Who is responsible
Unrotten is provided by NORTH VENTURES LLC. In this policy, ‘we’ means NORTH VENTURES LLC, the controller responsible for deciding how Unrotten processes personal data. This policy covers the iOS app, the services that support it and our website, unrotten.app.
Postal address:
NORTH VENTURES LLC
300 Delaware Ave
Ste 210 #260
Wilmington, DE 19801
United States
Contact support@unrotten.app, or use Settings → Privacy → Your data → Request access or deletion.
Your profile and activity
Unrotten saves your chosen name, language, app preferences, goals, schedules, usage summaries, session estimates, scores, check-ins and progress on your device. Apple’s Screen Time frameworks provide privacy-protected app, category and website selections and activity signals. We use these to track the apps you select, apply your rules and show your progress. We do not read the content inside your other apps or your browsing pages. Screen Time selections are not a list of readable app names sent to our service. Earlier versions may have stored an Apple sign-in identifier and email locally; you can remove them in Settings → Privacy → Your data.
Apple Health
Health access is optional and controlled by Apple’s permission system. Depending on the categories you allow and records available, Unrotten reads steps, workouts and their timing, energy, exercise and move minutes, distances, flights climbed, mindful minutes, sleep stages and timing, heart rate and related metrics (including resting and walking heart rate, heart-rate variability, cardiorespiratory fitness and respiratory rate). We use this information for goals, activity and sleep summaries, and MindBattery™ recovery. With write permission, completed breathing sessions can be saved as mindful minutes, and the nights and workouts you log by hand as sleep and workouts. We do not write invented health measurements. Health information is not sold, used for advertising or used for data brokerage. With your separate AI data-sharing permission, available health context may be sent to our AI service providers to support your requested wellbeing features. Health permission alone does not enable AI sharing.
Personalized AI and voice
Your AI Coach is included with Unrotten. Before personal data is shared with third-party AI, onboarding or your first AI request asks for explicit permission. Choosing “Allow & continue” grants permission; viewing the step, accepting the Terms or choosing “Not now” does not. You do not need to grant it again for each conversation.
Coach replies, Home messages, follow-ups, nudges and AI Insights send relevant context to our service and AI providers: your chosen name, language, profile and preferences, usage and session summaries, goals, scores, available health context and an installation identifier. Chat requests also include your message, relevant conversation history and saved memories. Voice recordings are sent for transcription; their text is then used in the conversation. Our backend does not maintain an archive of ordinary chat conversations or voice recordings. This does not mean that no data is retained: generated morning messages and nudges have separate storage, described below, and AI providers may retain inputs and outputs under their applicable service terms.
OpenRouter routes AI and transcription requests to model providers, including Google Gemini and other models. TypeSafe receives the current and previous user message to help select relevant context for the Coach. See Service providers and delivery for their roles. Do not submit passwords, payment details or information you do not want processed. Review or withdraw permission in Settings → Privacy → AI personalization. Withdrawal stops new requests containing personal data but does not erase records already processed. Existing local chats and unrelated local features remain available.
Morning messages, nudges and follow-ups
To prepare a morning message while the app is closed, our service temporarily stores structured facts such as screen-time totals, goals and outcomes, MindBattery™ scores, sleep and recovery information, Coach persona, language and time zone. This upload excludes your conversation text and follow-up plans. The input is cleared when generation succeeds, or through cancellation, opening, expiry and final-failure handling.
The generated morning message is stored for delivery and to help avoid repetition: generation can consult the last three morning messages. Reading a message does not delete its server copy. Scheduled cleanup removes morning records older than 14 days. Generated nudge text is cleared when the app retrieves it; unclaimed nudge text is cleared by scheduled cleanup after 24 hours. Nudge delivery records are removed after 14 days. Generated text can itself mention personal activity or health information. These records are linked to your installation, not anonymous.
Follow-up plans and prepared check-in messages are saved on the phone for local notifications; preparing a message still uses AI providers. Notification choices are in Settings → Notifications. Turning off a notification category does not delete previously processed service records or withdraw AI data-sharing permission.
Community comparisons
To show the level distribution, the app sends its installation reference, level-policy version, confirmed level when available and qualifying-day count to our service. We store a hashed participant reference, level and update time. The reference is pseudonymous: it still corresponds to an installation. The app receives aggregate percentages, hidden when fewer than ten participants qualify. Only records updated within the last 30 days contribute; falling outside that window does not itself delete a record. This feature uses no AI model and operates independently of AI-sharing permission. Request access or deletion through the privacy contact form.
