Skip to content

Privacy

There are two different things called “Timegrove” in this document, and they have completely different privacy stories. The app keeps everything on your iPhone and talks to no server of ours. This website is an ordinary WordPress site. Blurring the two would be the easiest sentence to write and the least honest.

The app

Timegrove for iOS has no accounts, no ads and no servers belonging to us — there is no server to have. Your memories, photos, recordings and measurements are files on your iPhone. Nothing is uploaded anywhere by us, because there is nowhere for it to go.

The app contains no analytics SDK, no advertising SDK and no crash-reporting SDK. The only network traffic it can make is Apple's:

  • Your iCloud, if you turn on backup. The app writes a .tmln file into your own iCloud Drive, where you can see it in Files under Timegrove. It is a backup, not a sync: we never see it, and neither does anything but your Apple account.
  • The App Store, when you buy Premium. Apple handles the purchase; we receive no card details and no name.
  • Apple Maps, when a place you pinned draws its map. The tile is fetched once and then kept on the iPhone.

Sealed time capsules are sealed to us as well as to you. The app cannot read one before its open date, and neither can anyone holding your phone.

What the app keeps, and where

Everything you put in a tree lives in the app's own storage on your iPhone: the words you type, the photos, videos and voice notes you attach, and the dates, places, moods and measurements you tag them with.

Some of those measurements are about a body — a height, a weight, a head circumference, a blood pressure, a course of medicine. That is health information and we treat it as such: you type it, it stays on the iPhone with everything else, and it is never sent anywhere. The app does not read from or write to Apple Health; there is no HealthKit integration to turn on, and nothing in Timegrove can see what other apps have recorded.

Voice notes are transcribed so you can search them later. That transcription runs on the device — the app pins Apple's recogniser to its offline mode, so the audio is not sent to Apple and not sent to us. Where a language has no offline model, the app simply skips the transcription rather than going online for it.

What the app asks permission for

Each one is asked for at the moment it is first needed, and each one is optional: refusing costs you that single feature and nothing else.

  • Photos — to add pictures and videos you pick into a memory, and to save a memory card back to your library when you share one.
  • Camera — to scan a document, a ticket or a letter straight into a memory.
  • Microphone — to record a voice note.
  • Speech recognition — to turn that voice note into searchable text, on the device, as above.
  • Location, while using the app — only when you tag a memory with where it happened. There is no background location and no tracking of any kind; the coordinates are saved with that one memory and nowhere else.
  • Face ID — to lock a tree. Apple checks your face and tells the app yes or no; the app never sees biometric data.
  • Notifications — to tell you a sealed capsule has reached its day, and for any gentle reminders you switch on. They are scheduled on the device; no server sends you anything.

Children

Timegrove is made for the adult keeping the record. A tree a parent keeps about their child is the parent's own diary: the child is not a user of the app, has no account, and has nothing to sign in to. Nothing in such a tree leaves the iPhone, is shown to anyone else, or is used to build a profile — the app builds no profiles and has no server to keep one on. The app is not directed to children and does not knowingly collect anything from them, because it does not collect anything from anyone.

Deleting things

A memory or a whole tree you delete goes to Recently Deleted and is kept for 30 days, so a mistake can be undone. After that the app erases it, together with any photo or recording that nothing else still refers to.

Deleting the app removes everything it holds, at once — there is no copy on any server of ours, because there is no server of ours. If you turned on iCloud backup, the .tmln files are in your own iCloud Drive under Timegrove, and you delete them there like any other file.

Because we hold nothing of yours, there is no request to send us and no account to close.

The App Store privacy label

Timegrove's label on the App Store reads Data Not Collected, in every category. That is not a statement of intent: the app ships a privacy manifest declaring no collected data types and no tracking, it contains no third-party SDK of any kind, and Settings ▸ Privacy Report inside the app shows you the same thing from the inside — including a running count of the bytes it has sent off your device, which is zero.

This website

The site runs on WordPress. Its server keeps ordinary web-server logs — IP address, time, page, browser — for a short period, which is what any web server does and what makes it possible to notice an attack. Comments are switched off site-wide, and there is no newsletter, because a mailing list is a database of people and we do not want one.

Cookies and local storage

Three things are stored in your browser, and only three:

  • tg_theme — light or dark. Written when you press the toggle in the footer.
  • tg_lang — the language you chose. Written when you use the language switch.
  • tg_consent — all or essential, whichever you answered in the cookie banner. Kept for 180 days.

All three are first-party, are never read by anyone else, and never leave your device. They are stored twice — as a cookie and in localStorage — because some browsers refuse scripted cookie writes and we would rather remember your choice than ask again on every page.

Analytics

This site currently runs no analytics at all. If that changes, this page changes on the same day, and the cookie banner appears before anything is measured.

Fonts, embeds and other people's servers

The Newsreader typeface is served from this domain, not from Google Fonts. There are no third-party fonts, no tracking pixels, no embedded videos and no social widgets. Apart from analytics, if you have allowed it, your browser talks only to this site.

Your rights

Because the app holds nothing of yours on our side, most data-protection requests have a short answer: we do not have it. For the website, you can ask what is held, ask for it to be deleted, or withdraw consent at any time.

Write to [email protected]. Two people read that inbox; expect a reply within two working days.

Changes

This page is versioned with the site. Last updated .