Privacy Policy

Last updated: 28 October 2026

middle place (“the app”, “we”, “us”) is a private, between-sessions support tool. This policy explains what information the app handles, where it goes, and the choices you have. It is written to be read by a person, not just a lawyer.

The short version: the app is local-first. Your chats, journal, and memory live on your device. If you leave sync on, a copy is also kept on our servers so your devices can share it, but it’s locked on your device first with a key only your devices hold, so we can’t read it (section 3). You sign in with Apple once, and Apple shares your name and email with us (or a private relay address, if you choose Hide My Email), which we keep with your account so it stays yours. We don’t run ads, there are no third-party trackers, and we never sell your data. Data leaves your device to do a specific thing you asked for — get an AI reply, write a Life Report, turn a voice entry or a spoken message into text, or compare notes with a friend — and our backend doesn’t store the content of any of it. Sync is the one thing we keep, and only in that locked form. The one automatic exception is a place name you mention, looked up in Apple Maps to pin it on your map (section 2). We also count how often each feature is used, roughly what time of day, and whether people come back, mostly as plain totals. The one record kept against your account is a log of its AI requests, each with its kind and the time it ran, filed with your email. If you become a supporter, we keep when your subscription runs until, so the extra AI allowance follows your account; Apple handles the payment and we never see it. Nothing you wrote is attached to any of it; section 13 spells out exactly what that is.

1. Who this applies to

This policy applies to the middle place app for iPhone, iPad, and Mac, and to the backend service that powers it. The app is a prototype intended for adults seeking a private space for reflection. It is not a medical device, not a substitute for professional care, and not a crisis service.

2. Information stored on your device

Almost everything you create stays on your device, in the app’s local storage. This includes:

Your chat messages and the assistant’s replies, including the model’s reasoning and tool-activity log;
Your memory — long-term notes about your struggles, goals, and what helps, plus the lists the assistant maintains (for example people in your life, current struggles, and coping strategies);
Your timeline — things you’ve done and plans you’ve mentioned, with when they happened, who was there, and how a plan went;
Your journal entries, including any photos, voice recordings, locations, and reflections you add (such as items imported from Apple’s Journaling Suggestions);
Any documents you choose to import;
A search index of your journal entries, chats and timeline, made on your device by a small language model built into the app, so search can find things by what they mean as well as by their words. It never leaves your device: it isn’t synced, isn’t included in backups, and is erased with the rest of your data when you reset the app or delete your account;
Your Life Report and any Common Ground results you’ve saved;
App settings and preferences.

This information is not transmitted to us simply by being stored. It only leaves your device in the specific, named circumstances described in sections 3–10. Separately, and never including anything you wrote, the app sends the usage counts described in section 13.

Two other things can leave your device. The first is a place name, sent to Apple Maps. When you mention seeing someone, the assistant saves a hangout on your device, and the app looks up where you said you were — sometimes with a rough, city-sized area around places already pinned — so it can appear on your map. The people, the day, and your notes are never sent, and none of it goes through our backend. Places that sound private or clinical (home, work, a friend’s flat, a therapist’s office) are skipped. It’s on by default; turn it off in Settings → Privacy & security. Journal locations you search for or pin use Apple Maps the same way. Results are saved with the hangout or journal entry, and synced end-to-end encrypted if sync is on.

The second is a voice recording, to be turned into text. If you record a journal entry out loud, the recording is saved with the entry on your device so you can listen back (and synced end-to-end encrypted if sync is on). If you speak a chat message instead of typing it, the recording is only kept until it’s turned into text, then deleted; it’s never saved with anything or synced. Either way, to turn it into text, what happens depends on the AI option you’ve chosen in Settings:

Built-in AI service (the default): a compressed copy of the recording is sent through our backend to Google’s Gemini model, which writes out the words and sends them back. The names of the people you’ve added go with it, so it spells them right; nothing else about them is sent. Our backend relays it and does not store the audio or the text. Google processes it as a sub-processor under its own terms (see section 12).
Your own Anthropic key, or Apple’s on-device model: the recording is turned into text on your device by Apple’s speech recognition, and the audio isn’t sent anywhere.

The text appears in your entry, or in the message box, for you to edit before you save or send it. The recording itself is never sent to the chat assistant.

