01
who this is from, and what it covers
in plain terms
This policy is about the Tend iPhone app and this site. Apple's own services have their own policies, and so does anywhere you send a file yourself.
This policy explains what happens to information when you use Tend, the iPhone app for people living with fibromyalgia. Tend is published by Off Script Foundry, Inc. (“we”, “us”), and in this policy “the app” means Tend and nothing else. Tend runs on iPhone today, and where this policy says your device it means the Apple device you have Tend installed on, so if Tend ever runs on another Apple device the same rules apply there.
This site is part of it. The pages you are reading now carry no analytics, no advertising, no cookies and no tracking of any kind. Our host keeps ordinary server logs, and we do not read them for anything about you.
It does not cover Apple. The App Store, your iPhone backup, Apple Health, and the Face ID or passcode check your device performs are all Apple’s, and Apple’s privacy policy governs them. It also does not cover what happens to a file after you export it from Tend and send it somewhere; section 12 covers that.
It sits alongside the Terms and Conditions, which cover what Tend is and is not.
02
what we collect
in plain terms
Nothing. There is no account and no server of ours for anything to arrive at.
We collect nothing. Tend has no account, no sign-up, no login, and no user profile. It never asks for your name, your email address, your phone number, or any other contact detail. There is no server that the app talks to, and we receive no copy of anything you record.
The app contains no analytics, no telemetry, no event logging, no advertising, no crash-reporting service, and no third-party software kits of any kind. Every framework it uses is Apple’s own. It reads no advertising identifier and it takes no part in cross-app tracking.
This is why Tend’s privacy manifest declares no collected data types and no tracking domains, and why its App Store privacy label is Data Not Collected. The label describes the app as it is.
03
where your information lives
in plain terms
In an encrypted database on your iPhone. Your settings sit beside it, and the widget gets one small note about today. None of the three leaves the device.
Everything you put into Tend is written to a database on your iPhone. That includes your check-ins and every moment of a multi-moment day, the places you mark on the body map, your notes, flares and flare plans, medications and doses, labs, questions for your doctor, records of visits, reflections, practice completions, elimination and experiment entries, and cycle dates if you choose to log them.
That database is stored with iOS complete file protection, which means it is encrypted at rest and unreadable while your device is locked. It is not shared with any other app.
A small amount of ordinary app state is kept in the app’s own preferences on the same device: whether you have finished the introduction, your theme and accessibility choices, your reminder preferences, which practices and readings you have kept, the date of your last Apple Health read, and whether the app lock is on. None of it is health data and none of it leaves the device.
If you use the “one gentle thing” home-screen widget, the app writes a single small snapshot of today’s suggestion into a shared container on your own device so the widget can draw it. The channel runs one way, and the widget never opens your record.
04
this phone is the only place it lives
in plain terms
There is no cloud copy of your record. Your iPhone backup is the safety net, and exporting is the copy you can hold yourself.
The honest other half of “it never leaves this device” is that this device is the only place it lives. There is no server copy for us to hand back to you, because there is no server.
Tend rides along in your iPhone’s own backup. If you back your iPhone up and later restore a new phone from that backup, your Tend record comes back with it. If your iPhone is not backed up and you lose it, the record is gone, and we cannot recover it for you. Those backups are Apple’s and are governed by Apple’s terms and privacy policy.
Exporting your data, described below, is the copy you keep yourself: a plain file that is readable without Tend.
05
health information, and why it is held this way
in plain terms
Most of what Tend holds is sensitive health information about you. It is never sold, never shared, never used for advertising, and never seen by us.
Most of what Tend holds is health information about you: symptoms, pain, fatigue, sleep, mood, medications, and free text about your body and your life. In many places this is legally special category or sensitive personal information, and it is exactly the kind of information that does real harm when it escapes.
We treat it as such by not having it. It is never sold, never rented, never shared with anyone, never used for advertising, marketing or profiling, never used to train any model, and never seen by us or by anyone working with us.
06
apple health
in plain terms
Optional and read-only. Four kinds of data: sleep, steps, resting heart rate, and heart-rate variability. Tend never writes to Health, and nothing it reads leaves your phone.
If you choose to, Tend can read four kinds of data from Apple Health: sleep analysis, step count, resting heart rate, and heart-rate variability. It sits beside what you tell the app; it never replaces it.
It is off until you turn it on in Settings, it is read-only, and it is never required. Tend asks for no write permission at all, so it can never put anything into Apple Health. It asks for no other Health data type. In particular it does not read menstrual data from Health. If you turn on cycle tracking, the dates are the ones you enter yourself.
Anything read from Health is written into the same on-device record as everything else, and goes nowhere. If you decline, the app carries on using what you tell it, and it does not ask again.
