Privacy Policy
In short
- No account, no email address, no name. No analytics tools, no ads, no tracking. Nothing is sold.
- Your count, your reasons, your journal, your unsent messages and everything else you write stay on your iPhone. Holdfast has no server that receives them.
- The coach is the one exception, and only after you agree on a screen that says so: what you type to it goes through our relay to an AI service that writes the reply. The relay stores no message, reply or reason.
- Purchases go through Apple. We never see your card.
- You can export everything you wrote, or delete everything, in the app at any time.
1. Who we are
Holdfast is an iPhone app for people who have decided to stop contacting an ex. It is published by an individual developer, referred to here as “the developer of Holdfast”, “we” or “us”.
The developer of Holdfast is the controller of the limited personal data described in this policy and can be reached at app.holdfast@proton.me.
2. What we do not collect
- No account. The app never asks for your name, email address, phone number or a password.
- No analytics, ads or tracking. The app contains no analytics or advertising software, uses no advertising identifier and does not track you across apps or websites.
- No location, contacts, microphone or camera.
- No copy of what you write. Nothing you write in the app is on a server of ours.
- Nothing sold. We do not sell personal data and do not share it for advertising.
3. What stays on your iPhone
The following is kept on your device only:
- your count and its history;
- the contacts you logged and their notes;
- your reasons, and the photos you attached to them;
- your journal entries;
- your unsent messages;
- your check-ins;
- when you opened Hold on and how it ended;
- which lessons you read;
- your settings;
- your conversation with the coach.
It is kept in the app’s own storage, a private folder that only the app and its own widgets can read. iOS file protection encrypts these files when your iPhone has a passcode, and what you wrote cannot be read while the phone is locked. The files are included in your own device backups (iCloud Backup, or a backup to your computer) if you have backups turned on, under Apple’s terms and your settings.
The app has no server that receives any of this. We cannot see it, and we cannot recover it for you.
The widgets show your count. They never show your reasons or anything you wrote.
Export. You → Privacy → Export everything I wrote makes one text file with your count and its history, the contacts you logged, your reasons, your journal, your unsent messages, your check-ins and your conversation with the coach. Photos are not part of the file.
Delete everything. You → Privacy → Delete everything removes all of the above from the phone, including any export file the app made, after one confirmation. It cannot be undone. An export you saved or shared somewhere else is a separate copy that stays where you put it.
4. The coach: the one exception
The coach is a text conversation written by software. Nothing is sent until you agree on a screen in the app that says what is sent and where it goes, says that an AI service outside Holdfast writes the reply, and links to this policy, which names that service. If you never open the coach, or go back from that screen, nothing leaves your phone.
What is sent, over an encrypted connection (HTTPS), each time you send a message:
- what you type to the coach;
- the conversation so far (your lines and the coach’s, up to the last twenty);
- the day of your count, as a number;
- whether you logged a contact in the last three days (yes or no, nothing about it);
- the voice you chose (gentle or direct) and the language of the app;
- where the conversation was opened (from Hold on, or from the coach’s own screen);
- your reasons, in words, only if you switch on “Share my reasons with the coach”. It is off unless you turn it on, and you can turn it off again in the coach’s options;
- with the request, as headers: your anonymous identifier (section 5), the app version, and a proof from Apple that the request comes from a genuine copy of the app.
Your journal, your unsent messages, your check-ins, the notes on your contacts and your photos are never sent.
Where it goes. The request goes to Holdfast’s relay, a small program we run on Cloudflare (a Cloudflare Worker). The relay passes the text, with the coach’s instructions, to an AI service that writes the reply: OpenAI, through its API. The relay does not send your anonymous identifier to OpenAI.
What the relay does with it. Before returning the reply, it has the reply’s text checked by OpenAI’s moderation service, to filter out harmful output. It then returns the reply to your phone and stores no message, no reply and no reason. What it does keep is listed in section 7.
What OpenAI does with it. OpenAI processes the text to produce the reply. We ask it not to store the exchange (the API’s “store” option is off). According to OpenAI’s published policy, data sent through its API is not used to train or improve its models unless the customer opts in, and we have not opted in. OpenAI may keep requests and replies in its abuse-monitoring logs for up to 30 days, or longer where the law requires it. See OpenAI’s page on data controls in its API.
What you choose to type. What you tell the coach is up to you. It may touch on your health, your intimate life or other sensitive matters; by sending it after agreeing, you consent to its use for writing the reply. Please do not type names, addresses or phone numbers, yours or anyone else’s.
Changing your mind. You can withdraw your agreement at any time: in the coach, open the … menu → Voice and what is shared → Withdraw my agreement. Nothing more is sent until you agree again. The conversation stays on your phone unless you clear it, which you can do in the same menu. Delete everything also removes your agreement. Withdrawing does not affect what was processed before.
