App Privacy Policy.

This policy describes the native The Way of Creation app for iPhone, iPad and Mac. Reading and drawing random cards work without an account. AI, Memory, iCloud sync and sending feedback each involve separate choices.

The Swiss operator identified below is responsible for the app and the processing described here. Contact hello@thewayofcreation.com for questions about the app or your data.

…
Switzerland

Before normal app use, you confirm that you are at least 18, agree to the App Terms of Use and acknowledge this Privacy Policy. We record that age confirmation, not your birth date. This does not activate AI processing, automatic Memory or iCloud sync. Those choices are separate.

The encrypted device vault records the document versions and hashes, language, your explicit choices and the time reported by your device. No account is required for this local record. If you later sign in with Apple, the app links that receipt to your coded service account and records when the server received it. The server does not independently verify the earlier device time.

When a revised policy is presented, the app asks again before further normal use. Existing notes, conversations and drafts are preserved. You can still read the policies, contact support and access data-deletion and Apple subscription controls without accepting the revision.

Your conversations, unsent drafts, memory notes, kept cards and reading positions are stored in an encrypted local vault. The device keeps its encryption key in Apple's Keychain. The app excludes its personal vault from device backups; losing the device or its key can make local data unrecoverable.

Reading and search happen locally. Search terms, reading positions and kept-card lists are not sent to our AI service. The app has no advertising or reading-engagement analytics.

The app downloads public content editions and images when needed. These requests contain the public resource address and technical connection data, not your conversations, notes or search terms. Public content is kept separately from the encrypted personal vault.

Before the first AI request, the app asks you to sign in with Apple and agree to AI processing. An AI request processes the content needed for that action: your message or situation, conversation context, the card or writing you attach, and memory notes when memory is enabled. Selected words are processed with the full writing as context. Guide and memory suggestions also process relevant conversation content. An unsent draft is not uploaded merely because you type it.

Requests pass through our service and OpenRouter to Microsoft's Azure provider in the EU. We restrict routing to that provider, require zero data retention and disable fallback providers. Our servers process the content to answer the request but do not store conversations, drafts, notes or generated replies.

Our app does not enable OpenRouter prompt/output logging or model training. OpenRouter retains request metadata, such as token counts and timing, and categorizes prompts to produce anonymous usage statistics. Its zero-retention routing permits temporary in-memory prompt caching. We do not use a persistent response cache for personal replies. The EU restriction applies to the model provider; it does not mean every OpenRouter system is in the EU.
Automatic Memory is off until you activate it. Once activated, the same AI response may create, update or remove memory notes on your device; it does not make an additional model request. You can inspect, edit, delete or clear notes, or turn Memory off. Turning it off retains the notes but stops sending and automatically updating them. Existing permission to use manually saved notes does not activate automatic updates.

Reading Guide is off until you turn it on. Once on, it refreshes suggestions from your chosen current conversation or enabled memory notes when that context changes and Read or Guide settings is open. Each update uses your AI allowance. You can change sources or turn the Guide off.

Apple verifies your sign-in. We request your email address for essential account, security and service notices. You can use Hide My Email to keep your personal address private. We do not request your name, subscribe you to newsletters or send your email to the AI provider.

Our service keeps your contact email encrypted, a coded account identifier, versioned Terms and privacy-acknowledgement receipts, separate AI consent version and time, session records and device-verification information. It protects the Apple credential needed to revoke sign-in when you delete the service account.

We record request identifiers, action types, costs, turn counts and allowance periods to enforce limits, settle provider charges and prevent abuse. These records do not contain your message text. Network connections expose an IP address to the infrastructure handling the request; our application uses short-lived keyed network hashes for abuse checks and excludes managed request logs from retained app logs.

We process the information needed to provide the functions you choose, fulfil the app-service agreement, protect accounts, prevent abuse, settle usage and meet legal obligations. Where applicable data-protection law requires a legal basis, these purposes rely on performance of the agreement, legal obligations or legitimate interests in operating a secure, reliable service. We limit that processing to what is necessary.

Optional AI processing requires your separate informed consent, including processing potentially sensitive information you choose to submit. You can withdraw it by stopping AI use and signing out; you may also request deletion of the service account. Existing local material remains available unless you erase it. Memory and iCloud have their own controls. Withdrawing a choice does not undo processing already completed lawfully.

If you enable sync, the app sends encrypted personal records to your private iCloud database: conversations, memory notes, kept and recent cards, and reading positions. Unsent drafts, pending attachments, service credentials, AI consent and Guide state are not synced.

A separate encryption key is shared through iCloud Keychain with your devices. Apple also processes record identifiers, sizes and synchronization metadata. Our AI service does not receive the cloud vault or its key. Recovery depends on access to the same iCloud account and key; encryption does not guarantee that lost data can be recovered.

Apple handles payment details. Our service receives verified purchase identifiers, subscription periods and renewal or refund status, together with a coded account binding. We use these records to provide paid access, restore purchases and prevent a purchase being used by the wrong account. We do not receive your payment-card or bank details.

Help prepares an email in your Mail app, or lets you copy the text. You review the content before sending. Conversation messages are included only when you select them for feedback. A sent email reaches our support mailbox with the information your mail service supplies, including your sender address. We delete support correspondence within 30 days after the issue is resolved.

Local personal content has no automatic expiry. You control it in the app. Service identity, contact email, Terms and Privacy receipts, separate AI consent and device records remain while the service account exists; account deletion removes them and revokes the protected Apple credential.

Detailed usage and request records expire after 35 days, except unresolved charges or active allowance obligations. After account deletion, a minimized coded marker keeps current cost and turn counts until that allowance period ends, to prevent limits being reset by creating another account. It contains no conversation text or contact details.

Minimal purchase records expire 35 days after paid access ends, including any billing grace period. A specific dispute or legal obligation can require longer retention; we keep only the records needed for that case. Required accounting documents are kept separately for ten years.

Redacted operational logs are kept for 14 days. Network abuse signals last at most 24 hours. Purchase-notification duplicate checks last eight days; completed deletion-status receipts last seven days. Expired access is rejected immediately; physical removal follows scheduled cleanup.

The app service does not currently keep scheduled database backups. Its database retains older versions for one hour, so deleting a live record does not instantly remove that version history. There is no promise of restoring service records after that window. This is separate from your local vault and optional iCloud data.

Settings offers separate controls for signing out, erasing this device, stopping iCloud sync, deleting iCloud data and deleting the service account. Read each confirmation: stopping sync does not erase existing cloud data, and erasing one device does not erase another. Account deletion does not cancel an Apple subscription; manage it separately in Apple's subscription settings.

You can use Help to request access, correction or deletion of service data and to raise a privacy concern. Where applicable law provides additional rights, including restriction, objection or data portability, you may exercise them too. We may need to verify that the account is yours. You may complain to the competent data-protection authority, including Switzerland's FDPIC.

You can change Hide My Email forwarding in your Apple Account settings.

Google Cloud runs the app service in Zurich. OpenRouter routes AI requests to Azure in the EU. Apple provides sign-in, app/device verification, purchases and optional iCloud services. Proton hosts our support mailbox. Opening an external link or sending email involves the service you choose and its own privacy practices.

Regional hosting is not a promise that every supplier's support, security or account system operates only in that region. OpenRouter's privacy policy describes possible transfers to the United States and other countries.

Each Terms and Privacy Policy version is identified by its date and content hash. The app presents revised documents for a new explicit choice. Acknowledging a revised privacy notice does not automatically grant a new AI, Memory or iCloud permission. Changes that need additional processing consent are presented separately before that processing begins.