English
Privacy Policy
ChillMate keeps your information on your iPhone, where you control it. There are no servers collecting your data. There are no ad or analytics trackers. Nothing about you is ever sold or shared.
The short version #
- On your phone. Your profile, logs, plans and notes are stored on your iPhone.
- No trackers. No ad networks, no analytics, no tracking code from anyone else.
- Nothing sold. Your personal and health information is never sold or shared.
- You are in control. You choose what to add and what to sync. You can delete all of it whenever you want.
Every connection the app makes #
Most privacy policies describe intentions. This one lists what actually leaves the device, which is both shorter and easier to check.
ChillMate's own code makes no internet connections at all: no URLSession, no analytics, no crash reporter, no remote settings. Everything in the table below is either an Apple service talking to your own account, or something you tapped.
| What | Goes where | When |
|---|---|---|
| iCloud sync (CloudKit) | Your own private iCloud database | Only if you turn iCloud on. Apple holds it, and I cannot read it. |
| Encrypted backup file | Your own iCloud Drive | Only if you turn backups on, or export a file yourself. |
| Apple Watch mirror | Your own watch, directly | If you pair a watch. Device to device, over Watch Connectivity. |
| Apple Health | Stays on the device | Only the categories you approve. HealthKit is local storage, not a service. |
| An optional donation | Apple's In-App Purchase | Only if you tap it. Apple takes the payment, and I never see card details. |
| A link you tap | Safari, to that site | Only on your tap. ChillMate does not fetch those pages itself. |
| A call or message you send | Your phone app, your messages app | Only on your tap, and you see the message before it goes. |
| Anything to a ChillMate server | Nowhere | Never. There is no such server. |
Read the source if you would like to check any of this for yourself.
Category by category #
These are the categories Apple asks every developer about. ChillMate's answer is the same in all of them.
| Category | Collected by ChillMate | Linked to you | Used to track you |
|---|---|---|---|
| Health & Fitness | No | No | No |
| Sensitive Info | No | No | No |
| Contact Info | No | No | No |
| Contacts | No | No | No |
| Location | No | No | No |
| User Content | No | No | No |
| Identifiers | No | No | No |
| Usage Data | No | No | No |
| Diagnostics | No | No | No |
| Purchases | No | No | No |
To be exact about the word. ChillMate stores a great deal on your phone, including health and other sensitive things you type in. It collects none of it. Collecting would mean taking it off your device and holding it somewhere you cannot reach.
What a wellbeing app usually knows #
This is not an accusation against anyone in particular. It is what the ordinary, entirely above-board version of an app like this holds, because holding it is how that version works.
| Question | The usual answer | ChillMate |
|---|---|---|
| Who can read your entries? | You, and whoever holds the database | Only you |
| What does a breach expose? | Everything on the server | Nothing. There is no server. |
| What can be handed over on request? | Your account and its contents | Nothing is held to hand over |
| What happens if it is acquired? | The new owner inherits the data | There is no data to inherit |
| What does an email address unlock? | Your account | There is no account |
| Who sees which screens you open? | An analytics provider | Nobody. There is no analytics. |
| Can the policy change later? | Yes, and the data is already collected | It can change, but there is still nothing collected |
There is an honest cost to the right-hand column. If you lose the phone and have no backup, nobody can get your data back for you. That is the same property, seen from the other side.
What this is really designed against #
Most privacy pages talk about breaches and hackers. For an app like this, the realistic risk is closer to home: someone picking up your unlocked phone. A partner, a housemate, a family member, a colleague glancing at a notification.
So the app has its own Face ID or PIN lock, on top of the phone's. Notifications can be worded so the lock screen says nothing revealing. One tap blanks the screen to a moon. And ChillMate hides what is on screen when you swap apps, and while your screen is being recorded or mirrored.
Having no server has a useful side effect. If I were breached, nothing about you would come out, because I hold nothing. The trade is worth saying out loud: if you lose the phone and have no backup, the data is gone. That is deliberate, and it is why an encrypted backup is one setting away.
Every change this page has ever had #
A privacy policy is a promise that can be edited quietly, and almost nowhere lets you check whether it was. This one is in a public repository, so here is its whole history, read out of git when this page was built rather than typed in by hand.
| When | What changed | Commit |
|---|---|---|
| 2026-09-12 | Give the domain its own module, and stop reaching for seven singletons | c94b013 |
| 2026-09-12 | Keep the Lock Screen's own counsel, and write down what the gate found | 053e5e4 |
| 2026-09-11 | Tell the site what actually shipped, and stop it guessing the version | e1f2170 |
| 2026-09-11 | Write the 5.0.0 release notes, in all five languages | c44c629 |
| 2026-09-11 | Add methamphetamine, and stop the website telling people something different | d945a6c |
| 2026-08-21 | Serve Google's verification file, and stop the build corrupting itself | f389f00 |
| 2026-08-14 | Use Apple's badge, and call the donation a donation | 3082bc2 |
| 2026-08-14 | Point the site at the App Store | 3d9c34c |
| 2026-08-13 | Give the phone walk to the phone | d81ad85 |
| 2026-08-13 | Make the help page print the way its own copy promises | c247148 |
| 2026-08-13 | Make the checker findable, cacheable and audible | 617e663 |
| 2026-08-13 | Stop shipping 96% of the page as images | 1654c98 |
| 2026-08-12 | Write the site for the person reading it, not the person who built it | 2880932 |
| 2026-08-12 | Dark only, and give the demo the whole risk engine | 1461ccd |
| 2026-08-12 | Halve the front page by saying each thing once | c1b282e |
| 2026-08-12 | Rebuild the home page as an exhibition, and make the risk checker playable | dd77914 |
| 2026-08-11 | Say who the app is for, and stop hiding nine sections when JavaScript fails | 0f8f20b |
| 2026-08-11 | Tag foreign service names, and answer the question the tables were dancing around | 9b6ba66 |
| 2026-08-11 | Show the actual app on the site, and let it speak five languages | 1a0ef4f |
| 2026-08-11 | Rebuild the GitHub Pages site around the real ChillMate mark | f69138e |
| 2026-07-30 | Make 4.2.1 shippable: fix the blockers the audit found, then the bugs the audit missed | 76a709a |
| 2026-07-28 | Rate limit PIN entry, add a passcode fallback, cap backup growth | 9ca50e2 |
| 2026-06-19 | Neutralize store-facing docs and remove App Store description copy (Guideline 1.1) | aebb91e |
| 2026-06-11 | v2.1.2 (230): single-stack More tab, setup wizard, privacy/support site | 4a44e79 |
Compare any two versions yourself in the file's history.
