Privacy Policy

Sensory Budget · Last updated 7 November 2026

Sensory Budget works out how demanding your day is likely to be. To do that it reads your calendar and, if you let it, health and noise data. Almost all of that stays on your iPhone.

This policy describes what the app actually does. Where something only happens if you agree to it, it says so. AI features and signing in wait for your yes; from version 1.5, signing in also turns syncing on. Usage analytics are the one exception: in the United States they start on, and you can switch them off in the app at any time. Everywhere else they wait for your yes too. An earlier version of the app had personalised notes on without asking; that grant has been withdrawn, once, on every phone holding it, because a setting nobody was asked for is not a setting anybody agreed to.

The short version

What stays on your iPhone

These stay on your device, apart from the exceptions each item names:

• Every Health reading. Sleep, heart rate, heart-rate variability, environmental sound levels, steps (or wheelchair pushes) and workouts are read from Apple Health, used on the device, and never uploaded: no value, no timestamp, no sample, under any setting. You choose which readings the app may read on Apple’s permission sheet. Health is only ever read. The app never writes anything back to Apple Health. Live readings are deleted after 48 hours. The database that holds what the app has read, and the small files behind your widgets, are kept out of iCloud and computer backups, so they do not leave the phone that way either. That also means a phone restored from a backup starts without your history unless syncing is on (from version 1.5, signing in turns it on).
  What the app works out from them is a different thing, and it can leave. Your morning figure moves with how you slept and with your resting heart rate, so with syncing on that figure is stored on your account, and with Anthropic allowed it is one of the numbers given to Anthropic. If you actively turned usage analytics on, how your check-ins compared with it also goes to our analytics service, in rough bands, with a few rating details that come from those readings (see Usage analytics below). So is a pattern like “noise seems to add to your load”, which the app learned from sound levels a wearable measured, when Anthropic is allowed. A conclusion drawn from a reading is not the reading, but it is not nothing either, and you should know it travels.
• Event titles stay on your phone unless you allow Anthropic. Before version 1.3, Anthropic gets a copy with names, numbers and links taken out (see AI features). From version 1.3, it gets your calendar events as written, the title included. Syncing never sends a title. The app reads titles to work out what kind of event something is, then keeps only the category, the times and a few anonymous details.
• Event notes, event places and guests’ names. Before version 1.3, none of these is sent, except that, if you allow Anthropic, a few short prep words are taken from notes you wrote yourself (like “photo ID”) and sent, and nothing else from them. From version 1.3, if you allow Anthropic, your calendar events are sent as written: the title, the time, the place, your notes on the event, and who is invited. Guests’ email addresses and links are never sent, in any version. See AI features.
• How you describe yourself. If you tell the app you are autistic, ADHD or AuDHD, burnt out, have sensory sensitivity or prefer not to say, that stays on the phone. It is never sent anywhere, and it never sets a cost by itself. It changes how soon the app trusts your own answers, and when it offers you a break. The drains you pick (like noise or crowds) are different: they are general words, and they are used as described under AI features, Usage analytics and Syncing.
• The name you are greeted by, and any words you write yourself, such as the name of a break. The one exception is a message you choose to send with Send feedback (see Feedback you send).

What’s on today?

The morning card keeps its picks, suggested tiles and your answers to “Did these happen?” on this iPhone only. Suggestions come from your calendar of the last eight weeks, earlier picks you answered Yes to, and starter kinds. A pick is an untimed budget line, never a calendar event. Its name, price and answer are not sent to the server or synced to another device. Delete everything removes them; a reinstall starts without them.

The morning notification is local, and the words it uses are written into the app. When it has something true to say about your day, it can name one of your calendar events by its title, but only a meeting, a presentation, focus time or exercise that has its own title and no health, legal or job-search word in it. Otherwise it gives the time only, and some mornings lead with a count or a number from your day instead. On some days it sends nothing. Titles are checked by their words, so a private appointment whose title reads like a work meeting can be named on your lock screen. The separate notification that asks “What’s on today?” keeps fixed words for a kind of thing and never names a calendar event or a custom title. If usage analytics is on, it records only fixed words for the part of the day, step, source, whether a price was a guess, a rough count of inferred tiles, and Yes or Not today. It sends no title, spoon figure or wake answer.

