Privacy Policy

What never leaves your device

These are stored in a local-only database that has no cloud mirror. They are not uploaded to us, not backed up to us, and not readable by us:

• Journal entries — including evening reviews, your answers to the inner-work exercises and the letter for the worst hour, which the app keeps as journal entries
• Lapse notes and what preceded a lapse
• Urge notes
• Mood entries and symptom logs
• Your reasons
• The people you add, up to five: the names and phone numbers you type in yourself, the message you write ahead of time, and when you called or texted one of them from the app
• The meetings you keep, the meetings you log as attended and the notes you write about them, which meetings you want reminders for, and your 90-in-90 count
• Your if-then trigger plans
• Money-custody details and self-exclusion records
• The hours of the day you told us your pattern covers
• The dates you mark — an anniversary, a birthday, a day you dread — and what you call them
• Everything in the financial disclosure list

On iPhone, this is enforced by which database each record type is registered in, not by a promise in this document: these records live in a store that has no cloud container. For the records in version 1.0, it was verified on real hardware by writing a marker into those fields and confirming it appeared only in the local store and in no cloud-synced table. Every record type added in versions 1.1 and 1.2 is registered in the same local-only store.

If you back up your iPhone, to iCloud or to a computer, the backup includes this store, like the rest of your phone. The backup is yours; we have no access to it. Apple holds the keys to an iCloud backup unless you turn on Advanced Data Protection, which encrypts it end to end. Apple no longer offers that to new users in the UK. A backup to a computer is encrypted only if you turn on Encrypt local backup. To leave Limiter out of iCloud Backup: Settings › your name › iCloud › Storage › Backups › this iPhone, then turn Limiter off. A restore will then not bring your writing back, so export first.

On Android, the app keeps all of its records, these included, in its own database on the phone. The Android app does not sync. From version 1.2, Android’s own backup can carry a copy to your Google account, but only when the phone can encrypt it end to end: on Android 9 or later, with a screen lock set, the copy is encrypted with your PIN, pattern or password, and Google cannot read it. Neither can we. With no screen lock, or on Android 8, nothing is backed up. The app names every file that may go: its database, which holds these records, and three small settings files — whether the app lock is on, and what the app has already counted, shown or asked, so a new phone does not repeat it. Everything else stays on the phone, including the counter’s display cache, the widget’s copy of your counter, and the dates the app uses to decide when to offer Google Play’s rating card. Whether and when the phone backs up is set by the phone, not the app. If you move to a new phone with Android’s device-to-device transfer, which you start yourself, the same files, and only those, are copied directly from the old phone to the new one; from a phone on Android 8, nothing is. We are not part of the backup or the transfer.

What syncs, and where

On iPhone, dates, counts and settings — your start date, run history, milestone dates, aggregate counts and preferences — sync through your own iCloud account, in Apple’s private database. We are not a party to that. We cannot read it, and there is no administrative view of it anywhere. Nothing added in version 1.1 syncs.

On Android, nothing syncs.

What we receive

From the iPhone app, one thing: when you reach a milestone, the app adds 1 to a shared counter of how many people reached that milestone that week, and reads the total back. The record is identical for two different people — there is no identifier in it and nowhere to put one. Counts below fifty are never shown, so a small number is indistinguishable from no number.

Apple’s CloudKit attaches its own creator metadata to public records. It is an opaque, container-scoped identifier that no available interface can resolve to a person, we do not request the permission that would make it resolvable, and there is no other record type in that database to correlate it against.

From the Android app, nothing. It does not take part in the milestone counter.

If you email us, we receive your address and what you write. We use it only to reply.

What there is none of

• No account. No sign-in, no email address, no password, no social login.
• No analytics. No usage tracking, no session recording, no product analytics of any kind.
• No advertising and no advertising identifier. No ATT prompt, because there is nothing to ask for.
• No third-party SDKs. On iPhone, purchases run on Apple’s own StoreKit. The Android app has nothing to buy at present. Beyond Android’s and the Kotlin language’s own libraries, it carries one of Google Play’s: the In-App Review library (com.google.android.play:review, with the three Google libraries it brings), which shows the Play Store’s own rating card. It adds no permission and no internet access. The app passes it nothing but the request to show the card, and is never told whether you left a rating.
• No crash reporter that phones home.
• No AI reading your writing. Nothing analyses, scores or summarises what you write. Not for insights, not for triggers, not for anything.
• No access to your contacts, your calls or your messages. You type in the names and numbers of your people yourself. When you tap Call or Text, the app hands the call or the message to your phone’s own calling or messaging app and sees nothing of it; it records only that you tapped.
• No feed, no comments, no messaging, and therefore no moderation that could ever delete what you wrote.

Location

If you tap “Near me” in the meeting finder, the app reads your location on the device, compares it against meeting coordinates that are already inside the app, and discards it. Your location is never stored and never transmitted. There is no network request on that path at all. If you refuse the permission, the finder still works.

Your data is yours

Export is free. You can export everything the app holds, as files you keep, at any time and without paying. We think charging for the way out of your own data is indefensible.

Delete everything means everything — the local database, the synced records, your iCloud zone, and cached values on the device. It is verified rather than assumed. On Android, it removes every record and setting the app keeps on the phone. Google’s encrypted copy, if your phone keeps one, is replaced at the phone’s next backup. Uninstall and reinstall before then, and the old copy can come back.

Children

Limiter is not directed to children under 13 and we do not knowingly collect information from them. Since there is no account and no personal information collected, there is nothing for us to hold in any case.

This website

getlimiter.com runs no JavaScript, sets no cookies and loads nothing from anyone else: no analytics, no fonts or scripts from other servers, no embedded content. Like any website, it is delivered by a host, Vercel. Vercel receives each request your browser makes, including your IP address and the type of browser and device, to deliver the page. It also uses that traffic data to run and secure its own service, under Vercel’s privacy notice. We never export these records, never combine them with anything, and never use them to identify a visitor.

Changes

If this policy changes materially we will update the date above and note the change here. Because the architecture is what enforces most of these promises, a change that weakened one would require shipping a different app.