Privacy Policy隐私政策

OffMemory ("we", "the App") is built on a single principle: your notes are none of our business. This Privacy Policy explains, in plain language, exactly what the App does and does not do with your information.

1. The Short Version

• There is no cloud and no server behind the App. Your entries are encrypted on your device, and there is nowhere on our side for them to go.
• We never collect, transmit, store, share or sell any of your personal data, notes, images, mood marks, passwords or device identifiers.
• There is no sign-up step: no email address, no phone number, no registration form, no analytics, no crash reporting and no advertising SDK.
• Your note titles, bodies and images are encrypted with AES-256 and stored only on your own device. For local search, folder names and tag names are not encrypted (they are kept in plain text on your device); they likewise never leave your device.
• You can export an encrypted backup and restore it on a new device or after reinstalling. That file is created by you, kept by you, and stays encrypted with your password — we never receive it.
• You may also choose to export plain, unencrypted files: a .zip archive of readable Markdown plus images, a plain .txt file, or a single note as .md. These are created only when you explicitly select and confirm them, and anyone holding them can read them directly.
• On supported devices, an optional on-device AI feature (Apple Intelligence) can summarise, continue or polish a note. It runs entirely on your device: the text it works on is never sent to us or to anyone else, and the feature is simply unavailable when your device, system version or region cannot run Apple's on-device model.
• Only two things in the App use the network: Apple's in-app purchase channel (required to process the one-time unlock and handled entirely by Apple — we receive no personal data from it), and the device-to-device transfer you start manually between two of your own devices, which runs point-to-point over your local network and never through our servers.

2. Information We Collect

None. The App does not collect any information whatsoever — not personal information, not usage data, not device data, not diagnostics. Because we operate no backend at all, there is no server of ours that could receive such data even if we wanted to collect it.

3. How Your Data Is Stored

• Location: All notes, folders, tags, mood marks, favourites and images are stored in a local database inside the App's private sandbox on your device.
• Encryption: Note titles, note bodies and images are encrypted with AES-256 before they are written to disk (authenticated AES-256-GCM for data written by 2.0.0 and later, AES-256-CBC for earlier data; both remain fully readable). Your master encryption key is derived from your password using the memory-hard Argon2id algorithm and is stored in the system Keychain.
• No server, ever: We operate no backend at all. There is no sign-in, no sync service and no place where your data could be stored on our side.
• Automatic device backups: Any backup made by your operating system (for example, an iTunes or iCloud device backup) is created and controlled entirely by Apple. Such a backup may contain the App's encrypted database files. Those files remain encrypted, and your password and encryption keys are never included.
• System search (Spotlight, off by default): you can turn on "Search in Spotlight" under Settings → Security. When it is on, note titles are written into the iOS system search index as entries, so you can find them in Spotlight and open the note directly. Bodies, images, moods, tag names and folder names are never written to that index; notes marked as locked are not indexed; and these titles are unreadable while the device is locked (the index uses iOS complete file protection). Turning the switch off immediately clears whatever was already written.
• Apple Watch: the watch app and the iPhone app talk to each other over Apple's WatchConnectivity, a device-to-device channel. It passes through no server and generates no network request. Anything you write on your wrist that has not reached the vault yet waits in the watch's own Keychain until your iPhone is reachable and unlocked; that queue lives entirely on your devices and is removed when you uninstall the watch app. Watch-face complications show only numbers and symbols — your streak, whether today is written, the On This Day count and how many captures are pending — never any note text.
• Mac: the Mac app keeps its own encrypted database inside the app sandbox and has no sync service either. If you use Time Machine or another system backup tool, that backup is created and controlled by macOS, may contain the encrypted database files, and never contains your password or encryption keys.
• Home Screen widgets, Control Centre and Shortcuts: to draw a widget, the App writes a small snapshot into an App Group container shared with the widget extension. The widget process cannot decrypt your notes, so it can only read that snapshot — and the snapshot is restricted by a whitelist to counts and a writing prompt: your streak, this week's entry count, whether today is written, and today's prompt, plus one boolean flag. It never contains a note title, body, image, tag or folder name. The Control Centre button and the "New blank entry" Shortcuts action only create an empty entry or open the App to unlock; they neither read your notes nor return any content.

4. Backups, Exports and Moving to a New Device

You can export an encrypted backup and import it on another iPhone, iPad or Mac, or after reinstalling the App.