3. Sync between your devices

The app offers optional sync so your chats, journal (photos and voice recordings included), memory, timeline, and saved reports follow you across your own devices. There is no separate account to create: sync uses the same sign-in described in section 5.

End-to-end encrypted. Each item is encrypted on your device (AES-256-GCM) before it leaves, with a key that was created on one of your devices and is shared between them by your iCloud Keychain. The key is never sent to us. Our servers (Google Firebase) hold only the encrypted copy, and neither we nor Google can read it.
What our servers can see. Encryption hides what you wrote, not that you use sync. We can see: which account has been given access; a random “vault” identifier, plus two check values that let a device prove it holds your key, all worked out from the key without revealing it; how many encrypted items you have and roughly how big each one is (sizes are rounded up to 256-byte steps), and the size of each photo and recording; when each change was made and uploaded, and a random tag saying which of your devices made it; the total space your vault uses and the calendar days it was created, last opened, and last changed; and, for each of your devices, the app version it runs and the last day it synced. We can’t tell what kind of item each one is (a message, a person, a journal entry), and we never see names, text, photos, recordings, or your key.
Kept apart from everything else. Nothing about your vault is stored with the usage counts in section 13 or with your daily allowance. The only place your vault and your account meet is the permission that lets your account open it.
Your recovery code. The app can show your key as a 56-character recovery code. Save it somewhere safe and private: anyone who has it can unlock your synced data. It’s how you get back in if you lose iCloud Keychain, and how you link a device that doesn’t use iCloud Keychain. We can’t recover it for you. If every device, your iCloud Keychain, and the recovery code are all lost, nobody can unlock the synced copy, including us.
Storage limit. Each vault has a storage limit, and photos and recordings count toward it. If you reach it, new changes stop syncing (they stay safe on your device) until it’s back under.
Turning it off. Sync is a setting you control. Turning it off deletes the synced copy from our servers (every encrypted item, every photo and recording, and the vault itself). Your data stays on your device, and your other devices stop syncing and keep their own copies.

Moving away from iCloud sync. Sync used to run through your personal iCloud account (Apple’s CloudKit). It is being replaced by the sync described above. If you had sync on, your devices move over automatically the first time the updated app opens; for a while they may use both, so a device that hasn’t updated yet stays in step. The old copy in your iCloud isn’t deleted automatically. If you had sync off, nothing changes: it stays off and nothing is uploaded. Your timeline and voice recordings were never part of iCloud sync: they are only ever synced the end-to-end encrypted way above. Your use of iCloud, including iCloud Keychain, is governed by Apple’s Privacy Policy.

4. Automatic encrypted backups

Separately from live sync, the app can keep periodic snapshots of your conversations and memory so you can restore them if something goes wrong. These backups:

are written to your own iCloud Drive (you can see the files in the Files app), never to us;
are encrypted before they’re written, with a key kept in your iCloud Keychain — so a device signed into the same iCloud account can restore them, but the files are unreadable without that key;
are limited in number (only the most recent snapshots are kept; older ones are pruned automatically);
can be set to daily or weekly, or restored from, in Settings.

Backups cover your chats, memory, timeline, and journal, including photos, voice recordings, locations, and snippets. They are encrypted at rest and are never sent to our backend.

5. Chat — information sent for a reply

For the AI to respond, your message — together with the relevant memory context the app assembles — must be sent to an AI model. By default this is done through our backend, which acts as a secure relay:

What is sent: the text of your message and the system instructions and memory context for that turn.
What our backend does with it: it forwards the request to the AI provider (Anthropic) and streams the reply back to you. It does not store the content of your messages, your memory, or the AI’s replies, and it does not keep logs of what you wrote.
What our backend does store: a minimal abuse-prevention counter — your account identifier with a per-day request count and timestamp — and anonymous usage tallies recording that a feature ran, plus two return-rate rows holding only dates and counts, and a log of your AI requests filed under your account with your email: the kind of each request and the time it ran, how much text went to and from the AI, and what it cost us (see what we measure). None of it contains any message content.

