The short version: there is no account, there is no server of ours holding your writing, and the most sensitive things you put into this app never leave your phone at all.
These are stored in a local-only database that has no cloud mirror. They are not uploaded, not backed up to us, and not readable by us:
This is enforced by which database each record type is registered in, not by a promise in this document. It was verified on real hardware by writing a marker into those fields and confirming it appeared only in the local store and in no cloud-synced table.
Dates, counts and settings — your start date, run history, milestone dates, aggregate counts and preferences — sync through your own iCloud account, in Apple's private database. We are not a party to that. We cannot read it, and there is no administrative view of it anywhere.
One thing: when you reach a milestone, the app adds 1 to a shared counter of how many people reached that milestone that week, and reads the total back. The record is identical for two different people — there is no identifier in it and nowhere to put one. Counts below fifty are never shown, so a small number is indistinguishable from no number.
Apple's CloudKit attaches its own creator metadata to public records. It is an opaque, container-scoped identifier that no available interface can resolve to a person, we do not request the permission that would make it resolvable, and there is no other record type in that database to correlate it against.
If you tap "Near me" in the meeting finder, the app reads your location on the device, compares it against meeting coordinates that are already inside the app, and discards it. Your location is never stored and never transmitted. There is no network request on that path at all. If you refuse the permission, the finder still works.
Export is free. You can export everything the app holds, as files you keep, at any time and without paying. We think charging for the way out of your own data is indefensible.
Delete everything means everything — the local database, the synced records, your iCloud zone, and cached values on the device. It is verified rather than assumed.
Limiter is not directed to children under 13 and we do not knowingly collect information from them. Since there is no account and no personal information collected, there is nothing for us to hold in any case.
If this policy changes materially we will update the date above and note the change here. Because the architecture is what enforces most of these promises, a change that weakened one would require shipping a different app.
OB DATA LLC — privacy@getlimiter.com