The fine print, plainly

Privacy Policy

Effective July 18, 2026 · Last updated August 11, 2026

The most personal app on your phone shouldn't feel like a surveillance product. ReEnchanted is built local-first: your journal, your kept pages, and everything you write live on your device, not on our servers. You do not need a ReEnchanted login. Optional purchases may use your Apple account or create a Stripe customer and subscription record, but neither contains your private Book. The only reader writing we receive is a specific public contribution you deliberately preview and confirm.

This policy explains what ReEnchanted (“the app,” “we,” “us”) does and does not do with information, so you can decide with your eyes open. It applies to the ReEnchanted app for iPhone and iPad and to this website, reenchanted.app.

The short version

Accounts are optional. You never create a ReEnchanted login. App Store purchases use your Apple account; the printed Bound Year creates the Stripe merchant record needed for billing and delivery.
Local-first. Your pages, saves, photos, and writing stay on your device. We can't see them.
On-device intelligence. The app's “local brain” runs entirely on your device. Your writing is not sent to us or to an AI service to generate pages.
No ads, no trackers, no analytics. We do not embed advertising, third-party trackers, or usage analytics SDKs.
No selling data. We never sell, rent, or share your personal information. There is no data broker in here.
Public means deliberate. Importing the Public Margins and offering something to them are separate opt-ins, both off by default. Every outgoing sentence gets another exact public preview and confirmation.

Information the app keeps on your device

Almost everything ReEnchanted does happens on your device and stays there. This includes your kept pages and drafts, the “Book of You” and monthly editions you bind, your in-world progress and belief, and any photos, notes, or audio you add to a page. This material is stored in the app's own storage on your device and, if you use iCloud device backup, within your personal encrypted Apple backup that we cannot access.

Device permissions you control

ReEnchanted asks for permissions only through explicit, revocable choices, and only when a feature needs one. You can decline any of them and still use the app; you can change your mind later in the iOS Settings app. When granted, this information is used on your device to shape your pages and is not transmitted to us:

Location — to anchor real places, fetch local weather, and color the day's pages.
Health & motion (body) — optional signals that inform reflective pages. Health data is never sent off your device.
Calendar — to weave upcoming or past events into the Book, on device.
Photos — to illuminate a page with an image you choose. Photos you don't add to a page are not accessed.
Notifications — gentle, optional nudges from the Book.

When information does leave your device

A few features reach the internet by design. When they do, only what that feature needs is sent, and only to the service that performs it:

The Public Margins

The Public Margins are an optional community window. They have two independent controls, both off by default. “Bring the Public Margins into my Book” permits the app to fetch approved community sentences deliberately offered by readers. “Offer me ways to add to the Public Margins” only permits the app to show contribution invitations. Turning on one never turns on the other.

Even when outgoing invitations are enabled, nothing is uploaded automatically. For each contribution, the app shows the exact sentence or fixed choice that may appear publicly on this website and in other readers' Books. It sends only after you press the plainly labelled public confirmation button. The submission contains a random request identifier, the public event and contribution type, the sentence or choice you confirmed, and the confirmation time. It also sends a random app-installation identifier used only by the network edge to rate-limit automated abuse; that identifier is not written into the Public Margins database or used to build a profile. It does not contain an account, hardware device identifier, Book page ID, surrounding writing, archive, photos, audio, location, health, Calendar, contacts, Belief, Book of You, or local-brain data.

Public contribution text travels over HTTPS and is encrypted at rest. Fixed choices are approved automatically because the app can submit only the displayed answers. Sentences are checked automatically for obvious contact details and by a safety classifier; they become public only when those checks pass. If a check is unsafe or unavailable, the sentence is rejected rather than published. No person is expected to read an ordinary submission. The server returns a random deletion receipt to the app; the server stores only a one-way hash of that token. The service intentionally does not create a stable identity, so it counts contributions rather than claiming to count people. Our network provider may transiently process an IP address to deliver the request, as any internet service does, but the Public Margins database does not store it or use it to profile you.

