Unbeatable Heart is a breakup recovery app for iPhone. It is made and published by Banuel Dogayman ("we", "us", "our"). This policy explains what the app stores, where it stores it, and what, if anything, ever leaves your phone.
The short version: everything you write is kept on your phone and is never sent to us. There is no server and no account. We cannot read your journal, your unsent messages or your red flags, because they never reach us.
The app does count which screens get opened, anonymously, so we can tell which parts are working. That counting never includes anything you write, never includes how you said you feel, and never includes anything at all from the SOS flow. It has a switch in Settings under Application, and section 2a explains exactly what is counted.
1. What the app stores, and where
Everything in this section is kept in a private database on your device. The app never sends it to us or to anyone else, and we have no technical means of reaching it. The one copy that can leave your phone is a device backup you make yourself, which section 4 explains.
- Journal entries. A title, if you give one, your words, and the date and time you wrote and last edited them.
- Unsent messages. The messages you write in the unsent thread, with the date and time. They are never delivered to anyone.
- Red flags. The prompt you chose and the sentence you wrote under it.
- Check-ins. For each day you answer, where the day sat on a five step scale from awful to great, and what you said was behind it.
- No contact runs. The start and end dates of each stretch without contact. The day counter, the circles and every achievement are calculated from these dates each time you open the app. Achievements are not stored separately.
- Onboarding answers. The name you would like to be called, the day you last had contact, whether you chose to count the days since then, and the pronoun you chose for your ex. Also your answers about how long you were together, how it ended, whether you have reached out since, how often you go looking, what you hope to find when you do, how you feel afterwards, what is hardest right now, what you tell yourself, what you want back, how far you want to get, and how sure you are about it. Apart from your name and the date, each answer is a choice from a fixed list rather than something you type.
- Settings. Which reminders are on and the times you chose for them, whether anonymous usage counts are switched off, the last milestone the app celebrated, and when it asked you to rate it, so that it does not ask again.
What the app deliberately does not store. The SOS flow, reached from "I need help right now", writes nothing. Not which option you chose, not your answer to "What are you hoping to find?", not whether you looked anyway, and not how many times you opened it. The only things an SOS session can ever save are an unsent message or a journal entry you deliberately wrote. Onboarding asks what you hope to find once, and that one answer is kept with the others listed above; nothing you choose inside SOS is.
2. What we do not collect
- No account. The app does not ask for an email address, phone number or password, and there is nothing to sign in to.
- Nothing you write. Not a journal entry, not an unsent message, not a red flag, not a title, not one line of any of it. This is the promise the whole app is built around and section 2a is where we spell out what the one thing we do count actually is.
- No advertising, no attribution and no crash reporting. The app contains no advertising software, no install-attribution software and no crash reporting software from us or from anyone else.
- No tracking. The app does not track you across other apps or websites and does not use the advertising identifier. We do not share anything with data brokers or advertising networks. That is why the app never shows the App Tracking Transparency prompt: there is no cross-app tracking to ask you about.
- No sale or sharing of personal information. We do not sell personal information and do not share it for advertising.
- No device permissions beyond notifications. The app does not request access to your location, contacts, photos, camera, microphone, calendar or health data.
2a. Anonymous usage counts
This is the one thing the app sends about how you use it, and it is off if you want it off.
If your phone is set to the United Kingdom, Ireland or anywhere else in the European Economic Area or Switzerland, by its region or its time zone, nothing is counted and nothing is stored for counting until you say yes. The app asks you once, near the end of setting it up, with "Share anonymous usage" and "Don't share" given equal weight and neither chosen for you. Everywhere else, counting is on from the moment you open the app, and you can turn it off.
What is counted. Which screens get opened, and which buttons get tapped. For example: that the journal was opened, that an entry was saved, that a red flag was written, that a check-in was completed, that the paywall was seen, that a reminder was switched on, that a reminder you tapped opened the app. It is a fixed list written into the app, and nothing can be added to it without a new version of the app.
What is never counted.
- Anything you write. Not the text, not a title, not a first line, not a word count, not a length. The list of things the app can count has no place to put text, so there is no way for your words to be included by accident.
- How you feel. A check-in is counted. The answer you gave is not, and neither is what you said was behind it.
- Anything in SOS. Not that you opened it, not which option you chose, not what you were hoping to find, not whether you looked anyway, not how often you have needed it. The SOS flow was already the one part of the app that writes nothing down, and it is also the one part that counts nothing.
