Understory
Privacy
Last updated 31 August 2026 · Understory for iPhone
Understory keeps what you write on your phone. There is no account, there is no server holding your answers, and there is nothing in the app that reports back. This policy is short because there is not much to say.
What we collect
Nothing. We do not collect, receive, store or have access to your answers, your trees, your foundations, your name, your email address or your device identifier. We could not hand your writing to anyone if we were asked, because we do not have it.
Where your writing is kept
On your device, in the app's own storage. It is included in your iPhone's backup if you back up your phone, which is between you and Apple and not something we can see.
You can export everything at any time, from Your data inside the app, whether or not
you have bought anything. You get a PDF to read and keep, and a .understory file that
can be brought back in. Both are made on your phone and neither passes through us.
The other side of this promise: if you delete the app, the record goes with it. There is no copy on our side to restore from, because there is no copy on our side at all. A phone backup, an export you have kept, or a tree connected to somebody else are the three things that survive it.
There is no analytics
No usage tracking, no advertising identifier, no third-party SDK, no attention or engagement measurement of any kind. We do not know how many screens you opened, how long you stayed, or whether you answered at all.
One exception, described exactly
If the app hits a fault, it can send us the error text and nothing else, so that we find out something is broken rather than waiting for somebody to email. This is the only thing Understory ever sends on its own, and you can turn it off in Your data.
What is sent
The kind of error, a scrubbed one-line description of it, up to three file-and-line references from our own code, the app version and your iOS version. That is the complete list, and the server drops anything else rather than storing it.
What is not, and cannot be
Nothing you have written. An error message can quote the text that caused it, so every quoted passage is stripped on your phone before anything is sent, and there is a test that tries to push real sentences through it and fails if any survives.
No name, no account, no email address, no device or advertising identifier, no location, and nothing that says which phone a report came from. Identical faults from a hundred phones are stored as one entry with a count.
Who receives it
We do, on the same Cloudflare Worker that carries sealed parcels. There is no third-party crash reporting service and no SDK in the app. Reports are deleted after 60 days.
Permissions the app asks for
Microphone and speech recognition (optional)
So you can speak an answer instead of typing it. Transcription runs on your phone using Apple's on-device recognition. Your voice is not recorded, not stored, and not sent anywhere. If your phone cannot transcribe on-device, the microphone is removed from the app rather than quietly falling back to a server.
Notifications (optional)
One reminder a year, on the anniversary of the day you planted, to tell you a sitting is due. Scheduled on your phone by your phone. No notification is ever sent from us.
Trees answered with someone else
Three of the four trees are answered with other people in the room, and those people keep the same tree on their own phones. Connecting two phones is a one-time thing: after that, a year sealed on any of them reaches the others on its own, with nobody sending or accepting anything.
That delivery goes through a relay we run at relay.understorytree.com. Four things
are true about it, and they are enforced in the code rather than promised:
- We cannot read it. Your phone encrypts the parcel with AES-GCM before it is sent. The key is derived on the two phones from keys that never leave them, and it is never sent to us in any form. The relay receives ciphertext and has no means to open it.
- We do not know who anyone is. There is no account, no email address, no name and no device token. A parcel is left at an address that is a hash only the connected phones can work out. To us it is a random-looking string with no person attached, and we cannot tell that two parcels came from the same pair of phones.
- We do not keep it. A parcel is deleted the moment it is collected, on the first successful read, not marked for cleanup later. One that is never collected is deleted after 400 days.
- We do not log who collected what. There is no analytics on the relay and no record of who sent or received anything.
The relay only ever carries a copy. Every connected phone holds the complete tree, which is what makes deleting parcels that aggressively safe. If the relay disappeared tomorrow, nobody would lose a single year.
Why a parcel can wait 400 days
Understory is opened about once a year. A year sealed in March that its recipient does not come looking for until their own anniversary in November would be gone under a shorter rule, and the delivery would silently not happen. It is still ciphertext we cannot open, with nothing identifying anyone attached to it, and it is still destroyed the moment it is picked up.
What is not sent, ever
The self-reflection tree cannot be connected or shared at all. It is the one tree with nobody else in the room, and that is what makes it safe to answer honestly. The app refuses it in code, at every point where sharing could begin, not by hiding a button.
Payments
Understory's one purchase is handled by Apple. We never see your card, your billing address or your Apple ID. We use RevenueCat to check whether a purchase was made. They receive an anonymous identifier and the fact of the transaction, never your writing. Apple's and RevenueCat's own privacy policies apply to that step.
Children
Understory is not directed at children under 13 and collects no personal information from anyone, of any age. A household tree may contain answers written by a child; those answers stay on the family's own phone exactly like every other answer.
Changes
If this policy changes, the date at the top changes with it. If the change is material, meaning the app ever begins collecting something it does not collect today, it will be said plainly in the app's release notes, not buried here.
Contact
Questions, or a request about your data: welcome@myspencer.ai. We will answer, though for most data requests the honest answer is that we have nothing of yours to give you, correct or delete.