07
weather and location
in plain terms
To show local pressure, Tend asks for a rough, city-level location and sends it to Apple's weather service to fetch the conditions. It keeps the weather, not your whereabouts. Decline and the feature simply goes quiet.
Tend shows a barometric pressure reading beside your days, because many people with fibromyalgia say they feel the sky change before anything else.
To do that it reads real conditions through Apple’s WeatherKit, and that is the one part of Tend that needs something from outside your phone.
Tend asks for while-you-use-the-app location, at reduced accuracy. Reduced accuracy is an iOS setting that gives an app a rough, city-level area rather than your exact position, and it is what Tend asks for by default. It never asks for precise location and never asks for background location.
That approximate area is sent to Apple to look up the conditions where you are, and it is used for that lookup and nothing else. What Tend keeps afterwards is the weather, not your whereabouts: the pressure, humidity and temperature come back and are written into the same on-device record as everything else. No coordinates are stored, and nothing about your location reaches us, because we have no server for it to reach.
Apple handles the lookup itself, so Apple’s privacy policy governs what happens on their side. Apple publishes that WeatherKit requests are not associated with your Apple Account.
If you decline, nothing breaks. The pressure card goes quiet and the rest of the app carries on exactly as before, using only what you tell it. You can withdraw the permission at any time in iOS Settings, and the app will not ask again.
08
voice notes
in plain terms
Speak a note and your phone turns it into text by itself. No recording is kept, and no audio is sent anywhere.
On days when typing is hard, Tend lets you speak a note instead.
Speech is turned into text by iOS on your device. The app requires on-device recognition, so there is no path in it that sends audio to a recognition server. No recording is saved: the audio exists only while you are speaking and is discarded as it is transcribed. If on-device recognition is not available on your device, the app offers a text field instead rather than quietly falling back to a network service.
The microphone and speech recognition permissions are requested the first time you use this feature, and never otherwise.
09
reminders and notifications
in plain terms
Reminders are set by your phone, for your phone. No server sends you anything.
Any reminder Tend gives you is a local notification scheduled by the app on your own device. Nothing is sent from a server, no push token is registered, and no notification identifier is transmitted anywhere.
After you have saved a few check-ins, Tend quietly asks iOS for the gentlest kind of notification permission. No prompt appears, and reminders arrive softly in Notification Center rather than as banners. Full banners are only ever requested when you ask for them in Settings. If you decline, or switch them off later in iOS Settings, the app carries on without them and does not nag.
10
the app lock, face id and touch id
in plain terms
The lock is your phone's, not ours. Tend only ever learns that the check passed. Your device passcode always works, so it cannot shut you out of your own record.
You can ask Tend to require Face ID, Touch ID or your device passcode before it opens. This is off unless you turn it on, and you can turn it off again at any time.
It is handled entirely by iOS through the LocalAuthentication framework. Tend receives one thing back: whether the check succeeded. It never receives your face, your fingerprint or your passcode, and it stores no biometric data of any kind. Nothing about the lock is sent anywhere.
The lock always accepts your device passcode as a fallback, so it can never lock you out of your own health record. While it is on, Tend hides its contents in the iOS app switcher and the home-screen widget redacts itself.
11
permissions the app asks for
in plain terms
Five, all optional, each asked when you reach the feature that needs it. No camera, no contacts, no background location. Refuse every one and the app still works.
Tend asks for these, and only these:
- Apple Health, read-only, when you tap to connect it in Settings. Four data types, described above.
- Microphone and speech recognition, the first time you speak a note instead of typing it.
- Notifications, for the reminders you set yourself. Tend also makes one silent request after a few check-ins, described in section 09, which shows no prompt.
- Face ID or Touch ID, only if you turn the app lock on.
- Location, while you are using the app, at reduced accuracy, only to fetch local weather. Section 07 describes what is sent and what is kept.
The app asks for no precise location and no background location, no camera or photo access, no contacts, no calendars, and no Bluetooth. Every permission above is optional, is never asked up front, and is never asked for a second time if you decline. The app works when you say no to all of them.
12
when information leaves your device
in plain terms
Your record leaves only when you send it, and then it goes where you chose, never to us. The one automatic exception is the rough area sent to Apple for weather.
There are two ways your record can leave this device, and both begin with you tapping something.
Export my data. Settings writes your record to a JSON file and a CSV file and hands them to the standard iOS share sheet. You choose the destination: a message, a mail app, Files, another app, your own computer.
The doctor’s letter. Tend can compose a printable PDF summary of what you have logged and share it the same way, so you can bring something real to an appointment.
