Privacy Policy

Protocol 75 is made by Jeremy Butler. Almost nothing in it leaves your device, and the parts that do are listed here in full.

What stays on your device

Your challenges, attempts, daily logs and task entries are stored on your device and mirrored to your own private iCloud database through Apple's CloudKit. That is your iCloud account, not a server belonging to this app — it cannot be read by me, and it is not collected.

Your preferences — water units, reminder settings, accent color, and the display name and avatar color you use in a Pact — are stored the same way. The display name and avatar color also sync between your own devices so they follow you.

What a Pact publishes

Pacts are optional. If you create or join one, your device publishes a snapshot containing:

• the display name you chose (not your Apple Account name)
• your avatar color
• the challenge name, current day, duration, today's completed and total task counts, and your streak
• your completion grid — one byte per day
• your CloudKit user record name, used as a stable member id

These records live in a shared CloudKit database, and are readable by anyone who knows the Pact's identifiers. Two things follow from that, and they are stated plainly rather than implied:

• Owner approval controls who is displayed, not who can read. It decides who appears in a roster. It cannot decide who may read the records.
• Removal is not enforced by a server. Apps honor it, but a removed member's device keeps whatever it had already fetched.

What keeps a Pact from being stumbled into is the invite code: ten characters, chosen at that length deliberately. That is sound against guessing. It is not an access control, and you deserve to know the difference before you share progress with anyone.

Nothing about your tasks is published — no task names, no notes, no photos.

What the subscription sends

The subscription is sold through RevenueCat, the only third-party service in the app. What leaves your device:

• The purchase itself — App Store transactions and the entitlement they produce, so a subscription bought once is recognized on all of your devices.
• An account identifier — your CloudKit user record name, used as RevenueCat's app user ID. This is the same app-scoped id a Pact snapshot already carries. It is not your Apple Account name, not a device id, and not an advertising id. It exists so that your Apple Watch recognises a subscription you bought on your phone.
• RevenueCat also collects device and purchase metadata of its own, described in RevenueCat's privacy policy.

Nothing about a challenge is sent. RevenueCat knows there is a subscriber; it does not know what they are doing.

If iCloud is unavailable there is no id to send and an anonymous one is used instead, which is why Restore Purchases exists on both the phone and the watch.

Apple Health

Health access is optional and off until you ask for it. If you add a step-goal task, the app reads your step count and nothing else. It is read on your device, used to tick that task, and never sent anywhere. The seven default tasks do not request Health access at all.

Tracking and advertising

There is none. No ads, no analytics, no third-party trackers, no linking of your activity across other apps or websites. The app declares no tracking domains.

Children

Protocol 75 is not directed at children under 13 and does not knowingly collect information from them.

Your choices

Leaving a Pact removes your snapshot from it. Deleting the app removes its local data; data in your own iCloud database is managed through your Apple Account, in Settings under iCloud. To ask a question or request deletion of anything published to a Pact, email protocol75support@icloud.com.

Changes

If this policy changes, the date at the top changes with it.

Contact

protocol75support@icloud.com