Your journal is an encrypted file in this app's storage.

What the app stores, and where

Your journal is one file in this app's storage. The widget has a separate sealed summary. An iCloud Backup or an encrypted Finder backup can restore the app container. The iCloud Drive copy and files you share are separate copies.

That journal file is encrypted before it is written. The journal key is created on this phone or recovered from an encrypted device backup, then kept in the Keychain. Progress photos and your profile photo use the same journal key. The widget summary uses a key of its own. The key for the sealed iCloud Drive journal copy stays within your own Apple Account through iCloud Keychain. The developer cannot reset these keys for you.

An encrypted iPhone backup carries the recovery key with it. An unencrypted local backup can bring the sealed journal file without the key that opens it. In that case the app keeps the file and does not write over it.

The barcode cache is a readable list of the products you have scanned. It goes nowhere on its own, and erasing your data leaves the barcode list behind, because nothing in it is an entry you made. Body scans are encrypted on this phone. An older scan saved before encryption stays unencrypted until this phone's key is available. The app says so on the scan card.

Local diagnostics are also a readable file. A readable backup, spreadsheet or PDF you export is readable to anyone who receives it. The app says so before it writes one.

Exports are deleted when sharing closes. If a copy can't be removed then, the app keeps trying each time it opens.

There is no Dialed account to make and no Dialed sign-in. Store purchases and iCloud use the Apple Account already on this phone; the developer does not create an account for you.

You can read and change your journal with no connection. Food lookups, food search, purchases and iCloud copies need their own connections, but none of them blocks the journal.

What can leave the phone

Barcode lookup

When lookup runs, the barcode digits and a fixed Dialed app label go to Open Food Facts, a public food database. Dialed adds no journal entry, account or device ID. Like any web service, Open Food Facts receives connection details such as the IP address. Barcode lookup, in Settings under Notifications & Data, turns it off.

Food search

The words you type into food search leave only if you send them. The last row of the results prints the exact words and sends them to the same public food database when you tap it, and only then. Typing sends nothing. The request adds fixed search options and a fixed Dialed app label, but no journal entry, account or device ID. The service receives connection details such as the IP address.

Food search, in Settings under Notifications & Data, turns it off, and the food table in the app keeps working without it.

Optional iCloud Drive copy

A sealed copy of your journal goes to your iCloud Drive if you switch it on. It goes to your own Apple Account, never to a developer server. Progress photos join only if you turn their switch on. Body scans and local diagnostics are not in this copy. Turning the journal copy off deletes it and reports a deletion failure.

The key that opens the copy stays within your own Apple Account through iCloud Keychain. A phone without that key tells you the copy is sealed and asks you to sign in to the same Apple Account and turn on iCloud Keychain. The developer cannot reset the key.

Files and cards you share

A backup, spreadsheet, PDF report, compare card or local diagnostics file leaves when you make one and pick where it goes. PDF reports and compare cards can include weight read from Apple Health. Dialed does not start one of these shares by itself. Each export starts with a tap from you and ends in the share sheet, where you choose.

Apple services

An iCloud Backup or encrypted Finder backup can carry this app's container, including the journal, photos, scans and local diagnostics. Health can sync samples Dialed wrote through iCloud. Apple sends TestFlight crash reports to the developer automatically; for App Store builds it sends reports when Share With App Developers is on.

iCloud Backup, Health sync and Share With App Developers are Apple settings. Finder has an Encrypt local backup setting.

Feedback

Feedback you choose to send goes through TestFlight on beta builds or your email app, only after you review it. If neither can open, your note is copied so you can send it yourself.

If you include context, it includes app and iOS versions, device model, entry-category counts, and whether Apple Health is connected, app lock is on, and barcode lookup is on. It includes no meal, mood, weight, note, compound name or photo content, and nothing is sent until you send it.