Once a file leaves through the share sheet it is in the hands of whatever service or person you sent it to, under their terms, and out of our reach. It never passes through us on the way.
One related thing worth naming: the crisis resources screen opens your phone or messages app with a number already filled in. Placing the call or sending the text is your action, handled by your device and your carrier. Tend does not place it, does not record it, and does not know whether you did.
13
taking your data, and erasing it
in plain terms
Export gives you everything as JSON and CSV. Delete everything erases the record from your phone, with no undo. Deleting the app takes its database and settings with it, but not your iPhone backup or any file you already exported.
Export. “Export my data” in Settings gives you your complete record as a JSON file and a day-per-row CSV file, immediately, free, and in a form other software can read. There is no request to make and no waiting period, because there is nobody to ask.
Delete everything. In Settings, this erases your entire record from the device. It asks you to confirm, and then there is no undo. Because we hold nothing, that is genuinely the end of it.
Deleting the app. Removing Tend from your iPhone removes its database and its preferences with it. What may remain is whatever is inside an iPhone backup you already made, and any file you exported yourself. Both are yours to manage.
Edit and correct. Every entry in Tend can be changed or removed by you, at any time, in the app.
14
how long anything is kept
in plain terms
Your record stays on your phone until you delete it. We keep nothing, so we have nothing to keep for a period.
Your record stays on your device for as long as you keep it there. We do not delete it, expire it, or age it out.
We hold no logs, backups, archives or analytics history about your use of the app, so on our side there is no retention period to describe.
15
children
in plain terms
Tend is made for adults managing their own health. We hold no data on anyone, children included.
Tend is intended for adults managing their own health. It is not directed at, designed for, or marketed to children, and it does not knowingly handle information from anyone under 13, or under the minimum age of digital consent where you live if that age is higher.
There is nothing in the app that asks a person’s age, because there is no account and no profile. Because we collect nothing, there is no child’s data for us to hold or to delete. If a child has used the app on a device, “Delete everything” in Settings erases the record, and deleting the app removes what remains.
16
your rights over your information
in plain terms
Your data never reaches us, so the app itself is where you exercise your rights. Export is your copy, Delete everything is your erasure, and both are in Settings with nothing to request from us.
Depending on where you live, you may have rights under the EU General Data Protection Regulation, the UK GDPR, the California Consumer Privacy Act, or a similar law. They cover knowing what is held, getting a copy, correcting it, deleting it, limiting its use, and not being treated worse for asking.
Those rights are aimed at organizations that hold your personal information. We hold none, which changes what exercising each one looks like in practice:
- Access and portability. Section 13 describes “Export my data”: the whole record, in machine-readable JSON and CSV, at once, at no cost.
- Correction. Every entry is editable by you in the app.
- Deletion and erasure. Section 13 describes “Delete everything”. No request to us is possible or needed, because we never received a copy.
- Sale, sharing and targeted advertising. We do not sell or share personal information, and we have never done so. There is no advertising in the app and no opt-out to give you, because there is nothing to opt out of.
- Restriction, objection and limiting sensitive information. There is no processing by us to restrict, object to, or limit.
- Automated decision-making and profiling. None takes place. The patterns the app shows you are calculated on your own device from your own entries. They describe your data back to you. They decide nothing about you.
If you want to raise something anyway, or you think any of this is wrong, write to daniel@offscriptfoundry.com and a person will read it. If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your local data protection authority.
17
security
in plain terms
Your record is encrypted on your phone, and you can put a lock in front of the app. There is no account of yours to steal and no server of ours to break into.
The record is stored with iOS complete file protection: encrypted at rest and unreadable while the device is locked. The optional app lock, described in section 10, adds Face ID, Touch ID or your passcode in front of the app itself.
Most of the protection here is structural. Tend has no password to be phished, no session to be hijacked, no API key, and no database of ours that could be breached, because none of those things exist. The app ships with no third-party code in it, which is a common way health data escapes apps that never intended it to.
The controls that matter most are the ones you already hold: keep a passcode on your iPhone, keep iOS up to date, and keep the device backed up. No system is perfect.
18
changes to this policy
in plain terms
Changes are posted here with a new date. If a future version ever starts sending data off your phone, we will say so here before it does.
If this policy changes, the updated version is posted on this page with a new date at the top. That date is the only version marker, and because there is no account, this page is the notice.
If a change is significant, and in particular if a future version of the app begins sending anything off your device, we will name the change here.
19
contact
in plain terms
Write to us and a person reads it.
Questions about this policy, about the app, or about something that could be gentler: daniel@offscriptfoundry.com.
Tend is published by Off Script Foundry, Inc., 1248 W 700 S, Pleasant Grove, UT 84062, USA.