• What the file is: a single archive containing your encrypted notes, images and mood data, produced on your device.
• Optional backup passphrase: you may protect the archive with a backup passphrase. If you do, an additional copy of your master key is wrapped with a key derived from that passphrase (Argon2id + AES-256-GCM for backups created by 2.0.0 and later, PBKDF2 + AES-256-CBC for earlier ones; both can be restored), which is what allows the same archive to be restored on a different device. We do not store the passphrase and cannot recover it.
• Where it goes: wherever you choose — the Files app, iCloud Drive, an external drive, or AirDrop. That choice is entirely yours. The archive remains encrypted throughout and is never uploaded to us or to any third party by the App.
• Your responsibility: a backup file is only as safe as the place you keep it and the passphrase you choose. If you lose the passphrase and the original device, the archive cannot be opened.

Plain exports (optional, unencrypted): besides the encrypted backup, the App can produce plain exports: a .zip archive of readable Markdown plus images; a .pdf of one note or of the whole vault, including images and handwriting; a plain .txt file; a single note as .md; and a .csv of your mood data (date, mood, note id, folder, tags). Plain files are not protected by the App's encryption, anyone who obtains them can read them directly, and the App never chooses a plain format for you: one is created only after you explicitly select and confirm it. To render a PDF the App briefly assembles the needed images and handwriting in a temporary folder inside its own sandbox, then deletes it when the export finishes — and again on the next launch if the process was killed mid-way. Please store or destroy these exports with the same care you would give any unencrypted file.

Device-to-device transfer (optional): you can also send notes straight to another device you own — open "Device Transfer" on both devices, bring them close, and the sending device shows a 6-digit pairing code to type on the other one. This makes the App broadcast a discovery request on your own local network (Wi-Fi or Bluetooth), the only place the App uses a local network; the connection is established point-to-point between the two devices, never through our servers, and we never receive any content. The archive that travels is AES-256 encrypted, with a key generated at random for that session and discarded when it ends — it is not stored anywhere. If you never use this feature, the App never starts a local-network discovery.

5. Passwords, Recovery and Passphrases — Please Read Carefully

Your password is never transmitted, never stored on any server, and cannot be recovered by us. We do not operate any server that could hold it. This is a deliberate design decision, and it is the reason true privacy is possible.

• If you forget your password, we cannot reset it for you, and we cannot recover your notes.
• The App offers security questions as a recovery mechanism. If you configure them, an additional encrypted copy of your master key is created locally. Answering your security questions correctly lets you set a new password while keeping your data.
• A second password opens a separate room. If you set a second password (a decoy or second space), the App keeps a separate database file, separate exports folder and separate encryption key for it. Unlocking with the first password shows only the first space; unlocking with the second shows only the second. The two are never merged, never synced and never visible from one another — and whichever password you enter, the App only ever sees that space's data. Both spaces stay on your device, and we can neither tell how many exist nor recover either password.
• If you forget both your password and your security answers, the only remaining option is to erase all local data and start over. This erasure is permanent and irreversible.

6. Biometric Unlock (Face ID / Touch ID)

If you enable biometric unlock, the App asks iOS to store a credential in the device Keychain that can be released after a successful Face ID or Touch ID match. Biometric authentication is performed entirely on your device by the operating system. We never receive your face or fingerprint data, and no biometric information ever leaves your device.

7. Photos and Files

The App requests access to your photo library only in two situations, and only after you explicitly grant permission:

• Inserting an image: the selected image is encrypted and copied into the App's private storage.
• Exporting a backup or a plain export: the encrypted backup file, or a plain export file you explicitly chose (.zip / .pdf / .txt / .md / .csv), is written to the location you choose.

You may deny or revoke these permissions at any time in iOS Settings. Denying them does not affect any other feature.

8. Purchases

OffMemory offers a single one-time purchase that permanently unlocks writing. There is no subscription, no auto-renewal, no trial period and no advertising. All payment processing is handled by Apple through the App Store. We do not receive your name, email address, payment card number or any other personal information from Apple in connection with your purchase.

9. Third-Party Services and SDKs

The App contains no third-party analytics, advertising, crash-reporting, social or attribution SDKs. The only third-party component that makes any network request at all is Apple's StoreKit framework, which exists solely to process the one-time purchase described above.