Motion & Fitness

From version 1.2 build29, the optional Drives feature is available on supported iPhones even with usage analytics off or while offline. It still requires Motion & Fitness permission. Turning analytics off makes no feature-flag request. A remote switch can still turn it off for everyone.

Where the drive feature is available, and only after Apple’s permission sheet, the app reads the last seven days of motion history on your iPhone to notice when you were in a vehicle, never where you travelled, and so to notice drives of 20 minutes or more that your calendar does not have. Your motion history never leaves the phone. Possible drives, your answers and usual drive patterns stay in a device-only ledger. Delete everything removes it; “Forget what it has learned” removes usual times and lengths while keeping drives you added.

A drive or ride you add becomes an ordinary Commute event in the app, never in your calendar. With syncing on, its times, category and cost sync like other logged events, never its title. After you confirm a usual drive, matching drives can count automatically, with an Undo each time. A possible drive does not sync.

From version 1.7, a drive of 20 to 29 minutes, or a trip whose longest drive is under 30 minutes, counts by itself, with a counted row on Day and an Undo: no card, notification or rating prompt. Like a drive you add, it is an ordinary event: its times, category and cost sync when syncing is on, never its title. You can switch that off under Motion & Fitness (Count short drives by themselves). A drive of 30 minutes or more is still asked about before it counts.

If usage analytics is on, it records only rough bands for duration, legs and the proportion of time in a vehicle, and fixed words for how and where you answered. From version 1.7 it also records when the short-drive switch is changed and when a drive counted quietly, as words. It sends no time, place, title or motion record. Permission answers are recorded like the app’s other permission answers. Drive notifications are local. You can switch reading off under Connections › Motion & Fitness, or in iOS Settings.

Your account

Sensory Budget does not require an account. Every part of it works without one, and there is no sign-in step anywhere in front of the app. If you want your history to survive a new phone, or to reach a second device, you can sign in with Apple or with Google at any time. It is offered and never required.

Our authentication provider stores the stable user ID that Apple or Google gives us, and the email address they return. If you use Sign in with Apple and choose “Hide My Email”, that address is Apple’s private relay, and we never see your real one. If you use Sign in with Google, our authentication provider also keeps the name and the link to the profile picture that Google returns. They sit with your account, are used for nothing, never appear in the app, and are removed when you delete everything. Sign in with Apple keeps no name. Nothing else about your identity is kept. There is no name or email column in our own database, and the app itself keeps no name: the greeting name stays the one you typed on your iPhone.

From version 1.5, signing in turns on syncing. Before 1.5 it did not. If you were already signed in, syncing turns on when you update to version 1.5, unless you had turned it off before. If you turn syncing off, your account holds a user record, a random salt used for scrambling identifiers, your time zone and your privacy choices. Three other things can reach it without syncing, and only if you allowed Anthropic: a daily note our server phrased for you; a one-way fingerprint of the event title that was sent, so the same title is not paid for twice; and a daily count of how many requests those two made. All three are described below.

If you allow Anthropic without signing in, the app still needs a way to reach our server for AI features, so it makes an anonymous account, only after you tap Allow. It has no email, no name and no sign-in provider. It holds your privacy choices, the random salt, a UTC time zone (your phone’s own time zone is never sent for it), the daily request counts and the notes written for you. It cannot sync. If you sign in later, Apple or Google is linked to it and it becomes your account. If that Apple or Google sign-in already has an account, that account is used instead, and the anonymous one is left behind: it is not deleted at that moment, and it expires after 60 days without use. One nobody uses for 60 days is deleted, and Delete everything deletes the one you are using. If you never allow Anthropic and never sign in, no anonymous account is made and we hold no account for you. The app still asks our server for the published starting numbers (see The numbers the app starts from), which sends nothing about you, and a message you send with Send feedback is stored (see Feedback you send).

If you sign in with Apple, Apple gives the app a one-time code, and our server swaps it for a refresh token from Apple that it keeps, out of reach of the app and of everyone else, until you delete your account. It is used for one thing: when you delete your account, we send it to Apple to revoke, so Sign in with Apple stops working for Sensory Budget, and then we remove it. If you sign in with Google, nothing like it is kept.