- Your name, or any of your onboarding answers. These are answers about your life and the app never sends them to us.
Who receives it, and where. A product analytics service called PostHog, which acts on our behalf. Our PostHog project is hosted in the European Union, in Frankfurt, and the counts are not sent to the United States. PostHog's privacy policy is at https://posthog.com/privacy.
There is no account or name attached. The app generates a random identifier on your phone, which is not your name, your email address or your Apple ID, and which we cannot connect to you or to your subscription. Your network address is not recorded and no location is worked out from it. Alongside each count the app sends the app version, the operating system and its version, and nothing else about your phone: not the model, not its name, not your language, not your time zone.
Turning it off. Settings, then Application, then Share anonymous usage. Turning it off stops the counting from the moment you tap, and the app works exactly the same either way. Nothing in the app is locked behind leaving it on. Turning it back on counts as saying yes.
Our legal basis. In the United Kingdom, Ireland, the European Economic Area and Switzerland, your consent, which you can withdraw at any time with the same switch. Elsewhere, our legitimate interest in understanding which parts of the app work, balanced against the fact that the counts are anonymous, hold nothing you wrote, and can be switched off at any time.
Asking us to delete them. Because the counts carry a random identifier and nothing else, we usually cannot tell which are yours. If you want them deleted, email us and we will explain how to read that identifier out of the app so we can find and remove them.
2b. Checking for app updates
When you open the app, it asks Expo, the service we publish the app through, whether a newer version of its screens and text is available. If one is, it downloads in the background and is used the next time you open the app. This is how we fix a mistake without making you install a new version from the App Store.
What the check sends. A random identifier generated on your phone, which is not your name, your email address or your Apple ID, and which we cannot connect to you or to your subscription. It is a different identifier from the one in section 2a. Alongside it the check sends that it is an iPhone, which build of the app you have, and which update it is currently running. If an update we published failed to start on your phone, the next check also sends the error message, so that the broken update can be withdrawn. Your network address reaches Expo, as it does with any connection to the internet.
What it never sends. Anything you write, how you feel, anything from SOS, your name or any of your onboarding answers. The check happens whether or not anonymous usage counts are on, because without it a fix cannot reach you.
Expo is based in the United States. Its privacy policy is at https://expo.dev/privacy.
3. Notifications
The app can send you up to three reminders: a daily quote, a daily check-in at a time you choose, and one note before a free trial ends. These are scheduled on your phone by the app itself. There is no push notification server and no device token is sent anywhere.
A notification never contains anything you have written. It shows a general line only, so nothing personal appears on your lock screen.
Notifications are optional. You can decline the permission when the app asks, turn each reminder off in the app's Settings, or turn notifications off for the app in your phone's Settings at any time.
4. Device backups
If you use iCloud Backup, or a local backup through your computer, the app's database is included in that backup along with your other app data. This is what restores your journal when you move to a new phone.
That backup is yours. It is created, encrypted and stored by Apple under Apple's terms and Apple's privacy policy, and we cannot access it. You can exclude the app from iCloud Backup or turn backups off in your phone's Settings.
5. Subscriptions and payments
Unbeatable Heart is offered as an auto-renewable subscription with a free trial. Purchases are made through Apple's App Store and processed by Apple. We never receive your card number, billing address or Apple ID password. Apple's handling of your payment is governed by Apple's privacy policy.
To confirm that your subscription is active, to restore a purchase on a new phone, and to honour the free trial, the app uses a subscription service called RevenueCat, which acts on our behalf. The following is processed for that purpose:
- A random identifier generated on your device. It is not your name, your email address or your Apple ID, and we cannot connect it to you.
- Your App Store purchase receipt, the product you bought, the price tier and currency, and the trial, purchase, renewal and expiry dates.
- The country of your App Store account, the platform and version of the app, and the network address your phone connected from at the time of the request.
If you redeem an offer code, the code and the offer it unlocked are part of that purchase record held by Apple and RevenueCat, and the app itself never sees the code, because you enter it in Apple's own window rather than in the app.
We use this only to run the subscription, to handle refunds and support requests, and to keep the accounting records the law requires. None of it is linked to anything you write in the app, which the app never sends to us in the first place.