10. Diagnostics and the On-Device AI

The App reports no diagnostics to us. It bundles no analytics or crash-reporting framework, and it never transmits diagnostic data to us or to any third party. If you choose in System Settings to share diagnostics with app developers, Apple may collect aggregate crash and performance data for the App in its own systems and surface it to us through App Store Connect; that collection is performed by Apple, never passes through any server of ours, and cannot be used to identify you. Switch that setting off and you have no diagnostic relationship with us at all.

Local diagnostic report (optional, initiated by you): In Settings → Share Diagnostic Report you can review and export a report. It contains counts and error summaries only — app version, platform, language, entry counts, feature usage, and the tail of the local error log. It never contains any diary content. The report stays on this device; whether to share it, and with whom, is entirely your decision. These local counters are deleted together with "Erase All Data".

On-device AI (Apple Intelligence, optional): on devices that support it, the App can ask Apple's on-device foundation model to summarise, continue or polish a single note. The model runs on your device through Apple's system framework. What is sent to it is only the note you selected plus your instruction, processed locally, in memory; nothing is transmitted — not to us, not to Apple, not to anyone else. We receive no copy of your note and no record of the prompts you use. If your device, system version or region cannot run Apple's on-device model, or if you have Apple Intelligence turned off, the feature is simply unavailable and nothing else is affected. The model's output is subject to Apple's own content-safety guardrails.

11. Children's Privacy

The App is not directed to children under the age of 13 (under 14 for users in mainland China) and does not knowingly collect any information from anyone. Because the App collects no data at all, no information from any user — including children — is ever obtained, stored or shared.

12. Data Retention and Deletion

Because we hold no data, there is nothing for us to retain or delete. You are in complete control of your local data at all times:

• Deleting a note moves it to the in-app Trash, where it is permanently deleted automatically once its retention period expires (7 days by default; you can change that period in Settings, and the Trash shows the real remaining days for each entry).
• Using "Erase All Data" in Settings permanently destroys all local notes, folders, tags, mood marks, images, backups held inside the App and encryption keys.
• Uninstalling the App removes all of its local data from your device. Any encrypted backup file you exported elsewhere remains wherever you saved it, and remains your responsibility.
• There is no cap on the number of entries you can store — the only limit is your device's free space. An encrypted backup you export can later be imported after reinstalling the App or on a new device, restoring your notes, images and moods.

These actions are irreversible.

13. Security

We protect your data with the following measures, all of which run locally on your device: AES-256 encryption of note titles, bodies and images (authenticated AES-256-GCM for data written by 2.0.0 and later, AES-256-CBC for earlier data; both remain fully readable); master-key derivation with the memory-hard Argon2id algorithm (32 MiB of memory, 2 iterations, 1 lane — 1.7× OWASP's current minimum recommendation); storage of keys in the iOS Keychain; mandatory password unlock with brute-force protection (progressive lockout after repeated failures); optional Face ID / Touch ID; automatic re-lock when the App enters the background; an optional screenshot-blocking mode on note detail pages; and passphrase-wrapped master-key recovery for new devices (Argon2id + AES-256-GCM for new backups, PBKDF2 + AES-256-CBC for earlier ones; both can be restored). AES-256 itself cannot be broken by brute force; the real line of defence is password derivation, and Argon2id's memory hardness stops offline brute-force attacks from being parallelised across GPU/ASIC farms or AI-assisted guessing — anyone who obtains the encrypted data on your device must still guess your password. No method of electronic storage is perfectly secure, and we cannot guarantee absolute security; however, we operate no server and cannot read your local data or an encrypted backup that you keep yourself.

14. This Website

This website is a static product page. It sets no cookies, runs no analytics, advertising or tracking scripts, and loads no third-party resources — all fonts, styles, scripts and images are served from this domain. The page does contain ordinary links to the App Store and to the Chinese filing-authority lookup pages; those are plain id-based links with no campaign or tracking parameters, and they only do anything if you click them. The only information stored in your browser is your language preference, which is kept in localStorage and never sent anywhere.

15. Changes to This Policy

If we update this Privacy Policy, the revised version will be posted on this page and included in the next release of the App, and the "Last updated" date above will change. Continued use of the App after an update constitutes acceptance of the revised policy.

16. Contact

If you have questions about this Privacy Policy, please reach us through the support information listed on this App's App Store page.

Remember: your password, security answers and backup passphrase exist only in your own memory. Guard them carefully, especially any passphrase needed for cross-device restore. If every recovery path is lost, your data is gone permanently — there is no exception.