Usage analytics
Unrotten uses Google Analytics for Firebase, a Google service, to learn how the app is used so we can improve it. It records the screens you open and the features you use (for example the steps of onboarding and the membership offer, starting a phone-free session, or turning a goal on or off), your app settings (such as language, active goals, notification switches and Dynamic Island style), membership purchases (plan and price, how long each took and, when one doesn’t go through, the App Store’s error codes), whether this device allows in-app purchases, how often and how long the app is open, and technical details such as app version, iPhone model, iOS version and the general location Google derives from your IP address. These records are tied to a random identifier that Google Analytics creates on your device, not to your name, email, Apple account or Unrotten’s installation reference. The identifier still links records to this app installation; these are not anonymous records. They never include what you write, your chats or memories, your Apple Health data, your Screen Time data (such as which apps you use or for how long), your scores, or your location from Location Services. We do not use the advertising identifier, Google signals or advertising features, and we do not link these records to Google Ads. Usage analytics is on by default. You can turn it off at any time in Settings → Privacy → Share usage analytics; the app then stops sending these records and deletes its analytics identifier from your device. Google Analytics is configured for 14-month event and user-data retention, with user-data retention renewed by new activity. Aggregated reports can remain longer. Turning analytics off does not itself delete records already held by Google.
Ad measurement
When we advertise Unrotten, we measure which ads bring people to the app with Tenjin, a mobile measurement service, and with Apple’s privacy-preserving attribution (SKAdNetwork and AdAttributionKit). The app tells Tenjin when it is opened, how often and for how long, and whether you reached the membership offer, started a free trial or subscribed, with technical details such as app version, iPhone model, iOS version, language, country, time zone, the identifier Apple gives one developer’s apps on your device (IDFV) and your IP address. RevenueCat sends Tenjin your subscription’s events, such as a trial converting, a renewal, a cancellation or a refund, with their prices, linked to those identifiers. The ad network that showed an ad receives from Apple only an anonymous report of the campaign and how far the install went, never who you are. If you came from an Apple Ads ad, RevenueCat receives Apple’s record of its campaign and keyword. We never ask to track you, so the app has no advertising identifier, and none of this includes what you write, your Apple Health data, your Screen Time data or your scores. Ad measurement follows Settings → Privacy → Share usage analytics: when it is off, the app stops sending these records and removes from RevenueCat the identifiers it gave it for Tenjin. Turning it off does not itself delete records Tenjin already holds.
Our website
Our website, unrotten.app, uses Google Analytics, a Google service, to learn how visitors use it: the pages they visit and for how long, the site that sent them, how far they get through the landing page’s opening story, which sections they reach and which demos they try, and whether they follow a link to the App Store or open the code to scan with an iPhone, plus technical details such as browser, device type and the general location Google derives from the IP address. These records are tied to a random identifier kept in a cookie in your browser, not to your name, your email or the app’s records. They never include what you enter in the page’s demos, such as the hours or the value of your hour on its sliders. In the European Economic Area, the United Kingdom and Switzerland the website keeps no analytics cookie: Google receives only measurements without cookies. We do not use Google signals or advertising features, and we do not link these records to Google Ads. You can block them with your browser’s privacy settings, a content blocker or Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). Google Analytics keeps these records for the period set in our website’s property, at most 14 months; aggregated reports can remain longer.
Service providers and delivery
Cloudflare hosts our backend, delivery state and operational records. Notifications and Live Activities use Apple push services; our service stores installation references, push tokens, cached score/usage/recovery state and delivery information to keep them working. Operational records include request counts, model/provider identifiers, token counts, costs, status/error codes and timings, and evaluation verdicts without the underlying chat text. These support delivery, security, usage limits, reliability and service analysis. Network providers may process IP addresses and security logs.
OpenRouter routes AI and transcription requests. Configured models include Google Gemini, DeepSeek, Qwen and OpenAI; the provider serving a request can vary. TypeSafe separately receives the current and previous user message to select relevant Coach context. Data-collection restrictions on model routing do not guarantee that every provider keeps no data. Providers may retain request content or metadata for service operation, abuse prevention or legal obligations under the terms applicable to the route. We do not promise universal zero retention or one retention period for all AI providers.
Google supplies Firebase usage analytics for the app and Google Analytics for our website. RevenueCat receives App Store purchase/subscription details and our installation reference to validate purchases, manage membership access and provide subscription analytics; it does not receive your payment-card details from Unrotten. Our installation reference links service records and RevenueCat; a support request can associate it with your email. Tenjin receives the ad-measurement records described under Ad measurement, including subscription events from RevenueCat. We do not sell personal data, and we do not track you across other companies’ apps and websites. We require service providers to protect the data and process it consistently with applicable law and our arrangements with them.