To use the backend, the app signs you in and uses Apple’s App Check (App Attest on iPhone and iPad, DeviceCheck on Mac) to confirm requests come from a genuine copy of the app. On first launch the app signs you in anonymously, then asks you to sign in with Apple once, which links your Apple ID to that account. The app asks Apple for your name and email. You can change the name on Apple’s screen, and choose Hide My Email to share a private relay address that forwards to you instead of your real one. Apple also shares a private identifier it creates for us alone. Our sign-in provider (Google Firebase Authentication) keeps the identifier, your email and your name with your account. They’re used to keep the account yours, and your email is also kept with the AI request log in section 13 so we can see how much each account uses. Both are deleted when you delete your account. On the device, the first name Apple shares also fills in what the app calls you, which you can change. Because of that link, your account follows your Apple ID: reinstalling the app or signing in on another device brings you back to the same account. A journal entry you write in the app goes to the model so it can reply, like a chat message; imported entries don’t get replies. On the built-in AI service the app may also send your journal entries, imported ones included, through our backend to Google’s Gemini model to help keep your timeline and the summaries of your life up to date. Our backend keeps nothing from them beyond the counts described above. Your photos are never sent. When a new entry has photos, your phone describes each one in a few words first, using Apple’s on-device image recognition: when it was taken, how many faces are in it, and what it shows (“people, board game, table”). Those few words go with the entry so the AI can tell which photos belong to which moment it puts on your timeline. Where a photo was taken is never included, and the descriptions aren’t stored.

Ask, in Search, answers questions about your own archive. The app first searches your journal, chats and timeline on your device, then sends your question and the closest passages it found to the AI, along with anything the AI looks up while it answers. That can include imported journal entries. It goes the same way a chat message does: through our backend to Anthropic by default, or with your own Anthropic key, or to Apple’s on-device model. Our backend keeps nothing from it beyond the counts described above.

6. Document import

If you import a document so the app can fold it into your memory, the text you import — along with the relevant part of your existing notes — is sent to Google’s Gemini model (through our backend, or directly if you use your own key) to extract structured edits. As with chat, our backend relays this and does not store the document or the result; the outcome is saved only in your on-device memory.

7. Life Report

Life Report is an optional feature that composes a warm, reflective summary of where you are right now. Nothing happens until you tap to create it. When you do:

The app builds a consent-gated snapshot of your memory — your struggles, goals, one-line summaries of the people in your life, and what helps you cope. Medications are deliberately excluded, and anything flagged as crisis content is stripped out before anything is sent.
That snapshot is sent to Google’s Gemini model to compose the report — through our backend (which signs the request with your account identifier, never your name or email) or directly, if you use your own key.
Our backend does not store the snapshot — it’s used only in the moment to compose your report. Google processes it as a sub-processor under its own terms (see section 12).
The finished report is saved on your device (and synced, end-to-end encrypted, if you’ve enabled sync). It isn’t shared with anyone else.

8. Common Ground

Common Ground is an optional, opt-in feature for two people who choose to compare notes — typically in person — to find what they share. It runs only when you start a comparison, and it’s designed so your raw profile stays private: it’s encrypted on your device, and our servers hold it only as ciphertext. The one exception is the moment the report is generated — described below — when both profiles are briefly decrypted in memory and never written to disk in readable form.

What you share: a curated profile you can review and edit first — a first name you choose (not pulled from your account), and summaries of your struggles, goals, the people in your life, and coping strategies. A running summary, free-text, and medications are off by default. Crisis content is always removed.
How it’s protected: the profile is encrypted on your device with a one-time key (AES-GCM). That key travels only inside the QR code or link you share with the other person — it is never sent to our server on its own. The backend stores only the encrypted blobs.
How the report is made: when both people have uploaded, the function briefly decrypts both profiles in memory to generate a comparison with Google’s Gemini model, then writes back a separate, re-encrypted report for each person. The raw profiles are deleted at that point.
What you receive: only your own report. Neither person ever receives the other’s raw profile. A summary of what the other person is “working through” is included only if they opted to share it.
“Unfiltered” mode: an explicit, high-friction choice both people must make for a deeper, more candid read. Choosing it is the consent to a more revealing portrait; crisis content is still removed.
Lifespan: the encrypted session is automatically deleted on a short timer — minutes for an in-person comparison, and no more than a day for a link-based invite. The saved report lives on your device afterward.
Try a demo: you can preview the experience against a built-in fictional partner; only your own profile is used and nothing is persisted.

