Understory
Privacy
Last updated 20 October 2026 · Understory for iPhone
Understory keeps what you write on your phone. There is no account, there is no server holding your answers, and there is no advertising or analytics in the app. It talks to the outside world in only a few ways, and each one is described exactly below. This policy is short because there is not much to say.
Who we are
Understory is made by SPENCER AI (ABN 31 978 335 623), Victoria, Australia. Where this policy says "we" or "us", it means SPENCER AI.
What we collect
Nothing you write, and nothing that says who you are. We do not collect, receive, store or have access to your answers, your trees, your foundations, your name, your email address or your device identifier. We could not hand your writing to anyone if we were asked, because we do not have it.
Where your writing is kept
On your device, in the app's own storage. It is included in your iPhone's backup if you back up your phone, which is between you and Apple and not something we can see.
You can export everything at any time, from Settings inside the app, whether or not
you have bought anything. You get a PDF to read and keep, and a .understory file that
can be brought back in. Both are made on your phone and neither passes through us.
The other side of this promise: if you delete the app, the record goes with it. There is no copy on our side to restore from, because there is no copy on our side at all. A phone backup, an export you have kept, or a tree connected to somebody else are the three things that survive it.
There is no analytics
No usage tracking, no advertising identifier, no advertising or analytics SDK, no attention or engagement measurement of any kind. We do not know how many screens you opened, how long you stayed, or whether you answered at all.
The app contains one third-party SDK, RevenueCat, and it is used only to check whether the purchase has been made. What it receives is set out under Payments.
Fault reports, described exactly
If the app hits a fault, it can send us an anonymous fault report, so that we find out something is broken rather than waiting for somebody to email. It goes to our own relay, not to a crash-reporting company, and you can turn it off in Settings, under Telling us when something breaks.
What is sent
The kind of error, a scrubbed one-line description of it, up to three file-and-line references from our own code, the name of the screen and the button that was in use (words from our own code, such as "settings" or "export"), a short code that identifies the fault rather than the phone, the app version and build, and your iOS version. That is the complete list, and the server drops anything else rather than storing it.
Before sending, the app asks the relay whether that same fault has already been reported today, and sends nothing if it has. No phone sends more than four reports in a day.
If the app cannot start
If Understory fails to open at all, it sends one fixed message, "the app did not start", with your iOS version, how long the app was on screen, and how many times it was hidden. Nothing else. The on/off switch lives inside your record, which is the thing that has failed to load, so this one message is sent whichever way the switch is set.
What is not, and cannot be
Nothing you have written. An error message can quote the text that caused it, so every quoted passage is stripped on your phone before anything is sent, and there is a test that tries to push real sentences through it and fails if any survives.
No name, no account, no email address, no device or advertising identifier, no location, and nothing that says which phone a report came from. Identical faults from a hundred phones are stored as one entry with a count.
Who receives it
We do, on the same Cloudflare Worker that carries sealed parcels. There is no third-party crash reporting service. Reports are deleted after 14 days.
Diagnostics
Settings ends with Help & diagnostics (five taps on the version number open it too). It is only for when something has gone wrong, and nothing leaves your phone unless you tap Send and then confirm.
What a report contains
The app version and build, your iPhone model and iOS version, language, time zone and free storage, the results of the health checks on that screen, and the app's recent technical log (screens opened, errors, timings). For Understory it also says which parts of the app started (export, dictation, purchases, notifications), how many trees, rings and foundations you have as counts, your membership state and when you last kept a copy, whether the relay answered, and the faults the app noted, with any quoted text removed.
What it never contains
Your answers, your tree's words, the names you give your trees and companions, your foundations, your contacts, your exact location or any password. The technical log holds event names, counts and timings; email addresses and long numbers are masked as a backstop, and a fault is the app's own error text, so in rare cases an error message could still quote a few words the app was handling at the time.
Before it goes, and where
Tapping Send to support first shows you exactly what will be sent. Only if you confirm
does it go to our own relay, relay.understorytree.com, which hands back a reference so
you can tell us which report is yours (with no signal, it opens the share sheet instead and you
choose where it goes). One report can be sent every ten minutes. It is used only to find and fix
the problem, is readable only by us, and is deleted after 7 days, well within the 90 days the
in-app notice promises. Copy report and Clear log are on the same screen.
