muni² privacy policy
The short version
Your words stay on your device. There is no account. We don't run ads, we don't track you, we don't count what you do in the app, and we never sell anything. The only things that leave your device are ones you start yourself: an iCloud backup that you turn on (it goes to your own iCloud, not to us), or a page you export or share yourself. muni² has no analytics, ads or tracking tools inside it. If you share app diagnostics in your device settings, Apple can pass crash reports to us, and they carry nothing you wrote.
What stays on your device
Everything you make in muni²: your pages, the scenes drawn from them, voice recordings (if you keep them), photos you add, your tree, your time capsules, and the visitors and places that take shape from your writing, with the private count of words behind them. All of it lives on your iPhone or iPad. We can't see it, and we don't have a copy.
Your pages are read and your scenes are drawn on the device itself. Nothing you write is sent anywhere to be read or drawn. If you turn on backup, what is kept is in the backup, encrypted like everything else, apart from wishes, which are never kept (see "Your tree" below).
Spoken and written
Each part of a page remembers whether you spoke it or wrote it, so the page can show which is which. That is a note on the page, kept with the page on your device, and in your backup if you have it on. It is in the JSON export too. Words you dictate with the keyboard's own microphone key count as written.
Unsaved words
While you write or speak a page, the words you haven't saved yet are kept on your device, so they survive if the app closes or your phone restarts. They are stored in the same place as your pages, on the device only.
If you close the page with its close button after typing only, those typed words are thrown away. If the page holds words you spoke, they are kept as an unsaved draft and offered to you again the next time you open muni², with the message "Your words from earlier are here." The draft stays until you save the page or delete the words.
A draft is never part of a backup and is never sent anywhere. Delete everything removes it with the rest of your pages.
Your tree
The tree grows as you save pages. muni² keeps how far it has grown, which of its changes you have already seen, and which small things (a bench, a birdhouse, a path) have appeared. All of it stays on your device, and in your backup if you have it on.
The weather on your tree comes from the weather already drawn into your latest page. muni² doesn't ask where you are and doesn't go online for it.
A wish you tie to the branch is never stored. The box is emptied when you tie it on, and the wish keeps no words. It is not in your backup. It frays and goes.
Time capsules
A time capsule holds a letter, up to 2 photos, and, if you choose, a month of your pages. It stays on your phone, and in your encrypted iCloud backup if you have backup on, until the day you set. Nothing leaves your phone except that encrypted backup. Restoring a backup never opens a capsule early.
Visitors and places
muni² looks for names and themes that come back in your pages. It does this on your device, and nothing leaves the phone. What it keeps is a private count: the word, how many pages hold it, and which creature it became, plus which visitors you have seen. A place you mention 3 or more times appears in Book as a place. The count table stays on the device. If you turn on backup, it is in the backup, encrypted like everything else.
"Let something go" removes a word's count and its visitor for good. If you had kept that visitor as a star, the star goes too.
Speaking a page
When you speak, the words are turned into text on your device using Apple's on-device speech recognition. No audio leaves the device, not to us and not to Apple's servers. Voice works in English for now.
If you use the microphone key on the keyboard instead, that is Apple's own dictation, not muni²'s. It follows Apple's settings and privacy terms, and it may use Apple's servers. muni² keeps no recording of it.
By default muni² keeps the recording with the page, on your device. In Settings you can turn off "Keep voice recordings". New recordings stop at once, and only the text of what you say is kept. muni² then asks, "Delete the recordings already kept?" If you choose "Keep them", the recordings you already have stay with their pages. If you choose "Delete them", they are removed from your device, and from your iCloud backup the next time it backs up. Your pages and their words stay either way. If you have backup on, kept recordings are in it, encrypted like everything else.
Photos
You can add up to 3 photos to a page, and up to 2 to a time capsule. You pick them in Apple's photo picker, so muni² never asks for access to your photo library and only gets the photos you choose. They are stored on your device and shown under your text. muni² doesn't read, scan or describe them, and they are never sent to us.
Microphone
muni² asks for the microphone only when you tap to speak. If it's off, you can keep typing.
Widgets
A muni² widget shows a copy of your latest scene picture, never your words. That copy stays on your device, is removed when you delete your last page or use Delete everything, and is replaced by plain paper when Lock is on.
iCloud backup (optional)
Backup is off until you turn it on. When it's on, your pages are copied to your own iCloud, encrypted. They sit on Apple's servers under your Apple Account, not on any server of ours. We hold no key and have no way to read them.
You can back up now, restore on a new device, or turn backup off in Settings.
We don't count what you do
muni² has no analytics inside it. It doesn't send usage counts, events or statistics, and it has no sign-up, no ID for you or your device, and no analytics, ads or tracking tools. The only numbers we see are the ones Apple gives every developer in App Store Connect, such as how many people viewed or bought the app. Apple gathers those itself, and they say nothing about what anyone does inside muni².
Crash reports
muni² doesn't send crash reports itself. Apple collects crash and diagnostic information only if you have turned on "Share with App Developers" in your device settings (Privacy & Security, Analytics & Improvements). If you have, Apple shares crash reports for muni² with us through Xcode and App Store Connect. They show where the app went wrong and on which version, and they carry nothing you wrote. You can turn sharing on or off in your device settings at any time.
First-time download
After you install, muni² downloads the drawing paper (the model and scene catalog) from Apple. It downloads again when a new scene pack or festival is added. Every download comes from Apple, through Apple's Background Assets service, the same way the App Store delivers the app itself. We don't run a server for it, so we never see your IP address or any other detail of the download. Nothing you wrote is part of it.
The first time you tap Speak, your phone may also download Apple's English speech model. That comes from Apple too, as part of iOS, and nothing you said or wrote is part of it.
No ads, no tracking, no selling
There are no ads. muni² doesn't track you across other apps or websites, and it doesn't ask for tracking permission because it doesn't track. We don't sell or share your data. On the App Store, muni² is labelled "Data Not Collected".
The purchase
muni² costs $4.99, paid once on the App Store. Apple handles the payment. We don't see your payment details.
Children
muni² is rated 4+ on the App Store. It isn't made for children in particular, and it doesn't collect personal information from anyone, children included.
Export and deleting
- Export: in Settings, Backup and export, you can export every page as a PDF book, plain text, or JSON with scenes and whether each part was spoken or written. Export is pages only: time capsules stay sealed and your tree is not exported. The file goes only where you send it. muni² never sees it.
- Delete a page: it moves to Recently deleted for 30 days, then it's gone. The page's photos and voice recordings move with it and are deleted with it after the 30 days.
- Delete everything: in Settings. This removes every page, scene, photo, recording, name, place and wish from your device, and it sends your tree back to a seed and removes every waiting time capsule, and it can't be undone. If you have a backup, there is a switch, "Also delete my iCloud backup". It is off by default. If you leave it off, your backup stays in your iCloud until you delete it. If you turn it on and the backup can't be reached, nothing is deleted.
- Deleting the app removes what's on the device. A backup in iCloud stays until you delete it.
Because we hold none of your pages and collect no data, there is nothing for us to delete or hand over on our side. Crash reports come from Apple without anything that identifies you.
Changes
If this policy changes in a way that matters, the app will say so. The date at the top is the last change.
Contact
Questions: [email protected]