9. Contacts

If you choose to link a person in your memory to one of your system contacts (to show their photo or name), the app uses Apple’s contact picker. The linking happens on your device: it stores a contact identifier and the name captured at link time, alongside that person in your memory. No contact data is ever uploaded to us, to the AI, or anywhere else — it’s used only to display the linked person on your own screens. You can decline linking, and the prompt won’t keep asking.

10. Push notifications

Push notifications are off unless you opt in. They serve two purposes. If you send a friend a Common Ground link invite and they finish later, you get a “your common ground is ready” notification so you can come back and reveal it. And when a friend on middle place shares something new from their day, you get a notification saying so. If you enable this, a push token for your device is registered with our backend, filed under your account identifier (over attested infrastructure). The Common Ground notification carries no profile content, just a generic prompt. A friend’s notification travels through Apple’s and Google’s push services saying only “A friend shared their day”, with their day still locked; your phone unlocks it with the key only the two of you hold and shows their name and the titles of what they shared. We can’t read it, and neither can Apple or Google. The evening round-up of friends’ days is scheduled by your phone itself and never goes through our backend. You can turn these off in the app or in iOS Settings at any time.

11. Bring-your-own-key mode

If you prefer not to use our backend, you can provide your own API keys (Anthropic for chat, and Google Gemini for document import, Life Report, and Common Ground) in Settings. When you do:

Your keys are stored only in your device’s Keychain, on that device, and are never sent to us;
Requests go directly from your device to the provider (Anthropic or Google), bypassing our backend entirely.

In this mode, your relationship for those requests is directly with the provider, under their terms and privacy policy.

12. Third-party services

We rely on a small number of providers to deliver these features. We do not sell data to anyone, and these providers receive only what is necessary for the function described.

Provider	What it does	What it receives
Anthropic (Claude)	Generates the AI replies in your chat.	Your message and the memory context for that turn.
Google — Gemini	Composes your Life Report and Common Ground report, helps organize your journal into your timeline and summaries, organizes content during document import, and turns voice entries and spoken messages into text on the built-in AI service.	The consent-gated snapshot (Life Report); the two profiles, decrypted in memory only at generation time (Common Ground); the text you import (document import); journal entries (timeline and summaries); or a voice recording being transcribed (see section 2).
Google — Firebase / Cloud (our backend)	Sign-in (anonymous at first, then linked to Sign in with Apple), app attestation, the relay service, abuse-prevention counters, usage measurement, the encrypted Common Ground relay, push delivery, and sync storage.	The private identifier, name and email Apple shares when you sign in, the request being relayed (not retained), encrypted Common Ground profiles (ciphertext only), rate-limit and usage counters, the log of your AI requests with your email (kinds, times and counts only, see section 13), your synced data (end-to-end encrypted; we can’t read it, only the details listed in section 3), and — if you opt in — a push token.
Apple: Sign in with Apple	Signs you in, and confirms it’s you before your account is deleted.	The sign-in request from the app, which asks for your name and email; when you delete your account, a request to end Sign in with Apple for middle place.
Apple — iCloud	Carries your sync key between your devices (iCloud Keychain) and stores encrypted backups (iCloud Drive). Until the move is complete, also the old iCloud sync.	Your sync key, backups, and any old iCloud sync copy, in your own iCloud account (we have no access).
Apple — App Store	Takes payment for Supporter, renews it and handles cancellations and refunds.	Your purchase, under your Apple account. We never receive your payment details, your Apple account email or your billing address (see section 13).
Apple — Maps	Puts hangouts and journal locations on a map.	Just a place name or map spot (see section 2).

Each provider processes data under its own terms: Anthropic, Google, and Apple. These providers operate from, and may process data in, the United States.

13. What we measure, and what we do not collect

To know whether the app is any use to anyone, we count how often each feature runs and whether people come back. This is measured by us, on our own backend — there is no third-party analytics service involved and nothing is shared with anyone.

