Location, when in use — draws your position on the map and sorts the roster by distance. It is used on the device, in the moment, and that is all: your location is never transmitted to us, never stored in a record, and never attached to an entry.
• Contacts — used only for roster import, and only for the people you explicitly tick. The contact card is parsed on the device and the fields you chose to import are encrypted like any other content. Your address book is never uploaded, in whole or in part.
• Calendar — write-only access, which is the narrowest calendar permission iOS offers. The app can add a date you asked it to add. It cannot read your calendar, and that is a structural limit rather than a promise: the permission it holds does not include reading.
• Photo library and camera — used only for the individual photographs and videos you choose to attach or capture. They are encrypted on the device before they leave it, and the stored bytes are ciphertext rather than images. The app does not browse your library and does not request full-library access to do it.
• Microphone and speech recognition — used for dictating an entry instead of typing it. Transcription runs on the device. The audio is not uploaded, and the resulting text is encrypted like anything else you write.
• Face ID — unlocks the app locally. It never falls back to your device passcode, no biometric data is available to the app in the first place, and none of it reaches us. iOS tells the app yes or no; that is the entire exchange.

What we do not ask for at all: your name, your phone number, your date of birth, or your postal address. We do not fingerprint your device and we do not build a profile of you.

If you write to us through this website

The form on the work page collects what you type into it: your name, your email address, a description of what you want built, the part you think is hard, and an optional budget band. That is not app content and it is not encrypted, because it is a message to a person and a person has to read it. It reaches us through our host's form service, described in section 09, and it is stored there and in our email. We keep enquiries for as long as the conversation is live and for twelve months after it ends, then delete them. We do not add you to a mailing list, because we do not have one.

How the encryption actually works

When you create an account with a password, that password is put through a key derivation function on your device to produce an encryption key. The password is never transmitted to us in a form from which the key could be derived, and the key itself never leaves the device.

If you sign in with Apple instead of choosing a password, a key is generated on the device and provisioned into iCloud Keychain, which is itself end-to-end encrypted between your own devices under Apple's control rather than ours. This is what allows the app to work across your devices without us holding anything that would let us read your content.

Every piece of content is encrypted with that key before it is sent. The server receives ciphertext, stores ciphertext, and returns ciphertext. Decryption happens on your device, after download, in memory.

We say end-to-end encrypted and we mean the ordinary technical sense of it: the endpoints are your devices, and the intermediary — us — is not an endpoint.

What we cannot do

We cannot read your content. This is worth stating as a list of the specific circumstances in which it remains true, because those circumstances are where privacy promises usually turn out to have been conditional.

• We cannot read it to help you with a support request. If you write to support and describe a problem with a specific entry, we can see that an encrypted object exists, when it was modified, and how large it is. We cannot see what it says, and we will tell you so rather than pretending to investigate.
• We cannot read it to moderate it. We have no ability to scan, classify, or review the content stored in an account, including automatically.
• We cannot read it in response to a legal demand. If we receive a valid legal order compelling production of a user's content, what we are able to produce is the metadata listed in section 03. We cannot produce plaintext content because we cannot generate it. We will not build a mechanism that would let us.
• We cannot read it to train anything. There is no model, ours or anyone else's, that is trained on your content, because there is no readable copy of it available to train on.

There is no administrative override, no support key, no escrow copy, and no internal tool that decrypts an account. If a future version of this software ever required one, this section would have to change first, and a change to this section is a change we would announce rather than publish quietly.

Losing access, stated plainly

If you lose both your password and your recovery code, your content is unrecoverable. Not difficult to recover, not recoverable through an appeal or an identity check or a support escalation: unrecoverable. Nobody at Post App Clarity can restore it, and nobody at Apple or at any of our processors can either, because none of them holds the key.

This is the direct consequence of everything in sections 04 and 05. A system in which we could rescue you from a forgotten password is a system in which we could read your content, and one in which somebody else could compel us to. We chose the other trade, and we are not going to soften the description of it.

Practically: write down your recovery code and keep it somewhere that is not the phone the app is installed on. The app will prompt you to do this when you create an account, and it will let you check that you still have it later.

Photographs and video

Media receives the same treatment as text, and we mention it separately because people reasonably assume that images are an exception. They are not. A photograph you add is encrypted on the device and uploaded as ciphertext. The bytes sitting in object storage are not a JPEG; they are an encrypted blob that happens to have a byte length. No thumbnail is generated on the server, because generating a thumbnail would require decoding the image, which would require the key.