Each AI request also carries a proof from Apple (App Attest) that it came from this app on a real iPhone. Our server keeps that install’s App Attest key and a count of its requests, with no account ID attached, and uses a scrambled form of your network address, kept for two days, only to limit how often requests can be made.

What you choose

AI features: Anthropic, only if you allow it

While you set the app up, its last question is “Turn on AI features?”, and its first line names Anthropic. Anthropic is a third-party AI service. If you allow it, it writes your daily note and sorts events the phone cannot place, and the app reaches it through our servers. The question has two buttons, Allow Anthropic and continue and Not now. Neither is chosen for you. Nothing is sent to Anthropic, and no anonymous account is made, until you tap Allow. After Not now, nothing is sent, and Today still shows a summary written on your iPhone. From version 1.3, what Allow covers is wider: your calendar events are sent as written, as the list below sets out.

You can change your answer at any time under You › Settings › Privacy & data › AI features. Turning it on there asks with the same two buttons. Turning it off stops everything below at once.

Anthropic’s model never produces or changes a number in your budget. It writes words and suggests categories, and your own answers always outrank it.

Syncing

When you turn syncing on, a derived version of your budget is stored so a new phone can restore it: the times, categories and costs of your calendar events (never a workout from Apple Health), your ratings, each kept with how long the thing you rated lasted and when, your model’s learned numbers and your settings, and, for each day, the sleep, heart-rate-variability and resting-heart-rate points the morning figure was built from (points on the app’s own scale, never the raw readings or their timestamps). Each learned answer also carries the starting number for its kind of event that your phone was using when it learned it, which shows which set of starting numbers your phone was on (see The numbers the app starts from). Identifiers are scrambled with a key unique to you (HMAC-SHA256), and no event title, name or free text is included.

Smarter event classification

Some events are hard to categorise from their shape alone. If you allowed Anthropic, the redacted title of such an event may be sent to Anthropic’s language model, through our server, to be classified. The category it answers with, and any tags, are kept on our server beside a one-way fingerprint of that title, so the same title is not paid for twice. Separately, if you allowed Anthropic, the whole event as written (the same content as the list above) may be sent to be tagged, and the answer is a few words from a fixed list, such as family, colleagues, presenting or medical, plus a short label for the kind of event (such as “team meetings”). The phone keeps them; our server keeps nothing from these whole-event requests, and the words are never sent on to anyone else. When its set of labels has changed, the phone also sends just the labels, once in a tagging pass, with no title, place or person, so that different spellings of one kind of event can be grouped. Mostly the events sent are the ones your phone’s own word lists leave untagged or cannot place; an event the phone has already tagged, and one for each repeating title, can also be sent once, only to be given its label. Before it leaves the phone, email addresses, web links, phone numbers and digits are removed, and every word that is not a known calendar or everyday word is replaced with [name] or [word], so names are taken out: “Joseph : Oshin meeting” is sent as “[name]: [name] meeting”. The one exception is a name that is also an ordinary word when nothing marks it as a name: “Will review roadmap” keeps “Will”. The model never produces a score. It only suggests a category, and your own answers always outrank it.

Apple’s on-device model

On an iPhone with Apple Intelligence switched on, a title the app cannot place from its own word lists may be read by Apple’s on-device model, which suggests a category. This happens entirely on the phone: nothing is sent to us or to anyone else, so there is no setting for it. Like the server model, it only suggests a category, and your own answers always outrank it.

The line under an Insights card

Only if you allowed Anthropic, and from version 1.5. Under an Insights card that rests on calendar events, the app can show one plain sentence about what those events have in common, such as “Both are early morning flights.” To write it, our server sends Anthropic up to six of the events behind the card: the title, the weekday, the start time, the place, the first 300 characters of your notes and how many other people were invited, never their names, an email address or a link. It sends nothing from Health, nothing about what the card found, no rating and nothing you said about yourself. Your phone checks the sentence again and shows it only if it passes the app’s own checks; it is made once for each card and set of events, at most 12 times a day, and kept on your iPhone only. Our server stores nothing from the request.