What is counted:

Daily totals. A running total, for each day, of how many chats, journal entries, Life Reports, Common Grounds, document imports, voice transcriptions, journal photos, places, snippets, people, struggles, coping-strategy entries, backups and exports happened across everyone using the app. Alongside those we keep operational totals for the same day: how much AI capacity was used, how many words-worth of text each feature sent to and received from the AI and what that cost us to run, how many requests failed or hit a daily limit, which model answered, how often a reply ran out of room, and how far people get through the Common Ground flow. These are totals only — no identifier of any kind is attached to any of them, so they cannot be traced back to a person.
Roughly what time of day the app is used. Counted across everyone, in six four-hour bands of your local day — “morning”, “evening”, and so on. It is deliberately that coarse: a precise hour, compared against our own clock, would reveal roughly what part of the world you are in, and we don’t want that. No identifier is attached, and it is never recorded against your account row.
Two rows for return rate. One against your account identifier, which follows your Apple ID, so it carries on if you reinstall the app or sign in on another device. And one against a random value your devices share through your iCloud Keychain, so that your iPhone and iPad — and a phone you replace next year — count as one person rather than three. Each row holds the same four things and nothing else: the first day it was seen, the most recent day, how many separate days that has been, and which return-rate milestones have already been counted. Nothing finer than a calendar day, and no record on either row of which features you personally used. The shared value is used for this and for keeping one daily usage allowance across your devices; it is never your account identifier, and nothing carrying your content is filed under it.
A log of your AI requests. Filed under your account identifier, with the email Sign in with Apple shares, so we can see how much each account uses the AI and keep cost and abuse in check. It holds each AI request your account makes: its kind (a chat reply, a Life Report, a voice transcription, a Common Ground, and so on), the time it ran, how much text went to and from the AI, and what that cost us to run, plus daily totals of the same. It never holds what you wrote, what the AI said, or anything taken from either. It is deleted when you delete your account.
Supporter. Supporter is an optional subscription that pays for the app’s running costs, mostly the AI and the sync. Apple takes the payment; the app hands our backend the receipt Apple signs for it, and Apple tells our backend when it renews, lapses or is refunded. From that we keep, under your account identifier, the date and time your subscription runs until and a one-way hash of Apple’s number for the purchase. Filed under that hash we keep your account identifier, the same date, which plan it is (monthly or yearly), whether it was a test purchase, and when Apple signed the latest receipt. That’s all: no price, no payment details, no Apple account email. It is used only to give your account the supporter allowance, and it is deleted when you delete your account.

Some of the app never sends our backend anything it can read (journal attachments, adding a person or a struggle, exports). For those, the app keeps small counts on your device and sends the totals — just the numbers, a few times a day at most.

What we do not collect:

No phone number, and no name or email beyond the ones Sign in with Apple shares, which are kept with your account, and your email also with your AI request log (section 5).
No advertising identifiers (IDFA) and no ad networks.
No third-party analytics, telemetry, crash-reporting, or behavioral-tracking SDKs.
No content of anything you write — the measurement above records that a feature ran, never what you put into it.
No per-person record of which features you use beyond the AI request log above, and no location, device fingerprint, or IP address kept alongside any of it.
No selling or sharing of your data for advertising or any other purpose.
No access, by us, to the content you sync or back up. We hold synced data only in encrypted form with no key to open it; what we can see is limited to the sizes, timing, and other details listed in section 3.
No uploading of your contacts.

14. Crisis-resource detection

To help keep you safe, the app checks your messages on your device for signs of self-harm or crisis. This check happens entirely on the device — nothing is sent to our servers to perform it. When it triggers, the app shows crisis resources (such as 988, Crisis Text Line, and 911). This is a safety feature, not monitoring: we do not receive a report when it triggers. Crisis-flagged content is also stripped from anything used for Life Report or Common Ground.