The relay and your connection
Anything the app sends travels to relay.understorytree.com, which runs on
Cloudflare. Like any website, Cloudflare necessarily sees the network address a request comes
from in order to answer it. Our code does not read, store or log that address.
Permissions the app asks for
Microphone and speech recognition (optional)
So you can speak an answer instead of typing it. Transcription runs on your phone using Apple's on-device recognition. Your voice is not recorded, not stored, and not sent anywhere. If your phone cannot transcribe on-device, the microphone is removed from the app rather than quietly falling back to a server.
Camera and photos (optional)
So you can put a photograph of a companion on their page. The photo is scaled down and kept on your phone. If you share that companion's tree, the photo goes with the tree to the other phones on it, encrypted like everything else on that tree, so we cannot see it.
Notifications (optional)
A few a year per tree, and every one of them scheduled on your phone by your phone, from a date it already holds. No notification is ever sent from us, and none can be: there is no account, no device token and no server that knows a tree exists.
A tree asks a month before its anniversary, a week before, and on the day. After that it asks once a day only while a year is genuinely unanswered, and stops the moment you answer. A tree you have planted but not yet answered asks once instead, a week later. Your foundations ask once, six months after you last opened them.
Nothing arrives because somebody else did something. Not when a person joins a tree, not when they leave it, and not when an animal is marked as no longer with us. Turning notifications off in iOS Settings stops all of it and breaks nothing.
Trees answered with someone else
Three of the four trees are answered with other people in the room, and those people keep the same tree on their own phones. Connecting two phones is a one-time thing: after that, a year sealed on any of them reaches the others on its own, with nobody sending or accepting anything.
That delivery goes through a relay we run at relay.understorytree.com. Four things
are true about it, and they are enforced in the code rather than promised:
- We cannot read it. Your phone encrypts the parcel with AES-GCM before it is sent. The key is derived on the connected phones from keys that never leave them, and it is never sent to us in any form. The relay receives ciphertext and has no means to open it.
- We do not know who anyone is. There is no account, no email address, no name and no device token. A parcel is left at an address that is a hash only the connected phones can work out. To us it is a random-looking string with no person attached, and we cannot tell that two parcels came from the same pair of phones.
- We do not keep it. A parcel is deleted the moment it is collected, on the first successful read, not marked for cleanup later. One that is never collected is deleted after 400 days at most.
- We do not log who collected what. There is no analytics on the relay and no record of who sent or received anything.
A parcel carries the whole tree: every sealed year and, for a companion, their name, details and photograph. All of it is inside the encryption.
The relay only ever carries a copy. Every connected phone holds the complete tree, which is what makes deleting parcels that aggressively safe. If the relay disappeared tomorrow, nobody would lose a single year.
Why a parcel can wait 400 days
Understory is opened about once a year. A year sealed in March that its recipient does not come looking for until their own anniversary in November would be gone under a shorter rule, and the delivery would silently not happen. It is still ciphertext we cannot open, with nothing identifying anyone attached to it, and it is still destroyed the moment it is picked up.
What is not sent, ever
The self-reflection tree cannot be connected or shared at all. It is the one tree with nobody else in the room, and that is what makes it safe to answer honestly. The app refuses it in code, at every point where sharing could begin, not by hiding a button.
Payments
Understory's one purchase is handled by Apple. We never see your card, your billing address or your Apple ID. We use RevenueCat, whose SDK is in the app, only to check whether the purchase was made. It receives an anonymous identifier it creates for the app, the purchase record from Apple, and the basic technical details its SDK sends with each request, such as the app version, iOS version and App Store country. It never receives your writing. Apple's and RevenueCat's own privacy policies apply to that step.
The website
understorytree.com sets no cookies and runs no analytics. The FOUNDERS links (understorytree.com/founders/…) add one to a daily count for the platform the link was shared on, then send you to the App Store. Only that number is stored: not your IP address, your device or anything else about you. The homepage shows how many FOUNDERS places are left, which is a single number with nothing about any person in it.
Children
Understory is not directed at children under 13 and collects no personal information from anyone, of any age. A household tree may contain answers written by a child; those answers stay on the family's own phone exactly like every other answer.
Changes
If this policy changes, the date at the top changes with it. If the change is material, meaning the app ever begins collecting something it does not collect today, it will be said plainly in the app's release notes, not buried here.
Contact
Questions, or a request about your data: welcome@myspencer.ai. We will answer, though for most data requests the honest answer is that we have nothing of yours to give you, correct or delete.