Your daily note and event understanding

Only if you allowed Anthropic. Then the one-line note on the Today screen is phrased by Anthropic’s language model, through our server, and so is the short read of your coming events (what an event is, how to get ready, what to bring) and the one line about the week ahead. What it is given is the list above: your phone’s own figures for the day, the kind of each event, your events’ titles (with names, numbers and links taken out before version 1.3, as written from version 1.3), their times, a few prep words, and from version 1.3 each event’s place, notes and the names of the people invited, as written. General words about what helps or drains you, up to three of the patterns the app has noticed about you, and the heavy days of your week. Your phone, not the server, puts an event’s own title into the note. The note cannot invent a number: anything it writes is checked against the figures your device sent (and, if you allowed location, the one temperature our server looked up) and thrown away if it does not match.

From version 1.8.2, an all-day calendar entry that the app cannot tell apart from a birthday, a holiday, an out-of-office or a deadline by its title alone (an outing, a trip, a conference or a moving day, for example) is included in the same way and under the same setting: its title as written, and for the note and the read of your events, its place if your calendar has one, its weekday and how many days it spans. No times, notes or names of people invited are sent for these entries.

No Health reading is among them, and this is the distinction worth being exact about. Anthropic is never given a heart rate, a decibel figure, a sleep duration or a timestamp for any of them. It is given your morning figure, which your phone worked out partly from how you slept and from your resting heart rate; and a pattern it is given may be one the app learned from sound levels, such as “noise seems to add to your load”. So what Anthropic sees is shaped by your health without containing any of it.

Off means nothing leaves, not that we decline it on arrival. Before you tap Allow, after Not now, and whenever the AI features row is off, your phone never composes the request, so the day’s categories, times and costs are not sent and then refused. They are not sent. The same is true when we turn the feature off from our end: your phone checks that before it builds anything, from a setting it already holds, without asking the network.

The note our server writes is kept on the server for 30 days, so the same day does not have to be phrased twice. The facts your phone sent to produce it are not kept. Only a fingerprint of them is, used to recognise the same day again. The read of your events is not kept on our server at all; your phone keeps each answer for about 30 days, so a recurring event is read once.

Usage analytics, crash reports and freezes

When it is on. If your App Store country is the United States, usage analytics are on until you turn them off. Everywhere else, including when the app cannot tell your country, they are off until you say yes to a question the app asks once, from your second day, with two buttons, Share and Not now. Tapping Share, or turning the switch on yourself, is what this page calls actively turning usage analytics on. The switch is always yours, under You › Settings › Privacy & data › Usage analytics and crash reports, and it works the same whether or not you have signed in. While they are on, the analytics service also tells the app which features are switched on for this install (the What’s new sheet, the weekly suggested questions and drive reading), and the app sends nothing more about you for that than the random install ID described below. With analytics off none of that is asked, and each keeps the setting built into the app.

What is sent. Every name comes from a fixed list written into the app; nothing is free-form. That covers which screens you open and for how long; the actions you take, such as rating an event, finishing a check-in, answering a permission request, starting a purchase or tapping Skip; after an update, the What’s new sheet and the rating ask: which one came up, which item you opened, and which of Rate, Send feedback or Not now you tapped (Apple does not say whether you rated, so that is not recorded); the update check’s screen or card: that it appeared, and whether you tapped it or dismissed it; the one-time alarm question for a break’s end, granted or denied, and whether the sound when a break ends is on; which Log tonight cards you answered, set aside or took back; which Insights explanation you opened (the sheet that says what a measure means, with no measure named and no reading), and whether the one-time “Tap to open” hint on Insights was shown and whether you then opened a card by touch; how long the first screen waited for your data, in bands; how a break you logged helped, as one of four words (made it worse, not really, a bit, a lot); how the app was opened (from a Home Screen or Lock Screen widget, the Live Activity, a notification, Siri or a Focus filter) and that a background refresh ran; how a sync ended (synced, offline, refused) and when your subscription changes state (a trial started, a renewal turned off, an expiry), as a word, with no prices or dates; that an AI call was made, which kind, how it ended and how long it took, never what was sent or what came back; which Details row on Privacy & data you opened; errors, with quoted text, email addresses, links and long numbers removed; crash reports, moments when the app froze and a summary of how the app last ended (from Apple’s MetricKit), with the last steps you took from the same list; how rough scrolling was, and how much processor time and how much time in the foreground and the background the app used over a period, in bands (also from MetricKit); how long you have had the app and your plan (trial, subscribed or expired); and whether calendar, Health, notifications, AI features, sign-in and a watch are connected, whether the Watch app is installed and how many widgets you have on your Home or Lock Screen, never what they contain. Learn reports a topic, and topics that name a condition are reported only as “condition”, so which condition’s article you read is never sent. The analytics service adds the app and iOS version, the device model, your language and a random ID for this install, and every event says which set of starting numbers your phone is using. Crash reports that iOS itself collects (through Apple’s MetricKit) are sent the next day with the code location only, under the same switch.