5. The anonymous identifier
When it first opens, the app makes a random identifier (a UUID) on your device. It is not derived from your name, your Apple account or your device. It is kept in the device Keychain, with a copy in the app’s settings storage. The app shows it under You → About → Support ID (tap to copy).
It identifies this install to two services: our relay, which uses it to count coach messages and check your plan, and RevenueCat, which manages purchases (section 6). Holdfast does not link it to a name or an Apple account. The relay turns it into a salted one-way hash at once and uses only that hash in what it stores and logs.
Delete everything does not remove this identifier (a purchase stays with your Apple account), and it can remain in the Keychain after the app is removed, so that the free coach messages and your purchases stay attached to the same install. To have the relay’s counters and the RevenueCat record deleted, write to app.holdfast@proton.me and quote your Support ID.
6. Purchases
Holdfast Plus is bought through Apple’s In-App Purchase. Apple handles the payment; Holdfast never sees your card details.
Purchases are managed with RevenueCat, which acts for us as a processor. It receives the anonymous identifier, the device’s identifier for vendor (IDFV, which iOS gives to the apps of one developer on your device), your purchase and subscription status, the App Store country, and basic device and app information (such as the app and iOS versions). The app contacts RevenueCat when it opens, to learn your plan and the current prices, whether or not you buy anything. When you use the coach, our relay asks RevenueCat whether that identifier has Plus.
7. What our relay keeps
The relay exists only for the coach. Under the salted hash, never under the identifier itself, it keeps:
- three counters: free coach messages used, coach messages sent today and coach messages sent this month (the daily one is removed when a new day starts and the monthly one when a new month starts, 00:00 UTC);
- App Attest data (Apple’s device-integrity check): the id of the key your device made, its public key, the date it was registered and a counter that stops a request from being replayed;
- your plan (Plus or not, and until when), cached for up to 24 hours so RevenueCat is not asked on every message.
Logs. The relay writes one line per request with metadata only: a request id, the salted hash, the endpoint, the status, the latency, the app version, the AI model that answered, token counts, and fixed codes for what happened (an error code, how the request was checked, which counter was used). The logs never contain what you typed, the reply, your reasons, your identifier itself, or whether a reply pointed you to crisis help.
Connection data. As with any internet service, Cloudflare, which hosts the relay, processes your IP address and standard request data to deliver and protect it. The relay itself does not record your IP address.
8. Notifications, Face ID, photos
- Notifications are local. They are scheduled on your phone by the app. There is no push server, and we do not know when one is shown. Your reasons and your journal never appear in a notification.
- Face ID is handled by iOS. If you turn on the app lock, iOS checks your face, your fingerprint or your passcode and tells the app only whether it passed. The app never sees biometric data.
- Photos are picked with the system picker. The app receives only the photo you pick and has no other access to your library. The copy it keeps stays on the phone.
- Crisis lines are listed by country. The app chooses the country from your iPhone’s region setting, on the device; it does not use your location.
- Apple’s reports. The app contains no crash-reporting tool. If you chose to share analytics with app developers in your iPhone’s settings, Apple may show us crash reports and usage figures that do not identify you.
9. Support emails and this website
If you write to us, we receive your email address and what you wrote, and use them only to answer you. If you report a reply of the coach (touch and hold the reply → Report this reply), the app opens an email to us with that reply’s text; nothing is sent unless you send that email, and it contains what you choose to send. Our mailbox is hosted by Proton. We delete support emails when they are no longer needed, and on request.
This website sets no cookies, runs no scripts and loads nothing from other sites. Its host, Cloudflare, processes your IP address and standard request data to deliver and protect it.
10. Service providers
We share data only with the providers below, only for the purposes described here.
| Provider | Role | Data | Where |
|---|---|---|---|
| Cloudflare | Hosts the relay, what it keeps (section 7) and this website | Salted hash, counters, App Attest data, plan cache, request metadata, connection data; the coach’s text in transit | Global network; requests are handled in a data centre near you |
| OpenAI | Writes the coach’s replies and checks them for harmful content | What you typed to the coach and the rest of the request listed in section 4, without your identifier | United States and other countries where OpenAI operates |
| RevenueCat | Purchase management (processor) | Anonymous identifier, identifier for vendor (IDFV), purchase and subscription status, App Store country, basic device and app information | United States |
| Apple | App Store, payment, App Attest, device backups | As described in Apple’s privacy policy | Worldwide |
| Proton | Support mailbox | Emails you send us | Switzerland and the European Economic Area |
We may also disclose information when the law requires it, for example in response to a valid court order. Because we hold no names and no content, there is very little we could disclose.
11. Where data is processed
What you write stays on your phone, wherever you are. The data described in sections 4 to 7 may be processed outside your country, in particular in the United States. Where the GDPR or the UK GDPR applies, such transfers rely on the safeguards those laws provide for: an adequacy decision where one exists, or standard contractual clauses in the provider’s data processing terms.
