Most privacy claims are about restraint: we could collect this, but we choose not to. That framing is worth distrusting, because a choice can be revisited the moment the incentives change. The stronger version is structural — there is no collected information, so there is nothing to revisit.

Four apps in, here is what that has actually meant.

It removes the easiest answer to every hard problem

“Sync it through our backend” solves an enormous number of design problems at once. Take it away and each one comes back individually.

Fast Tracker needed history on more than one device. With a server that is an afternoon: an account, a sync endpoint, done. Without one it became a real piece of engineering — the two devices discover each other on the local network over a shared protocol, pair with a one-time code, and copy directly. Harder to build, and the result is a sync feature where your fasting history never transits anything you do not own.

The same pressure shows up in small places. No account means no password reset flow, no email verification, no session handling — a large amount of software that simply never gets written, and never gets breached. Alot of information that is never collected, and thus never lost or leaked.

The database is the whole attack surface

When nothing leaves the device, the device is where the security work goes.

Period Vault stores everything through SQLDelight. On Android that sits behind SQLCipher, with the key wrapped by the Android Keystore, and allowBackup is deliberately disabled so Google’s device backup cannot quietly sweep up the live database. That last flag is on by default. Turning it off is a decision you have to make on purpose, and it is the kind of decision that only matters if you have already decided that the data is yours, and accepted that the data is never leaving.

For a cycle tracker this is not an abstract concern. The log is a record of whether someone is pregnant, trying to be, or has stopped being. “We don’t sell your data” is the wrong promise for that. “We never had it” is the right one, and it is checkable.

You end up documenting what you do not do

Apple requires apps to declare which sensitive APIs they use and why. Watch Cast declares three, each tied to the specific code path that needs it — file timestamps for its local store, user defaults for a per-device setting, boot time via MetricKit — in a rationale document kept next to the code. And published here for our users to be our auditors.

That document is more useful than any marketing sentence, because it can be checked against the source by external auditors. The privacy manifest for Wisdom Notifications is shorter still: no tracking, no data collected, no required-reason APIs. Notifications of Wisdom needs no access. So it asks for nothing.

What it costs

Honestly: features arrive more slowly, and some never arrive. There is no cross-device sync unless both devices are on the same network. There are no usage analytics, which means no data on which features matter — you find out by being told. Only when then user wants to tell that we get to know.

The trade is that the promise on the front page is a fact about the architecture rather than a policy we are choosing to honour this quarter. When someone asks what we hold about them, the answer is nothing, and it stays nothing whether or not we remain well-intentioned.