How accurate the estimates are. So we can tell whether the numbers are right for real people and make them better, each rating you give is sent with the estimate you were shown: the estimate in points, whether it was the app’s own starting number or one your earlier ratings had already shaped, the word you picked, the kind of event (a meeting, a meal, a medical appointment), how long it was in steps of a few minutes, the part of the day, whether it came straight after another event or sat in a packed stretch, whether it was your first of that kind, how many ratings you had given before, whether the app asked or you rated on your own, how long after the event you rated, how sure the app was, roughly how many people were there and what kind of place it was, the drains you picked when setting up (like noise or crowds), and which version of the app’s numbers you had. Never the event’s title, its exact time, its place or anyone in it.

Some things exist only because your sleep, heart or noise readings said so, so they wait until you have actively turned usage analytics on. In the United States, until you tap Share or switch analytics on yourself, they are left out. They are: from each rating, whether you started the day with a low budget, whether it was late in your waking day, whether your watch measured anything during the event (never what it measured) and the “poor sleep” drain if you picked it; any rating of a workout Apple Health recorded, and the prompt to rate it; how your morning and evening check-ins compared with the app’s morning number and its forecast for the day, in rough bands; whether your first budget used your sleep; the card about a heavier stretch and your answer to it; the “load rising” alert, including a rest you start from its “Take 10 min” button, and the “today went better than expected” note; and a refresh that new Health data started. Once you have turned analytics on, they are sent.

What is never sent: any event title, exact time (to the minute), place name or anyone in it; any Health reading; anything you typed, or how you describe yourself (autistic, ADHD and so on, including by way of which article you read); your name, email or account ID; or Apple’s advertising and vendor identifiers. There is no screen recording and no tap tracking, and the service is set to discard your IP address. PostHog analytics are never linked to your account and never used for advertising.

Health readings, calendar events, event titles, ratings and anything you type are never sent to Meta. When the app is installed, each time it is opened, and when a free trial starts, Meta is told so we can see which of our ads work. This happens only while usage analytics are on, and only while the app is open on screen. Meta receives our Meta app id, the event (an install, an open or a trial start), the time, an anonymous install id, the device model, iOS version, language and region, time zone, screen size, the app’s version and build, the name of the screen that was open (a code name, never anything typed) and the connection’s IP address. The trial signal has no price, no currency, no product, no value and no name in it. Automatic features in Meta’s tools that could read what you type are kept switched off, and we check this before every release.

Off means off. The analytics service is not started on your phone, and nothing reaches it, until usage analytics are on. Turned off after being on, it stops, and what it was holding on your iPhone is removed: the events waiting to be sent, its random install ID and any crash report waiting to go. Turned on again, it starts fresh under a new random ID. Delete everything removes the same things.

Feedback you send

You › Settings › Send feedback sends what you type (up to 4,000 characters) and the kind of feedback it is, to our server and nowhere else. If you tick “Include app details”, it also sends the app version, your device model, the iOS version, the screen you were on and the last 60 steps you took in the app (screen and button names, never anything you typed), which the app keeps in memory on your phone until then. Nothing is added if you leave it unticked.

Feedback is stored on our server (Supabase) with a random code made for this install. If you are signed in it is also tied to your account, so Delete everything removes it. If you are not signed in, the report also carries the random install ID that analytics use, when analytics are on, so we can match it to what happened. If you are signed in the install ID is not attached. Our server drops it whenever an account (a sign-in, or the anonymous account AI features make) is attached to a report, removes it from the earlier reports of the same iPhone at that moment, and stores any later report from that iPhone without it. So no stored report connects your account to your analytics ID, not even through the random code that the reports of one iPhone share. That code still shows that reports came from the same iPhone. Feedback is kept for at most one year, and Delete everything removes what this iPhone has sent.