12. How long data is kept
| Data | Kept for |
|---|---|
| Everything on your iPhone | Until you delete it in the app, use Delete everything, or delete the app; and in your own device backups under your settings |
| What you type to the coach, and its replies | Not kept by our relay. OpenAI may keep them for up to 30 days for abuse monitoring, or longer where the law requires it |
| Daily coach counter | Until the day ends (00:00 UTC) |
| Monthly coach counter | Until the calendar month ends (00:00 UTC) |
| Plan cache | Up to 24 hours |
| Free-message counter and App Attest data | As long as the service runs, so the free messages stay correct, or until you ask us to delete them |
| Relay logs (metadata only) | A short period set by Cloudflare’s logging service: days, not months |
| Purchase records at RevenueCat and Apple | Under their own retention rules |
| Support emails | As long as needed to help you |
13. Purposes and legal bases
We use the data above only to run the coach, to manage purchases and the free allowance, to keep the service secure and fair, and to answer you. We do not use it for advertising or profiling, we make no decisions about you by automated means that have a legal or similarly significant effect, and we do not use what you type to train AI models.
Where the GDPR or the UK GDPR applies, the legal bases are:
- Your consent (Article 6(1)(a), and Article 9(2)(a) for any sensitive information you choose to type): sending what you type to the coach, and your reasons if you switch that on.
- Performance of a contract (Article 6(1)(b)): managing purchases, checking your plan and counting the free coach messages.
- Legitimate interests (Article 6(1)(f)): keeping the relay secure and preventing misuse (App Attest, the daily limit, metadata logs), and answering support emails. These interests are limited to what a small service needs to stay available, and involve no content.
What stays on your iPhone is not processed by us at all: we never receive it.
14. Your rights (EEA, UK, Switzerland)
Under the GDPR, the UK GDPR and Swiss law you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time without affecting what was done before. For an app that holds no account, this is what that means in practice:
- Access and portability. Nearly everything is on your phone. Export everything I wrote gives you a copy.
- Correction. You can edit what you wrote, and the date of your count, in the app.
- Erasure. Delete everything removes it from the phone. The conversation with the coach can also be cleared on its own.
- Withdrawing consent. See “Changing your mind” in section 4.
- What the relay holds (section 7) contains no content and is tied only to a salted hash. We have no name or email to look you up by (GDPR Article 11). Send us your Support ID (You → About → Support ID) and we will find these entries and delete them.
- Purchase records are held by Apple and by RevenueCat under the anonymous identifier. Write to us with your Support ID and we will have the RevenueCat record deleted.
Write to app.holdfast@proton.me. We answer within one month, and it costs nothing. You also have the right to complain to the data protection authority where you live or work: in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the FDPIC.
If you live somewhere else, the law there may give you similar rights (for example, the LGPD in Brazil). The same answers apply, and you can write to us at the same address.
15. California
This section is for California residents and uses the terms of the California Consumer Privacy Act (CCPA). We give you these rights whether or not the law applies to a developer of our size.
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past twelve months, including for anyone under 16.
- Categories collected in the past twelve months: identifiers (the anonymous identifier, its salted hash, the identifier for vendor sent to RevenueCat, and the IP address our hosts process in transit); commercial information (purchase and subscription status); internet or network activity (the request metadata in section 7); and, only if you use the coach, the text you type, which passes through to produce the reply and is not kept by us. All of it comes from your device.
- Purposes and recipients. We use it for the purposes in section 13 and disclose it only to the service providers in section 10.
- Sensitive personal information you may type to the coach is used only to write the reply, not to infer anything about you.
- Your rights: to know what we hold and to receive a copy, to have it deleted or corrected, and not to be put at a disadvantage for asking. Most requests are answered on your phone: Export everything I wrote and Delete everything. For the rest, write to app.holdfast@proton.me; you may use an authorised agent. As we hold no name or email, we check a request against the Support ID it quotes, not against your identity.
- Retention is set out in section 12. We offer no financial incentives for personal information.
16. Security
- Every connection is encrypted (HTTPS).
- Requests to the relay are checked with Apple’s App Attest, and the relay stores identifiers only as salted hashes.
- The relay’s logs are limited by design to a fixed list of metadata fields.
- On your phone, what you wrote is under iOS file protection, the identifier is in the Keychain, and you can add the app lock.
No system is perfectly secure. If an incident puts your information at risk, we will act promptly and tell you and the authorities where the law requires it.
17. Children
Holdfast is not directed to children under 13, and we do not knowingly collect personal information from them. Where the law of your country sets a higher age for agreeing to the use of your data (up to 16 in parts of Europe), please do not use the coach below that age without a parent’s or guardian’s agreement. If you believe a child has used the coach, write to us and we will help delete what can be found.
18. Changes
We will update this policy when the app or its providers change, and change the date at the top. If a change needs your agreement, the app will ask for it again.
19. Contact
The developer of Holdfast
Email: app.holdfast@proton.me