Privacy Policy

1. Scope and who we are

This policy applies to the iOS app “Yesterbook” (the “App”). The App is developed and operated by the individual developer Chao Meng (“we”).

The App is a life-logging tool for journals, moods, check-ins and personal finances. It is designed to be “local-first”: we have no servers of our own, no account system, and no third-party tracking components. As a result, we do not collect, do not store, and cannot see anything you record in the App.

This policy explains where your data is kept, in which cases it leaves your device because of a feature you use, who it is sent to, and how you can control it.

2. Our promises

• Zero upsell pop-upsNo pop-ups pushing paid features. The “Buy the developer a coffee” tip appears only in Me › About; it never pops up, never reminds you, and never unlocks any feature.
• Your data is always yours to takeExport to JSON / CSV / Markdown at any time, regardless of payment status.
• We don’t use your content to train AIWe have no servers, so we never receive your content and can’t use it to train models; private content is never given to AI. A model provider you set up yourself receives only what each feature needs, handled under that provider’s privacy policy.
• Your records stay with you, not on our serversNo account sign-up needed; syncing goes through your own iCloud, end-to-end encrypted. A shared ledger syncs only between members you invite, via iCloud; Apple can see the amounts and other numeric figures, while notes and other sensitive content are encrypted separately with each shared ledger’s own key.
• Keep data at expiryIf we offer a subscription or trial in the future, your local data stays available to view and export after it ends.
• Deleted means deletedDeleted records can be recovered from Recently Deleted for 30 days, then are erased for good; deleting the app destroys local data; encrypted backups in the cloud are yours to manage or delete in one tap.

3. Where your records are kept

The content you create in the App—journal entries, notes, moods, check-ins, people and places, holidays, tags, financial records, photo and voice attachments, and so on—is kept only on your device:

• Records are encrypted one by one in the on-device database (encryption is always on, no setup needed), and attachments such as photos and voice recordings are encrypted file by file;
• The encryption keys are kept in the system Keychain and are never written to disk in plain text;
• The App records on the device only a small amount of usage state that contains no record content, for example: the date of first use and the days of use in the last 30 days (used to decide when to ask the system to show a rating request), and the timestamp of “whether today’s care message has already been shown”. This information does not leave your device;
• Performance and crash reports delivered by iOS (MetricKit; containing only launch times, hangs, memory and crash call stacks, no record content) are kept only on the device. You can view or delete them in Me › Data › Diagnostics, and they are never uploaded.

We currently do not collect any diagnostic or usage statistics. If we offer “anonymous diagnostics” in the future, it will be off by default and will report only after you explicitly turn it on, and will contain no record content; we will update this policy before then.

4. When data leaves your device

Related data leaves your device only when you use the features below; every transfer happens directly between your device and the relevant service, and does not pass through our servers.

1. iCloud backup and sync (on by default, can be turned off)

New installs have iCloud backup on by default, and you are told about it on first launch. Backup packages are encrypted on the device before upload and stored in the App’s folder in your own iCloud Drive (Files app › iCloud Drive › Yesterbook › Backups). File names contain only the backup time, device model and an install marker, and no record content.

• Stored in iCloud (default): the key is kept by your iCloud Keychain (end-to-end encrypted by Apple); sign in with the same Apple Account on a new phone to restore. Neither we nor Apple can read the content;
• Fully self-managed (optional): the key exists only on your devices and on the Recovery Kit you keep yourself. If you lose all your devices and the Recovery Kit, no one (including us) can help you get it back;
• You can turn off iCloud backup at any time in Me › Data, and can delete existing backups at the same time.

2. Shared ledgers (only when you create or join one)

A shared ledger syncs between the members you invite through Apple iCloud (CloudKit sharing). To make multi-person bookkeeping work, structured information such as amounts, categories, dates, who recorded the entry, name snapshots of counterparties / places, and members’ public keys is stored encrypted by iCloud and can be read by Apple; notes and other sensitive content are end-to-end encrypted with a key specific to that shared ledger, and Apple cannot read them either. Your journal, personal ledgers and private content never enter a shared ledger.

3. Weather and places (can be turned off in Me › Logging Preferences)

• Apple Weather (WeatherKit): each day when you open or return to the App (at most about once every 6 hours in the same place), and when you write a note or log a mood, your location at about 1 km precision is used to look up the current weather, hourly and daily forecasts, and local weather alerts. Only the converted weather type and a whole-number temperature are saved in the entry; your location is not saved. The forecast and the location grid cell of about 1 km are kept on the device for up to 24 hours, not included in backups and not synced;
• Apple Maps: when you log a mood, your location is used to look up a place name; only the place name is saved, not the coordinates. A location with about 11 m precision is saved to a place only when you check in at your current location or at a new place; the map’s base map sends only the visible map area; only when you tap search on the map page is the text in the search box sent to Apple Maps (without your location). Private places never appear on the map.

4. AI features (see the next section)

Content leaves your device only when you use a cloud model provider you set up yourself, and only the minimum content needed for that feature is sent.