The numbers the app starts from

Before the app has learned anything about you, it starts from numbers for what a typical meeting, meal or commute costs. We test changes to those starting numbers the way any app tests a change, and publish the current ones on our server. The app downloads them at launch without an account and without sending anything about you (only the network address any request carries), whether or not any switch is on; if it cannot, it keeps the last numbers it had or the ones built into the app. Your own ratings always keep their say: a change moves where new estimates start, not what you have already taught the app. A new set can reach some phones before others, chosen at random on your phone, and about one in ten phones always keeps the numbers built into the app, so we can check that a change is an improvement. Which set your phone uses is sent with usage analytics while they are on, and, if you turn syncing on, can be read from the learned numbers that sync stores (see Syncing). We can also switch the published numbers off. Your phone checks at most once a day, so that takes effect at its next daily check, within about a day, and shows from the next time you open the app. The app also asks our server, without an account and without sending anything about you (only the network address any request carries), whether this version may still run or should be updated. It asks once after a launch and at most every six hours after that (once a minute while the app is blocked, so a mistaken block lifts quickly, and fifteen minutes after a failed ask), keeps only the last answer on the phone, and carries on as normal if it cannot reach us. If a check finds the app blocked, the phone may post one local notification. With usage analytics on, we count whether the update screen or card appeared and what you did with it.

Location, weather and Leave by

If you allow it, the app asks for your approximate location (an area of a few kilometres, never a precise position) for two things: so the daily note can mention weather that may cost you, such as a heatwave or a storm, and so it can tell you when to leave for an event that has a place (Leave by).

• It is read once, when your day is planned. Never in the background.
• It is stored nowhere. It exists for the length of one request.
• For weather, our server looks the forecast up on your behalf, so the weather service never sees you.
• For Leave by, Apple Maps on your iPhone works out the trip. The event’s place, read from your calendar when it is needed, and your approximate area go to Apple Maps, the same as any Maps lookup on your phone. None of it goes to our servers, to Anthropic or to analytics, and Apple’s own handling of Maps requests applies. This is separate from the AI features, where from version 1.3 your calendar events, as written, can reach Anthropic.
• From version 1.8.2, the quiet spot on Today’s note works the same way. For an event with a place, Apple Maps on your iPhone looks for a park, library or cafe within a short walk of it. The event’s place goes to Apple Maps for that search, the same as for Leave by. None of it reaches our servers, Anthropic or analytics, and no new permission is asked.
• If you decline, there is no fallback. Your own location is never sent, and the note simply has no weather in it. Event places are a separate matter: from version 1.3, if you allow AI features, they can reach Anthropic as part of your calendar events, whether or not you allowed location (see AI features). We do not infer your location from your time zone or your IP address.

The weather never changes a number. It only changes wording.

Calendars

Apple Calendar is read on the device through iOS. Nothing about it crosses the network for that to work, including calendars from a Google account you have added to your iPhone in Settings. This is how the app reads your calendar today.

Google Calendar, connected directly: not in the current version. This version of the app does not offer to read Google Calendar directly and reads nothing from Google’s calendar servers. If you added a Google account to your iPhone in Settings, its calendars are read through iOS like any other. If a direct connection is offered again, it will use read-only access, and this page will say what it reads before the app asks you.

Subscriptions

Subscriptions are sold by Apple and managed through your App Store account. We use RevenueCat to tell whether your subscription is active. They receive an identifier for you (your account ID once you are signed in) and the purchase details Apple provides; they do not receive your health, calendar or budget data. From version 1.8, while usage analytics are on, RevenueCat also receives Apple’s own attribution token once per install, so it can ask Apple whether one of our Apple Search Ads campaigns brought the install and which one; the app does not use the advertising identifier or show a tracking prompt. Cancelling is done in your iPhone’s Settings, as Apple requires.

Who else handles your data

We do not sell your data. Apart from the install and trial signals to Meta under Usage analytics, we do not share your data for advertising, and nobody below may use it for their own purposes. Each is used only for the job named here, and each is bound by terms that protect your data at least as well as this policy does.

