Privacy

Nagatha has no account and no sign-in. Your programs, your log, your chats and your settings stay on your phone, and in your own iCloud if you turn on sync.

Nothing leaves your phone for us unless you choose Continue on the screen Nagatha shows the first time you open her. Choose Not now and nothing is sent; the app works exactly the same. Versions of Nagatha that do not show that screen send us nothing at all.

Everything you put in: programs, the log and history, the chats, About me, what Nagatha calls you, notes and instructions, the lines she writes and how you reacted to them. The chat and the fresh lines run on your phone's own model, so they never leave it either.

With Sync with iCloud on, the same data is kept in your own iCloud private database, which only your Apple Account can read. We cannot see it. A report, export or backup goes only where you send it.

Nagatha sends anonymous usage signals to our server. They show us what people actually use her for and where she gets in the way. This is what is sent:

• Your programs, with personal details removed. The names of programs, stages and items, the kind of each item, how many times a day, the words and numbers in a routine (Hold, Relax, 10 reps, 5 seconds), where the program came from and roughly how long you have kept it.
• Counts. How many runs, reminders and answers in a week, by hour of day and weekday, and a small note when a run finishes or a reminder is answered: what happened, the hour and the weekday.
• Region and time zone. The region set on your phone and its time zone (Australia/Sydney, for example), with the app version, the iOS version, the kind of device and the language. Once a day, when you first open the app, these also go with the signing key, so we can count how many phones are active in each region and time zone.

Before anything leaves, your phone removes personal details from those names: your own names, email addresses, phone numbers, web links, dates and long numbers, then the names of people, places and organisations. Each name is cut to 60 characters. A program you mark Keep private is never sent.

• Your name, what Nagatha calls you, or anything in About me.
• Your chats, notes, instructions or comments.
• Anything from Health or your calendar.
• Any account, device or advertising identifier, or anything else that says who you are.
• Your IP address. Our server does not keep it, or your browser details, and request logging is off.

There is no install id, no device id and no token that lasts. Nothing links two uploads across a calendar month. A program carries a token that changes every week and another that changes every month, so the server can count how many programs were active in a week or a month, and nothing more. The tokens are made on your phone, and the server keeps only a scrambled copy of each, which it deletes once the following week or month is over. With the signing key, the phone also tells the server how many days it has been since it was last active, as a single number, so active users over a week or a month can be counted without linking anyone.

The key your phone signs uploads with still expires at midnight. Within one day the server can tell, while it checks them, that two uploads came from the same phone. It does not write that down. Because nothing points to you, there is nothing of yours for us to find or delete.

Your choice on that first screen is a switch in Settings, Privacy. Turn it off and nothing more is sent. What Nagatha shares, in the same place, shows the last thing sent, exactly as it was sent, with the date.

If our server cannot be reached, your phone holds the signals and tries again later. Anything older than seven days is dropped.

Each upload is signed with Apple's App Attest, which proves it came from a genuine copy of Nagatha on a real iPhone without telling us which iPhone or whose it is.

These pages set no cookies and run no analytics. Signing in on the web, when it opens, is for physios and people who write programs. Using the app never needs it.

If any of this changes, this page changes first, with a new date at the top. Questions to [email protected].