5. Sharing (only when you tap)

Share text and share cards are generated only from content that is not marked private, and individual transaction amounts do not appear; only when you tap “Copy / Share” is the result handed, through the clipboard or the system share sheet, to the app you choose. The App does not keep a record of shares and does not integrate any social platform SDK.

6. Ratings and tips (via Apple)

The rating prompt is drawn and managed by iOS, and we can’t get whether you rated or how many stars you gave; “Rate Yesterbook” opens the App Store only when you tap it. Tips are made through Apple’s in-app purchase; payment information and transaction records are handled by Apple (the Apple privacy policy applies), and the App does not record whether you tipped, or the amount or number of times.

Opening Apple’s Health app, Home Screen / Lock Screen widgets, and Control Center buttons do not make any network request, and widgets do not read your records.

5. AI features

The App’s AI features (such as turning notes into journal entries, recognizing bills, periodic summaries, and the AI Assistant) are suggestion-only, can be turned off entirely, and do not build any profile for recommendations.

• On-device model first: on devices that support Apple Intelligence, the on-device model is used first, and content does not leave your phone;
• A model provider you set up yourself: only after you enter your own provider’s API key in Me › AI › Model Provider is the content a feature needs sent directly to the provider you chose, without passing through our servers. Whether that provider stores it or uses it for training is governed by its privacy policy. Your API key is kept only in the on-device Keychain and is never written to logs;
• Private content is never sent to a model provider;
• Content not sent by default and needing your separate permission: health summaries (sleep, workouts, steps)—requires turning on “Allow health summaries in cloud AI”; receipt / bill photos—requires allowing “Send receipt images” item by item, and only that one image is sent; imported bill files—your consent is asked in a confirmation dialog before sending, and financial files exported by the App itself are never sent to a model;
• In mainland China, only providers that have completed generative AI filing are offered (DeepSeek, Tongyi [Alibaba Cloud Model Studio], Kimi [Moonshot AI], Zhipu, Doubao [Volcano Ark]); in other regions, providers are offered according to each provider’s officially supported regions;
• “Learn my writing habits” distills style entries only on the device (originals are not saved), and can be turned off or cleared at any time.

6. System permissions

Every permission is requested only the first time you use the related feature; denying any permission does not affect other features, and a manual alternative is provided.

7. Third-party services at a glance

The App integrates no third-party SDKs (no analytics, tracking, push, sign-in, payment or social components). The services below are called by system frameworks or your device directly, and only when you use the corresponding feature:

We do not sell, rent or share your personal information with any third party—in fact, we don’t hold it.

8. Encryption and private content

• Records on the device are encrypted one by one, and backup and sync are end-to-end encrypted throughout;
• You can mark any record as “Private”. A private record is encrypted whole with a separate key and does not exist even in memory while locked; even with the database file or an iCloud device backup, private content cannot be read;
• Private content protection has two levels: Face ID only (default); Face ID + Privacy Passcode—even if the phone’s data is fully extracted, private content can’t be opened without the passcode. To be upfront: the “Face ID only” level’s key is, like the whole-database key, a Keychain item that is “readable after first unlock”, so forensic methods that can fully extract the Keychain from a phone that has been unlocked can read it;
• If you choose a custom privacy passcode, forgetting it means private content cannot be recovered, and we can’t help you get it back;
• Private content never enters AI requests, share cards, Lock Screen notifications or widgets.

9. Your rights

Under laws and regulations such as the Personal Information Protection Law of the People’s Republic of China (PIPL), you have the following rights over your personal information. Because your data is entirely under your control, most of these rights can be exercised directly in the App:

• Access and copy: export to JSON / CSV / Markdown at any time in Me › Data › Export;
• Correct: edit any record directly in the App;
• Delete: delete a single record (it can be recovered within 30 days in Me › Data › Recently Deleted, or erased immediately); erase by time range or everything in Me › Data › Erase data; turning off iCloud backup also deletes the cloud backup, or you can delete it in the Files app or in iOS Settings › Apple Account › iCloud; deleting the app destroys local data;
• Withdraw consent: turn off any system permission in iOS Settings at any time, or turn off switches in the App such as iCloud backup, weather and location, Health connection, and AI model providers;
• Account cancellation: the App has no accounts, so there is nothing to cancel;
• Complaints and inquiries: contact us as described in section 12.

10. Minors

The App is designed for adults and is not directed at children under 14. The App has no community or comments, and we do not collect anyone’s personal information. If you are a minor, please use the App with the company and consent of your guardian.

11. Updates to this policy

When the App’s data handling changes, we will update this policy and revise the “Last updated” date at the top. For major changes involving data flows, new permissions or new third-party services, we will notify you prominently in the App and, where necessary, ask for your consent again.

12. Contact us

If you have any questions, comments or complaints about this policy or your personal information, please contact:

• Developer: Chao Meng
• Email: mengchao0532@gmail.com

We will reply within 15 working days of receiving your email. If you are not satisfied with the outcome, you can file a complaint or report with the competent authorities such as the cyberspace and industrial and information technology authorities.