• Supabase runs our database, sign-in and server functions. Everything described above as reaching “our server” or “your account” is stored there, including the published starting numbers the app reads and any feedback you send.
• Anthropic, only after you tap Allow Anthropic and continue. Our server sends it what is listed under AI features, and nothing that says who you are: no account ID, no email address of yours, and not your phone’s location. An event’s own text can include names and places, and from version 1.3 your calendar events are sent as written, as AI features sets out. Under Anthropic’s commercial terms it may not train its models on what we send, and by default it deletes API requests within 30 days, but it may keep some longer, for example to enforce its usage policy, where the law requires it, or under terms agreed with us.
• RevenueCat checks whether your subscription is active and, with usage analytics on, which Apple Search Ads campaign brought an install (see Subscriptions).
• PostHog, in the United States, receives the usage analytics, crash reports and freezes described above, only while usage analytics are on. It is set to discard IP addresses and keeps these events for one year.
• Meta (Facebook) gets the install, open and free-trial signals described under Usage analytics, only while usage analytics are on, so we can see which of our ads work.
• Apple and Google, only if you sign in with them. They see that you signed in to Sensory Budget; they do not receive your budget, health or calendar data from us. Apple also handles your subscription and, on your iPhone, the Maps lookup for Leave by.
• Open-Meteo looks up the weather for the daily note, if you allowed location. Our server asks it for a rounded point and a time zone, so it never learns who is asking.

How long things are kept

* When you delete a single rating or logged break, it disappears from the app at once and stops affecting anything. If your phone has not yet managed to tell our server, because it has been offline or because the request keeps failing, a hidden copy of that entry stays on the phone until it can, because that copy is the only thing that can carry your deletion to the server. There is no time limit on that: we would rather hold something on your own phone, where nothing shows it and “Delete everything” wipes it, than leave a copy on a server you were told was gone.

Deleting and exporting

Delete everything is in the app, under Settings › Privacy & data. It works in this order, and the app holds off AI features and refreshing while it runs. It removes the feedback this iPhone sent first, and if that fails nothing else is removed. Then it removes every row we hold and your account itself, and the anonymous account AI features are using, if there is one, and revokes your Sign in with Apple token if you signed in with Apple. Then it signs you out, cancels pending reminders, disconnects Google Calendar if it was ever connected, and wipes the database on your phone, together with the events waiting to be sent to the analytics service, its random install ID and any crash report waiting to go. It also removes the breaks and events Sensory Budget itself added to your calendar, past and future, because that is the one place its data was ever visible to anyone else. Nothing else in your calendar is touched, and Apple Health is not touched at all.

If your phone cannot reach our server at that moment, nothing is deleted and the app tells you, so that you are never left believing a copy is gone when it is not. You can try again. If our server had already removed your account when something later failed, trying again only wipes your phone.

If you signed out earlier, your iPhone no longer has a sign-in to prove the account is yours, so Delete everything cannot remove that account from our server. It removes the feedback, the anonymous account (if there is one) and everything on your iPhone. The account you signed out of stays on our server until you sign in again and use Delete account under You › Account.

Usage analytics are never linked to your account, so “Delete everything” cannot find what the analytics service already holds. It stays at PostHog until its year is up. Turning usage analytics off stops anything more being sent.

Export gives you a JSON file of everything held on the device, including the titles and the self-description that never left it, because it is yours. Five things are left out: the live heart-rate and noise readings that are deleted after 48 hours anyway, the queue of things still waiting to be sent, the secret key the app uses to scramble identifiers, the random number that decides which set of starting numbers your iPhone uses, and the copy of the published starting numbers the app keeps. The secret key is left out on purpose: it is not information about you, it is what stops the scrambled values in the file meaning anything to anyone else, and a file you may share is the wrong place for it. The random number stays on your iPhone for the same reason, and the copy of the starting numbers is public and read again from our server.

Two things we cannot do for you: an Apple subscription must be cancelled in your iPhone’s Settings, and RevenueCat’s own customer record is removed on request.

Children

Sensory Budget is not directed at children and we do not knowingly collect data from anyone under 13.

Changes

If this policy changes in a way that affects what leaves your device, this section says so, with the date and the version the change starts in. The date at the top always reflects the current version.

