This Privacy Policy explains how Penumbra ("Penumbra", "the app", "we", "us", or "our") handles information in connection with your use of the Penumbra iOS application (bundle identifier xyz.bogtsi.umbra). Penumbra is developed and operated by an individual developer based in Israel (the "Developer").
Penumbra is operated by a solo developer based in Israel. For any privacy question or request, contact us at support@bogtsi.xyz.
The following information is created and stored only on your device, in a local SQLite database inside the app's own sandbox. It is never transmitted to us — we operate no server to receive it — and we cannot access it:
Because this data lives only on your device, it is removed when you delete the app, or when you use the double-confirmed delete all data option in Penumbra's Settings. We provide no cloud backup or sync of this information ourselves; if you use iCloud device backup, your device backup is governed by Apple's own policies, not by us.
Penumbra offers an optional lock on the app itself, toggled off by default in Settings. When it's on, opening the app calls iOS's own LocalAuthentication framework, which shows the standard system Face ID, Touch ID, or passcode prompt.
You can turn the lock on or off at any time in Penumbra's Settings. Turning it off does not delete or expose any of your existing entries — it only changes whether the app requires a check before opening.
Penumbra can schedule up to three kinds of local notification on your device only, each generated and delivered entirely on-device and each independently optional: a daily reminder to reflect, an opt-in alert before a verified Apple free trial's current period ends, and an opt-in weekly reminder to consider making a manual backup. We use no push tokens and send no remote push notifications. None of these notifications ever contains anything you've written — the daily reminder names only a generic prompt-to-reflect or your active journey's next day number, the trial reminder names no specific date or charge amount, and the backup reminder never itself creates, reads, or sends a backup file — it only opens awareness that you may want to make one yourself.
Penumbra can turn your speech into editable text for the journal body and the trigger/glimmer "What happened?" field, using Apple's on-device Speech framework.
Voice-to-text requires you to grant microphone and Speech Recognition permission the first time you use it; you can decline or revoke either at any time in iOS Settings, and typing remains fully available whether or not you grant them. This feature is available on iPhone only.
Penumbra can export your entries as plain text (free, for everyone) or as a PDF (a Penumbra Pro feature). Either way, the app builds the file or text on your device and hands it to the standard iOS share sheet or a "Copy/Share" action. Where it goes next is entirely your choice — Files, Mail, another app — and that destination's handling of it is governed by whatever app or service you choose. The file or text is not sent anywhere by us.
Penumbra offers a separate, manual backup of everything described in Section 2 — one file that can later be used to restore your data, including onto a different device. Penumbra runs no automatic backup or sync of any kind; a backup is only ever created when you explicitly ask for one.
A backup file you save or email — protected or not — reflects a snapshot of your data as of the moment you created it; it is not kept in sync with later changes.
Penumbra relies on a small number of third-party services. When you use the app, some of these services may collect or process data directly, under their own privacy policies. We map each one below.
| Service | When it applies | What it processes | Purpose |
|---|---|---|---|
| RevenueCat | When you start, restore, or manage a Penumbra Pro subscription | Purchase and subscription data, keyed to a pseudonymous app-user identifier (we never set a user ID, because there are no accounts). No journal content, trigger logs, check-ins, or other writing is ever sent to RevenueCat. | To process purchases, validate receipts, and unlock Pro features |
| Apple / App Store | Download, updates, and in-app purchases | Purchase transactions and standard App Store data handled by Apple. Payment is made to Apple with your Apple ID — the Developer never receives or sees your payment card details. | App distribution and payment processing |
| iOS LocalAuthentication | Only if you turn the Face ID / passcode lock on in Settings | A pass/fail authentication result. No biometric data is provided to Penumbra or to us — see Section 3. | To lock the app so only you can open it |
| Apple Speech framework | Only if you use voice-to-text (Section 5) | Audio processed entirely on-device to produce a text transcript; no audio or transcript is sent off your iPhone by this feature. | To turn your speech into editable text |
| Mail / your chosen destination app | Only if you choose "Email a backup" or "Save to Files" (Section 7) | The backup file itself (plaintext unless you add passphrase protection), handled from that point on by the app or service you picked, under its own policies. | To let you move a copy of your data off this device, on your own terms |
| Expo / EAS | App build, distribution, and over-the-air updates | Used to build and ship the app and to deliver JavaScript updates; the app sends no journal content or personal data to Expo at runtime as part of Penumbra's features | To build and ship app updates |
We use no analytics or crash-reporting SDKs of our own (no Firebase, Sentry, Amplitude, or similar), and Penumbra's own code makes no network requests to any server we operate. Penumbra does not integrate with Apple Health / HealthKit and does not request any Health permissions.
Penumbra contains no advertising and no advertising SDK. The app displays no ads, contains no third-party ad or tracking framework, and does not collect or use the advertising identifier (IDFA). Because nothing in the app tracks you, Penumbra never presents Apple's App Tracking Transparency prompt. If advertising were ever introduced in a future version, this Privacy Policy would be updated before it shipped — but doing so would work against the app's core design, since advertising would require exactly the kind of data collection Penumbra is built to avoid.
The services above process data under their own privacy policies, which we encourage you to review:
We ourselves do not collect or receive your personal data, journal content, trigger logs, or check-ins on any server. Information is used only for the purposes described above: providing app features on-device (journeys, the reflection deck, the trigger log, check-ins, insights, voice-to-text, exports, backups, and reminders), and processing subscriptions. We do not sell your personal data, and we do not use it for advertising or profiling — there is no mechanism in the app by which we could, since nothing you write ever reaches us.
Data stored locally on your device is retained until you delete it in the app, use the delete-all-data option in Settings, or uninstall the app. A backup file you save or email exists independently of the app, on whatever destination you chose, until you delete it there. Data processed by third parties (RevenueCat, Apple) is retained according to their respective policies.
Penumbra is not directed to children and is not intended for use by anyone under the age of 13 (or the minimum age of digital consent in your jurisdiction, such as 16 under the GDPR). We do not knowingly collect personal information from children — indeed, we do not collect it from anyone, since nothing written in the app is transmitted to us. In line with the U.S. Children's Online Privacy Protection Act (COPPA) and the GDPR's protections for children (GDPR-K), if you believe a child has provided personal information through the app, please contact us at support@bogtsi.xyz.
The Developer is based in Israel. Penumbra is available through the Apple App Store internationally. The third-party services we use (RevenueCat, Apple) may process data in various countries, including the United States, in accordance with their own policies and legal safeguards. Your journal entries, journey progress, trigger logs, and check-ins are not part of any such transfer — they never leave your device unless you yourself choose to share or email a backup. By using the app, you understand that the limited subscription information described above may be processed in countries other than your own.
Because your journal stays on your device, its security is tied to your device's own protections (passcode, encryption) plus, if you enable it, the app's own Face ID / passcode lock, handled entirely by iOS. A backup you choose to share or email is only as secure as the destination and, if unprotected, is plain readable text — see Section 7. Data handled by third-party services is protected under their respective security practices. No method of storage or transmission is 100% secure.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and post the new version at this URL. Material changes will be reflected here; your continued use of the app after an update constitutes acceptance of the revised policy.
Questions about this Privacy Policy or your data? Email support@bogtsi.xyz.