What it would take to start collecting your data #
Worth being concrete, because "I will never" is easy to say. The version of that claim that means anything is about how the app is built, not about how good my intentions are.
Collecting anything would take a lot. I would have to write a server and run it somewhere. I would have to add accounts, so records could be tied to people. I would have to add networking code to an app that has none. And all of it would go through App Review, with a privacy label that changed from nothing to something.
It is not a setting somebody could flip, and it is not a line somebody could sneak in. It is a different app, built differently, and the first commit would be public on the day it was written.
That is the actual protection. Not a promise about what I intend, but a shape that makes the other thing expensive and visible.
What ChillMate can save
- Your profile, photo, medication notes, trusted contact, home address, settings, and preferences.
- Private logs, sleep notes, health-related entries and test reminders, plans, journal entries, check-ins, and emergency-card details.
- Optional information you choose to add from Apple Health, Contacts, Photos, or Location Services.
Some of the entries you choose to add are health-related and sensitive. They are stored only on your device, under your control.
How your information is used
- To show your private overview, reminders, follow-ups, emergency shortcuts, and wellbeing reflections.
- To sync with Apple Health only for the categories you approve in iOS settings.
- To create encrypted backups only when you turn backup features on.
All of this happens on your phone. ChillMate never sends what you write to me.
What ChillMate does not do
- No ads, no selling personal information, and no sharing of your health details for marketing.
- No medical diagnosis, treatment decisions, or advice on whether anything is safe.
- No messages are sent to your contacts unless you choose to send them.
Where your data is stored
On your iPhone. Data is kept in the app's private storage, protected by iOS file protection and, if you enable it, an extra app lock (Face ID or PIN).
Optional iCloud. If you turn on iCloud backup or sync, ChillMate stores your data in your own private iCloud account through Apple's CloudKit and iCloud Drive. Apple encrypts it, and only you can reach it. I have no access to it at all.
No servers of mine. There is no ChillMate server anywhere that receives or stores your personal information.
Apple Watch
If you pair an Apple Watch, ChillMate copies part of your data to it, so the watch still works when your phone is out of reach. That means your streak and daily score, any running dose timers, your watch settings, your emergency number, and the name and phone number of your trusted contact, so the watch can call them without your phone.
This goes straight between your phone and your watch, on your own two devices. It does not pass through my servers, because there are none.
Two things worth knowing. Your trusted contact's details belong to somebody else, and they end up on a second device, so only add someone who would be comfortable with that. And ChillMate's app lock protects the phone app. On the watch, your watch passcode and wrist detection do that job instead.
Clearing your trusted contact in Settings, or unpairing the watch, removes this mirrored data.
Device permissions
Each permission is optional and only used for the purpose you grant it:
- Apple Health. Read and write only the categories you allow (such as sleep, heart rate, HRV, and workouts).
- Contacts. Only to let you pick a trusted contact. The lookup happens on your device.
- Photos. Only to set a profile picture you choose.
- Location. Only to attach a location to a log or include your current location in an emergency message you send.
- Notifications. For the reminders and check-ins you turn on. Discreet wording can be enabled so lock-screen text stays vague.
Payments and donations
ChillMate is free. If you choose to donate, that goes entirely through Apple's In-App Purchase. Apple takes the payment, and I never see your card or account details. Donations unlock nothing, and they change nothing about what data is collected.
Your control and deletion
- You can delete logs, plans, reminders, timers, journal entries, and your whole account from inside the app.
- Deleting the app removes its local data from your iPhone. iCloud data can be removed from iCloud settings or from within the app's backup controls.
- iOS permission controls for Health, Location, Notifications, Contacts, and Photos remain available in the Settings app at any time.
Because ChillMate does not collect your data on a server, there is no remote profile to ask for, correct, or erase. You already hold all of it. If you are in the EU or EEA, your GDPR rights (access, correction, erasure, portability, objection) are met directly by these controls on your phone.
Children
ChillMate is intended for adults only. You must be 18 or older to create a profile and use the app.
ChillMate is a wellbeing and reflection tool, not a medical service. It does not diagnose, treat, or tell you whether anything is safe. For any health, medication, or mental-health questions, speak with a qualified professional. If someone may be in immediate danger, call your local emergency number.
Changes to this policy
If this policy changes, the updated version will be posted on this page with a new "last updated" date. Material changes will also be noted in the app or in the changelog.
There is a Nederlandse vertaling, because most of the people this app is for read Dutch first. This English text governs: if the two ever disagree, the English one is what was meant and the Dutch one has a bug. Only these two exist, because a translation is a promise to keep it in step, and two is what I can honestly keep.
Contact
Questions about privacy? Email chillmate@icloud.com. For anything security-related, see the security page.