Support and feedback
When you contact us, we receive your message, email address and any files you choose to send. Feature ideas and improvement suggestions are treated as support correspondence. A diagnostic attachment is required for “Something isn’t working” and optional for other topics. It is the app’s record of this iPhone, to find what went wrong: versions, device model, locale and time zone, battery and storage, and permissions; Screen Time monitoring, its recent records and the app’s decisions about them; blocking, and your goals with their settings and recent results; today’s MindBattery™ timeline and recent score changes, with when each happened and its points; notification, Live Activity and widget state; and the app’s recent activity log. It excludes readable app names, anything you write (chats, memories, the words behind a goal), your name, Health measurements such as steps, sleep, workouts or heart readings, and push or access tokens: a change that came from Apple Health shows only its time and points. You can review the exact attachment first. Every message includes the installation reference, the ID RevenueCat uses for your membership, so we can find your purchase (for example, for a refund) and the relevant service records. The form sends your message through Cloudflare from an Unrotten address to our support inbox, with your email as the reply-to address. We use correspondence to reply, troubleshoot, improve the app and handle rights requests, not to subscribe you to marketing.
How long information stays
Local history and preferences remain until removed. Unpinned chats are cleaned up after 24 hours of inactivity when the app performs cleanup; pinned chats remain until deleted, with a maximum of 300 persisted messages per chat. Saved memories remain until removed. The optional recovery backup stores history and key settings in this device’s protected, non-synchronizing Keychain and can survive an app reinstall. Turn it off in Settings → Privacy → Your data to remove that copy. Apple manages any system device backups you enable.
Morning-message and nudge retention is described above. Live Activity state and token records have a 30-day expiry renewed when updated; recovery-session and bonus-notification records use 24-hour expiry periods. Selected endpoint and delivery diagnostics are cleaned up after 14 days. These periods do not cover every service record. AI usage/spend/routing ledgers and community participant records have no general automatic age-based deletion rule. We retain operational, subscription and support records as needed to provide and secure the service, resolve requests and disputes, and meet legal obligations. Support emails and attachments remain in the support mailbox; expiry of a duplicate-submission receipt does not delete them.
Firebase retention and renewal are described under Usage analytics, and the website’s under Our website. Provider logs, infrastructure backups and legally required records can have separate retention periods; application cleanup is not a guarantee that every copy disappears at that moment. Deleting a local chat, turning off a notification or uninstalling does not itself delete previously processed service records. Request access or deletion through the in-app privacy contact form; legally required records may be retained with restricted use.
Your choices and legal bases
Where data-protection law requires a legal basis, we rely on consent for Health access, microphone access and sharing personal data with AI providers; performance of the service you request for core features and support; legitimate interests for proportionate security and reliability, for usage analytics that help us improve the app and for measuring our ads, both of which you can turn off in Settings → Privacy → Share usage analytics, and for our website’s analytics, which your browser can block; and legal obligations where applicable. For health data where special-category rules apply, optional sharing relies on your explicit consent. You can withdraw Health or microphone permissions in iOS or Apple Health, and AI data-sharing permission in Settings → Privacy → AI personalization. Withdrawal affects future processing and does not make earlier lawful processing unlawful. Some features need their related permission to work, but declining optional permissions does not prevent you from using unrelated features.
Access, deletion and other rights
Depending on where you live, you may request access, correction, deletion, a portable copy, restriction or objection to processing, and withdraw consent. Use Settings → Privacy → Your data → Request access or deletion or email support@unrotten.app. We may ask for proportionate verification to protect your information and will respond within applicable legal deadlines. You may complain to your local data-protection authority and will not be penalized for exercising your rights. To remove this device’s app data, disable and remove the recovery backup, then delete Unrotten. Health records remain in Apple Health and can be managed there. Online service records require a separate request.
Security and international processing
We use protected platform storage, encrypted transport and access controls. No storage or transmission is perfectly secure. Our providers may process data in countries other than yours. Where required, transfers must use an applicable adequacy decision or appropriate contractual safeguards. Contact us for information about safeguards relevant to your request. Avoid sharing unnecessary sensitive information in support messages or chats.
Young users and policy updates
Unrotten is a personal wellbeing tool, not a children’s service. It is not intended for children under 13 or below the age at which they can lawfully consent to relevant processing in their country. A parent or guardian should contact us if a child has provided personal information without required permission. We may update this policy as the app or law changes. The revision date appears above; material new uses of optional data require a renewed choice where required. This policy does not remove mandatory rights under local law.