9 October 2026: from version 1.3, if you allow AI features, the app sends Anthropic your calendar events as written: the title, the time, the place, your notes on the event, and who is invited, by name, and how many there are. Before version 1.3, titles go with names, numbers and links taken out, and the app sends no place name, no notes and no guest names; it sends only a few prep words from your notes. Nothing is sent unless you have allowed AI features. If you allowed them on an earlier version, version 1.3 keeps that choice and sends your calendar events as written to Anthropic. You can turn AI features off at any time under You › Settings › Privacy & data › AI features. Guests’ email addresses and links are never sent.

9 October 2026: the third-party AI service changed from OpenAI to Anthropic. From this date, AI requests from every version of the app are sent to Anthropic, through our servers. Versions of the app released before this date still name OpenAI on their screens. Version 1.3 names Anthropic on its screens and keeps the choice of anyone who allowed AI features on an earlier version. For versions before 1.3, what is sent and what is never sent has not changed.

29 October 2026: versions of the app before 1.3 no longer receive AI features from our servers; they use the on-device reading instead. Only version 1.3 and later send anything to Anthropic.

30 October 2026, from version 1.6 on the App Store (and the 1.5 test builds before it): signing in turns syncing on, and you can turn it off in Privacy & data. If you were already signed in, syncing turned on when you updated, unless you had turned it off before.

30 October 2026, from version 1.7: the app asks our server, once after a launch and then at most every six hours, whether this version may still run (an update check with no account, and nothing about you). Drives of 20 to 29 minutes can now count by themselves under Motion & Fitness, and you can switch that off. The suggested questions can now include the titles of events that repeat on three or more days. This update also sets out three things the AI features have done since version 1.5 that this page did not list: tagging with the whole event, the line under an Insights card and the weekly suggested questions. With usage analytics on, the What’s new sheet, the rating ask, the update check, the Insights cards and the alarm question send closed words about what you tapped or answered.

1 November 2026, from version 1.7.2: usage analytics also records that you opened the sheet that explains an Insights measure, whether the one-time hint on Insights played and whether you then opened a card; that you searched Settings, which row a search opened and how many results it showed, never what you typed; when the evening check-in or the morning notification stepped down or came back, and which button of the paused-evening notice you tapped; on notification reports, which of the app’s fixed wordings was behind a notification and its hour of the day, never a minute or any text; and, as closed words, where you opened the calendar sheet or the Health steps, and why Insights was read again after a change in what Health shares. It also records that the quiet row at the end of Insights about Health data not arriving was shown, opened or dismissed, as one of four words for its shape and never which kinds; that the finding card on Today in your first days was shown, opened or set aside, with the kind of finding or the word health; and, in bands, how many cards the Insights page had, how long a setup step’s work had run when it timed out and whether it was a second try, and how long the store call ran before prices failed to load. None of it goes anywhere except the usage analytics service, and only with usage analytics on. Separately, the morning notification can now name one of your calendar events by its title on your lock screen, as described under What’s on today?; that title is built on your iPhone and stays there.

7 November 2026, from version 1.8.1: with usage analytics on, the app tells Meta when it is installed, when it is opened, and when a free trial starts, as set out under Usage analytics.

7 November 2026, from version 1.8.2: if you allow AI features, an all-day calendar entry that the app cannot tell apart from a birthday, a holiday, an out-of-office or a deadline by its title alone is sent to Anthropic with its title as written, its place if your calendar has one, its weekday and how many days it spans, and never its times, notes or names of people invited. The quiet spot on Today’s note also sends an event’s place to Apple Maps on your iPhone, to find a park, library or cafe nearby; none of it reaches our servers.

3 November 2026, from version 1.8: with usage analytics on, the app lets RevenueCat, our subscription provider, receive Apple’s own attribution token, once per install, so that RevenueCat can ask Apple whether one of our Apple Search Ads campaigns brought your install, and which campaign, ad group and keyword it was. The token comes from Apple, not from the advertising identifier, and the app shows no tracking prompt. It is sent only while the usage analytics switch under Privacy & data is on. Turning that switch off stops further collection, but it cannot take back a token already sent; RevenueCat deletes it with your customer record when you ask.

Contact

Questions about this policy, or about your data: [email protected].