Pending or rejected contributions are removed after 30 days. Approved contributions are removed after one year unless you delete them sooner with the receipt kept on your device. You can turn either choice off at any time; turning off the outgoing choice stops future invitations but does not by itself delete a sentence already made public.

Weather and local context

To show weather and local flavor, the app may request weather data for your approximate location from a weather provider (such as Apple Weather). Optional content sources you choose to enable (for example, public reference or news feeds) are fetched directly from their publishers.

Personalized public-web research

The optional “Let my interests visit the public web” setting is off by default. If you enable it, the app may send an interest you wrote and a broad home-place description to DuckDuckGo or another public research source so a Gossip Page or letter can carry back a current public finding. Names, Book pages, health notes, and precise coordinates are not included. Close the setting at any time to return those searches to fixed, non-personal queries.

Nutrition lookups

If you log food and ask for a rough nutrition estimate, the app may send the food description you typed to the U.S. Department of Agriculture's public FoodData Central API to look up typical values. No identity is attached to this request.

Purchases (the Standing Order)

The auto-renewable Standing Order subscription is handled entirely by Apple through the App Store. Apple processes payment and tells the app whether an item is unlocked. We never see your card number or full payment details. Apple's handling of that transaction is governed by Apple's Privacy Policy.

Ordering a printed book

The one place you deliberately share personal details is when you order a physical printed edition of your Book. To manufacture and ship it, the app sends the print-ready PDF of the edition you chose, plus the shipping name and address you enter, to our print-on-demand partner (Lulu), and processes your payment through our payment processor (Stripe). Your contact email is used to send you order and shipping updates. We only send these details when you choose to place a print order, and only to complete that order. A paid order waiting to be submitted is kept on the device for no more than seven days and is removed from local storage when Lulu accepts it. Print files are held in private storage and made available to Lulu through random links that expire. See Lulu's Privacy Policy and Stripe's Privacy Policy.

This website

If you join the launch/TestFlight list on this site, the email address you submit is stored with our email provider (Buttondown) solely to send you the one launch notice you asked for. You can unsubscribe at any time using the link in that email. The website does not run advertising or third-party analytics trackers.

The community section fetches the same public, moderated Public Margins snapshot available to opted-in apps. It does not set a community account cookie or attach reactions, profiles, or analytics to a contribution. It does not import a social-media feed.

Data retention and deletion

Because your journal lives on your device, you control it. Deleting a page removes it; deleting the app removes its on-device data from your phone (and from your Apple device backup on Apple's normal schedule). For a print order, we and our print/payment partners retain the order records needed to fulfill it and to meet tax and accounting obligations. To request deletion of information tied to a print order, email us at the address below. Public Margins retention and deletion are described in the Public Margins section above.

Children's privacy

ReEnchanted is a general-audience app and is not directed to children under 13, and we do not knowingly collect personal information from children. Because the app requires no login and keeps personal content on the device, it collects no personal information from any user by default.

Security

Keeping data on your device, protected by your device's own security, is the strongest privacy posture we can offer. Public Margins contribution text is encrypted in transit and at rest. For the limited information involved in a print order, we rely on reputable partners (Apple, Stripe, Lulu) that use industry-standard encryption in transit. No method of transmission or storage is perfectly secure, but we've minimized what's at risk by collecting as little as possible.

Your choices & rights

You can revoke any device permission in iOS Settings, decline any feature that reaches the internet, unsubscribe from our email list, and delete your data by deleting pages or the app. A Public Margins deletion receipt can remove its specific contribution without an account. Depending on where you live, you may have rights to access or delete personal information we hold about a print order; contact us and we'll honor applicable requests.

Changes to this policy

If we change how the app handles information, we'll update this page and revise the “Last updated” date. Material changes will be reflected here before they take effect.

Contact

Questions about privacy? Write to hello@reenchanted.app. The app's engine is also open source under the MPL-2.0, so you're welcome to read exactly how it works.