15. Retention & deletion

On-device data: kept until you delete it. You can delete individual items, export your data, remove the app, or delete your account (below).
Synced data: kept on our servers, encrypted, for as long as sync is on. When you delete something, a small marker with no content stays behind so your other devices delete it too. Turning sync off deletes the whole synced copy; our own disaster-recovery copies of the database can still hold the encrypted data for a limited time before they expire. We record, as calendar days, when each vault was created, last opened, and last changed, so we can later set a rule for vaults nobody has used in a long time. Nothing is deleted on that basis today, and we’ll update this policy before anything is.
Your account: kept until you delete it, in the app under You → Privacy and sync. The app first offers to export your journals. Deleting then ends Sign in with Apple for middle place, deletes your account along with the name and email kept with it, deletes your synced copy from our servers, and erases the app’s data on the device you delete from, including unsaved drafts and any API keys you entered there. iCloud sync turns off on that device, but your iCloud sync copy and your iCloud Drive backups aren’t deleted: they stay in your iCloud account and on your other devices until you remove them. The records our backend files under your account identifier are deleted automatically when the account is: your push token, your return-rate row, your AI request log, your rate-limit counters, your Supporter record, and any friend codes you created. Deleting your account doesn’t cancel a Supporter subscription, because Apple bills it: cancel it in Settings → your name → Subscriptions. A friend code you used stays marked as used, without your account identifier, so your friend’s phone can still finish adding you. A Common Ground comparison that hadn’t finished is deleted; a finished one loses your report and keeps the other person’s until it expires. The daily totals carry no identifier, so they stay. You can sign in again later, which starts a new account.
Old iCloud sync copy: stays in your iCloud account until you remove it; we never delete it automatically.
Backups: only the most recent snapshots are kept; older ones are pruned automatically. You can delete them from your iCloud Drive.
Common Ground sessions: the encrypted relay is auto-deleted on a short timer (minutes in person, no more than a day for a link invite).
Backend rate-limit counters: per-day counters that reset daily and hold no content. Some are filed under your account identifier and are deleted with your account; the rest are filed under codes that change every day and expire within 48 hours.
Usage measurement: the daily totals and the two return-rate rows described in section 13 are kept indefinitely — a return-rate figure only means something with history behind it. They hold no content, and each of those rows holds nothing beyond two dates and two small numbers. Deleting your account deletes the row filed under it; the row keyed to the value your devices share isn’t tied to your account, so it stays unless you ask us to remove it. The AI request log is kept until you delete your account, and is deleted with it.
Supporter: the record described in section 13 is kept while your account exists and is deleted with it. Apple keeps its own record of the purchase under its own policy.
Push token: removed when you disable notifications or delete your account; invalid tokens are pruned automatically.
Provider processing: content sent to AI providers for a reply, a report, or a voice transcription is handled per their retention practices; our backend retains none of it.

16. Your rights

The app keeps an account for you but no profile about you beyond the counts below, and most of your data is directly in your control on your device: you can view, edit, export, and delete it yourself at any time. You can also delete your account yourself, in the app under You → Privacy and sync; section 15 says what that removes. Depending on where you live, you may have additional rights (such as access, correction, deletion, or objection) under laws like the GDPR or CCPA. Your account holds your name and email. Filed with it is the AI request log described in section 13: each AI request’s kind and time, with your email and no content. The pair of return-rate rows in the same section carry no name or email. Both rows carry on if you reinstall the app: one is filed under your account, and the other is keyed to a random value shared between your own devices. You can contact us with any request — including to have both rows deleted — and we’ll help where we can. Your synced data is deleted by turning sync off or deleting your account; we couldn’t pick it out for you, because nothing ties it to your name.

17. Children

middle place is intended for adults, is not directed to children, and requires you to be 18 or older. We do not knowingly collect information from children. If you believe a child has used the app in a way that requires our attention, please contact us.

When you first open the app it asks you to confirm you are 18 or over. On iOS 26 and macOS 26 it will also offer to check the age range already on your Apple Account, so you do not have to answer a question you have answered before — sharing that is your choice, and declining simply returns you to the question. Either way the app is told only which side of 18 you fall on: never your age, never your date of birth. Your answer is stored on your device and is never sent to us.

18. Security

Data on your device is protected by the operating system’s app sandbox and, where you enable it, an additional Face ID / passcode lock. API keys, the backup encryption key, and the sync key are kept in the Keychain. Synced data is encrypted on your device before upload, backups are encrypted at rest, and Common Ground profiles — used only when you start a comparison — are encrypted on your device and stored by our servers only as ciphertext, decrypted for a brief moment in memory to generate the report and then deleted, never written to disk in readable form. Connections to our backend and to AI providers use encrypted transport (HTTPS), and requests to our backend are gated by app attestation. No system is perfectly secure, but we aim to minimize what is collected so there is little to expose.

19. Changes to this policy

If we make material changes, we’ll update the date at the top of this page and, where appropriate, note the change in the app. Continued use after an update means you accept the revised policy.

20. Contact

Questions about privacy? Email support@middleplace.app.