RevenueCat is based in the United States. Its privacy policy is at https://www.revenuecat.com/privacy. Where data about a person in the United Kingdom or the European Economic Area is transferred to the United States, it is protected by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, as applicable.
Apple also provides us with sales and subscription reports through App Store Connect. These are aggregated and do not identify individual customers.
6. Links that leave the app
Three things hand you to another app. "Manage subscription" opens your account settings in the App Store, because cancelling a subscription is Apple's screen and not ours. The Community row opens our Facebook group. A crisis line in the SOS flow hands its number to your phone to call, and the app does not know whether you called or what was said. From the moment you arrive you are using Apple's or Meta's service under their privacy policies rather than this one. The app makes no request of its own, sees no response, and learns nothing about what you did after you left.
7. Beta testing and Apple diagnostics
If you install the app through TestFlight, Apple may share crash logs with us and, if you choose to send it, your feedback, including any screenshot you attach. This is governed by Apple's TestFlight terms. You choose whether to send feedback, and you can turn off crash log sharing in your phone's Settings under Privacy & Security, then Analytics & Improvements.
Separately, if you have chosen "Share With App Developers" in your phone's analytics settings, Apple may provide us with aggregated, anonymised usage and crash statistics. We do not add any code to collect this ourselves.
8. Deleting your data
- Anything you wrote. Hold a journal entry, an unsent message or a red flag to delete it. When you do, the words are erased from the database in the same step. What remains is an identifier and a timestamp that hold nothing you wrote.
- Everything at once. Deleting the app from your phone deletes its database with it. A copy may remain in an iCloud or computer backup you made earlier, which you control and can delete through Apple.
- Usage counts. Turn them off in Settings, under Application. To have the ones already sent deleted, email us at banueldogayman@gmail.com and we will explain how to read the random identifier out of the app so we can find them.
- Purchase records. Records held by Apple are kept under Apple's policies. To ask us to delete the subscription records that RevenueCat holds on our behalf, email us at banueldogayman@gmail.com. Because those records are keyed to a random identifier rather than to your name, we may ask you to send that identifier or your App Store receipt so we can find them. We keep records that tax or accounting law requires us to keep for as long as that law requires.
9. How long data is kept
Data on your phone is kept for as long as you keep it, and it goes when you delete it or delete the app. The anonymous usage counts in section 2a are kept for no longer than 12 months and are then deleted. Subscription records are kept for as long as your subscription can be restored and for the period the law requires for financial records, and are then deleted.
10. Your rights
Because the app is designed so that we hold nothing about you beyond the subscription records in section 5 and the anonymous counts in section 2a, most of your rights are ones you exercise directly on your phone: you can read, change and delete everything the app stores about you without asking us, and you can switch the counting off in Settings.
If you are in the United Kingdom, the European Economic Area or Ireland, you have the right to ask us for access to, correction, deletion, restriction or portability of the subscription records we hold and the usage counts described in section 2a, to object to our processing of them, and to complain to your supervisory authority. You can object to the usage counts without emailing anyone, by turning them off in Settings. In the United Kingdom that is the Information Commissioner's Office at https://ico.org.uk. In Ireland it is the Data Protection Commission at https://www.dataprotection.ie. Our legal basis for processing subscription records is that it is necessary to perform our contract with you, and, for fraud prevention and accounting, our legitimate interests and our legal obligations.
If you are in California, you have the right to know what personal information we hold, to ask for it to be deleted, and to not be discriminated against for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising.
Wherever you live, you can exercise any of these rights by emailing banueldogayman@gmail.com. We will reply within 30 days.
11. Children
Unbeatable Heart is for adults only. You must be at least 18 years old to use it. It is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has used the app and that we have received their information through a subscription record, email us and we will delete it.
12. Security
Your data lives inside the app's private storage on your phone, which iOS protects with the device's built-in encryption when your phone is locked. We recommend a passcode, Face ID or Touch ID on your phone.
We want to be plain about one limit: the app does not yet have its own lock screen. Anyone who can unlock your phone can open the app and read what is in it. If that matters to you, keep your phone locked and do not share your passcode.
13. Changes to this policy
If we change how the app handles your data, we will update this policy, change the date at the top, and, for any change that matters, tell you in the app before it takes effect. Older versions are available on request.
14. Contact
Banuel Dogayman Harav Goren, Israel banueldogayman@gmail.com