What is visible to us about a media object is the same metadata as anything else: which account it belongs to, when it was created, its storage path, and its size.

The AI runs on your phone

NutHub uses Apple Foundation Models, which execute on the device. Content processed by those models is not transmitted anywhere. We want to be precise about the reason, because on-device is a claim that is frequently made loosely: it is not that we have chosen not to send your content to a model provider, it is that the application contains no network path that would carry it there. There is no API key, no inference endpoint, and no request that would deliver it.

We do not use any third-party model provider for content processing. We do not send prompts, embeddings, summaries, or derived features from your content to any external service.

Who processes data on our behalf

Three, and only three.

Supabase

Supabase provides the Postgres database, the authentication service, and the object storage that hold your encrypted data and the metadata listed in section 03. They hold ciphertext and metadata. They do not hold keys, and like us they have no means of decrypting content.

Apple

Apple operates Sign in with Apple, which we use for account creation where you choose it, and in-app purchase, which handles all subscription billing. Apple tells us your subscription tier and status. Apple does not tell us your payment details, and we never see your card, your billing address, or your purchase history beyond the subscription state of your own account with us.

Netlify

Netlify hosts this website and runs the form on the work page. Serving you a page necessarily discloses your IP address to them, in the same way any request for a file discloses it to the server holding the file, and anything you send through the form is stored in their dashboard until we delete it. They have no access to app content or to the encrypted data described above — this site and the app share a name and nothing else.

We do not use any other processor. No analytics vendor, no crash reporting service that receives content, no customer data platform, no email marketing tool holding your address for anything other than replying to you.

What we do not do

• We do not sell your data. Not your content, not your metadata, not your email address, not in aggregate, not anonymised, not to anyone, and not as part of an acquisition without telling you first.
• We do not run advertising networks and we do not embed ad SDKs.
• We do not run third-party analytics on your content. There is no product analytics tool inside the app that reports what you write or what your entries contain.
• We do not share your data with data brokers, people-search services, or anyone in the business of assembling profiles.
• We do not track you across other apps or websites, and we do not request App Tracking Transparency permission because we have nothing to ask permission for.

Deleting your account

You can delete your account from inside the app, without writing to us, without an exit interview, and without waiting for a support agent to process it. Deleting your account removes the account record and the encrypted objects associated with it from our database and our object storage.

Backups are the honest caveat. Our infrastructure keeps operational backups on a rolling window, and a deleted account may persist in a backup snapshot until that snapshot ages out, which happens within thirty days. Those backups contain the same ciphertext as production and are equally unreadable to us.

Deleting your account does not cancel a subscription you bought through Apple. Subscriptions are managed by Apple and must be cancelled in your Apple account settings; we cannot cancel one for you, and we cannot issue a refund for one, because we never received the payment directly. Section 07 of the Terms says the same thing from the billing side.

Age

Our apps are not directed to children, and NutHub in particular is rated for adults. You must meet the minimum age stated on the App Store listing and in the Terms to hold an account. We do not knowingly create accounts for people under that age, and if we learn that we have, we will delete the account.

Your rights over your data

Depending on where you live, you may have statutory rights to access, correct, export, or erase the personal data an organisation holds about you. We will honour those requests, and it is worth being straightforward about the shape of what you would receive.

• Access and export: we can give you the metadata listed in section 03 and a copy of your encrypted objects. We cannot give you a readable export of your content, because we cannot produce one — the app itself is where a readable export comes from.
• Correction: the metadata we hold that is capable of being wrong is your email address, and you can change it in the app.
• Erasure: deletion is in the app, and is described in section 11.
• Objection and restriction: we do not profile you and we do not process your data for marketing, so there is very little here to object to, but if you want to raise something, write to us.

Write to support@postappclarity.com for any of these. We will respond within five business days.

Changes to this policy

If we change this document we will change the date at the top of it. If a change is material — if it alters what we collect, what we can read, or who processes it — we will say so in the app and not only here. A privacy policy that quietly gains a clause is a privacy policy nobody can rely on.

Contact

Questions about this policy, or about anything described in it, go to support@postappclarity.com. Post App Clarity is a d/b/a of Post Clarity LLC.