Privacy

Last updated: 31 August 2026

The short version

Earned is built to know as little as possible. The parts that decide what you owe run on your phone. The server holds only what has to be shared with another person: who you are, who you asked to hold you accountable, and the terms of a commitment you cannot be trusted to enforce against yourself.

What the server holds

• Your account. An opaque identifier from Sign in with Apple, and a display name — a first name is enough. Not your email address.
• Your accountability partners' contact details, encrypted, plus a keyed one-way index used to recognise a contact without being able to read it. A contact reaches the server once, at nomination, and is never returned to any app.
• The terms of a hardened commitment — its title, deadline, how many approvals would release you, and when it locked in. These live on the server precisely because you must not be able to edit them later.
• Override requests, and a snapshot frozen at the moment you asked: your progress figure, a 30-day reliability count, and an optional reason you wrote.
• An audit log of requests and votes, holding hashed network addresses under a rotating salt — no message contents, no readable addresses.

What the server never holds

• Which apps you block. Apple hands Earned opaque tokens; Earned itself cannot read which apps they are, and cannot tell anyone.
• Your health data. Beyond the single progress figure for a commitment you have chosen to ask about, nothing from HealthKit leaves your phone.
• Your location, your device details, your other commitments, or anything about what you did on your phone.
• Your history of completions and failures. That lives in a file on your phone and is not uploaded.

If someone named you as their partner

You are not an Earned user, and Earned treats you accordingly.

• You are asked once. There is at most one reminder, and never sooner than three days later.
• Saying no is final and global. It stops every future request to you, from every Earned user — not just the person who asked. The record kept to enforce that is a one-way index of your contact detail and nothing else: it cannot be reversed into your number or address, and it is not linked to who asked.
• If you approve or decline a request, you see only what is on that page: a first name, what they committed to, a deadline, a progress figure, and any reason they wrote. You never see their other commitments, their contact details, or who else was asked.
• Other partners never learn that you were asked, how you voted, or that you exist.

How long things are kept

• The snapshot a partner saw is deleted 30 days after the request resolves, and the link stops showing anything at the same moment.
• Records of how each partner answered are reduced to a status on the same schedule.
• A partner's contact details are deleted when they are removed, or when the account is deleted.
• A global opt-out is kept indefinitely, because forgetting it would mean contacting someone who has already refused.

Account deletion is the open question flagged at the top of this page. The intended separation is that deleting your personal data is a privacy right and is not conditional on your commitments; what happens to a live commitment when you leave is a separate, product question. Both need review before launch.

Who else sees any of this

Earned uses Supabase to host its database and server code, and a messaging provider to deliver invitations and approval links. No data is sold, and none is used for advertising or shared with anyone else.

Contact

A contact address will be published here before Earned is offered outside development.