Direct requests made by Dialed

Current routes for journal data include the iCloud Drive copy, a device backup, a file or card you share, and nutrition samples you let Dialed write to Health. Turn both food lookups off and Dialed makes no direct web requests. Dialed sends no analytics or telemetry, and the developer runs no server. Store purchases and the Apple routes above can still use Apple's services.

Apple Health

Dialed reads the fields you switch on. Raw samples are not copied into the journal, but a Dialed-day record can store whether Health steps or a Health workout completed its activity mark. Health weight can appear in PDF reports and compare cards you share. Dialed writes your logs to Health when on: calories, protein, water, caffeine and sodium can go into Health and sync through iCloud.

Turning a switch off stops new Health reads and writes right away. Turning a switch off does not revoke Health's grant or remove earlier writes.

When you open a workout that has a route, Dialed reads that route from Apple Health while the workout is open and draws it in the app. Dialed does not save or send the route, and nothing is fetched to draw it.

The Health app lists the grants it has given Dialed. Dialed's switches control what it uses, not what Health lists as allowed.

Photos, scans and diagnostics

New progress photos and profile photos are sealed before they are stored. Older progress photos are read from their existing files while Dialed retries sealing them after launch. Dialed tries to seal an older profile photo before loading it and retries on a later launch if sealing fails. An iCloud Backup or encrypted Finder backup can include both. Exported backup files include neither. Progress photos go to the app's iCloud Drive copy if you turn on both the journal copy and its photo switch.

Body scans are encrypted on this phone. An older scan saved before encryption stays unencrypted until this phone's key is available. Scan records are left out of the iCloud copy on purpose. Like your journal, they are included in your phone's own device backups. iCloud Backup and an encrypted Finder backup can restore them to a new phone. An unencrypted Finder backup cannot restore encrypted scans. An older scan saved before encryption is restorable from it until it is encrypted. Otherwise they travel only in a backup you export yourself.

Dialed uses MetricKit on this phone to receive and save crash and performance records from iOS. The readable file can include stack frames, build, OS, device and region details, memory figures and app-load outcomes, but no journal entries. It rides encrypted device backups and leaves through the Diagnostics share action. Dialed sends no analytics or telemetry itself. Apple's separate crash-report delivery is listed above.

Retention and deletion

Deleting the app removes the local journal file, not a device backup, the iCloud Drive copy or a file you already shared.

Erase all data, in Settings behind Leave Dialed, removes the journal, scans, photos, staged share files and the app's iCloud Drive copy, and reports if the iCloud copy could not be deleted. It does not touch a file already shared, the barcode cache, local diagnostics or Health permissions. Health samples written earlier can remain when Health writing is off.

Exports are deleted when sharing closes. If a copy can't be removed then, the app keeps trying each time it opens. A copy you already shared is controlled by the place you sent it.

Withdrawing consent and changing choices

• Turn barcode lookup or food search off in Settings under Notifications & Data.
• Turn the iCloud Drive journal copy off to delete that copy. A deletion failure is reported.
• Turning a switch off stops new Health reads and writes right away. Health permissions remain in the Health app, and earlier Health writes can remain.
• Use Erase all data for the items listed in the retention section above.

This website

dialedjournal.app is separate from the app. The website collects the email address you choose to submit, along with the optional "what are you tracking" answer. The beta itself is open on TestFlight and needs no email; the address is used to notify people who cannot join yet. It is stored for that purpose: no newsletter, no advertising, no sale or sharing, and no third-party marketing service. Ask at support@dialedjournal.app and we will delete it.

The website also uses Vercel Web Analytics to record page views. When you activate a tracked link, it records one of three custom events: testflight_click when you open a TestFlight link, testflight_continue when you continue from the TestFlight explainer to Apple, and support_email_click when you open a support email link. The custom event payload adds the placement of the link on the site. It does not add your email address, a query string, an account identifier or a device identifier.

Changes to this policy

If a release changes these routes or controls, this policy and the privacy claims register must change with it.

Contact

Questions about this policy: support@dialedjournal.app