01Who we are, and what this covers
BlueprintOS is an iPhone app made by one developer. “We”, “us” and “our” means the developer of BlueprintOS, based in British Columbia, Canada. This policy explains what the app does with your information, what leaves your phone and when, and the choices you have. It covers the BlueprintOS app, the BlueprintOS Pro subscription and this website.
It is written to be read in five minutes. If anything is unclear, email privacy@blueprintos.io and a person will answer.
02The short version
Your data lives on your iPhone. There are no accounts, so there is nothing to sign up for and nothing of yours stored on our side. We run no analytics, show no ads and never sell data. When you use a Pro feature, the information that request needs goes through our relay server to an AI provider and the answer comes back; the relay does not keep what you sent. That is the whole model.
03What the app keeps on your iPhone
Everything you type, tap or log is stored in the app’s own database on your device. Nothing in this table is sent to us.
| What | Where it comes from | What it is for |
|---|---|---|
| Your profileName or initial, archetypes, body numbers (weight, goal weight, height), allergies and dietary restrictions, health conditions and notes you choose to enter, fitness baseline, sleep and wake times, energy curve, work pattern and fixed commitments, nutrition preferences, financial snapshot, priorities and goals, coaching tone | Onboarding, and edits on the Profile tab | Writing realistic plans, menus and workouts around you |
| Your daysMissions, timers, completions, skips, lateness and recovery choices | Mission Control and the Day screen | Running the day, and the weekly review |
| LogsWorkouts and sets, weigh-ins, meals eaten, trackers you create (net worth, savings, steps, anything) | What you log in the app, or allow from Apple Health | Progress, recovery and the charts on your profile |
| ReviewsYour weekly review answers, dictated text, the course for the week | The weekly review | Next week’s plan |
| Postcode or ZIPOptional | Typed by you | Your local currency, and local prices when you ask for them |
| SettingsUnits, appearance, notification choices, an anonymous purchase ID | The app | Running the app and checking Pro |
Backups. Once a week the app writes a backup file into its own folder in the Files app (Files › On My iPhone › BlueprintOS), keeping the last six. You can also export or restore a backup yourself from Settings › Backup. These files stay on your device unless you move them. If iCloud Backup is on for your iPhone, the app’s data is included in that device backup, which Apple holds under its own terms, not us.
04What leaves your phone, and when
Only Pro features send anything anywhere, and each one sends only what that request needs. The app never uploads your database, never syncs in the background, and never sends anything while you are not using a Pro feature.
| Pro feature | What the request can include |
|---|---|
| Write my baseline | Your onboarding answers: body numbers, sleep and work times, goals, preferences, health notes and anything you wrote |
| Plan my day | Your profile, today’s fixed commitments (including imported calendar titles and times), your energy curve, recent completions and skips |
| Find my next move | The gap in your day, your priorities, the places you saved |
| Craft my menu | Nutrition preferences, allergies and restrictions, calorie targets, your kitchen and budget notes |
| Price my list | The grocery list and your postcode or ZIP, so prices are local |
| Tailor my workout | Fitness baseline, recent workouts and logged sets, recovery state, gear you have |
| Weekly review | Your answers and the text of what you dictated, with the week’s missed and completed missions, a weekly summary from Apple Health if connected, and your net worth totals, budget totals and tracker values |
| Your goal plan and week plan | Your onboarding answers, goals and life rating, the week’s planned blocks, calendar event titles and times if connected, a weekly summary from Apple Health if connected, and your net worth totals, budget totals and tracker values |
| Local resources | Your postcode or ZIP and the kind of place you are looking for |
Health numbers the app plans with — weight, hours slept, steps — can be part of a planning request as shown above. Nothing from Health is ever sent for any other purpose.
Requests are rebuilt on our relay from a fixed allow-list before they go anywhere, so a request cannot carry more than the feature is designed to send.
05Our relay server
Pro requests go to a small server we run (the “relay”), which checks that the phone has an active Pro subscription, takes one use from that feature’s fair-use allowance, and forwards the request to the AI provider with our credentials. It exists so that no API key ever has to be on your phone.
- What it keeps
- An anonymous purchase ID (a random identifier generated when you first open the app, not your name, email or Apple ID), a cached yes/no on whether that ID has Pro, and counters of how many requests each feature has made today and this month.
- For how long
- The Pro check is cached for 10 minutes. Daily counters expire within 2 days, monthly counters within 32 days. Nothing else is written.
- What it never keeps
- The content of your requests or the answers. The relay forwards and returns; it does not log request bodies or responses.
- Where it runs
- On infrastructure provided by Railway, with a Redis store for the counters above. See service providers.
06Service providers
We use four companies to make the app work. None of them receives your name or email from us, because we never have them. None is allowed to use your data for anything but providing their service to us.
| Provider | What they do | What they receive | Their terms |
|---|---|---|---|
| Anthropic | Runs the AI model that writes plans, menus, workouts, reviews and prices | The content of each Pro request, as described above | Processed under Anthropic’s commercial terms, which do not allow it to train its models on that content. Privacy policy. |
| Apple | Sells and bills the subscription; provides the App Store, Health, Calendar, notifications and speech recognition | Your purchase, under your Apple Account. We never see payment details. Health and Calendar data stay on the device under Apple’s frameworks. | Apple’s privacy policy |
| RevenueCat | Checks that a subscription is valid | The anonymous purchase ID and the App Store receipt data — no name, no email | RevenueCat’s privacy policy |
| Railway | Hosts our relay server and its Redis store | Request traffic in transit, and the counters above | Railway’s privacy policy |
07Permissions the app asks for
Every permission is optional, asked for when a feature first needs it, and can be changed later in iPhone Settings. The app keeps working without any of them.
- Notifications
- All notifications are scheduled on your device by the app. We run no push servers and cannot send you anything from outside. The app asks for Time Sensitive notifications so that calls can cut through Focus modes you have allowed it in.
- Apple Health
- With your permission the app reads sleep, steps, weight, resting heart rate, heart rate variability, active energy, exercise minutes and workouts, including what Apple Watch and other wearables write to Health, to plan your day, set calorie targets, fill in weigh-ins and write your weekly review, and writes the workouts and weigh-ins you log back to Health. Health data is used on your iPhone. A short weekly summary of these numbers is included in week planning and weekly review requests, as described in section 04. We never use Health data for advertising or marketing, never share it with data brokers, and never sell it. Change this any time in the Health app › your picture › Apps › BlueprintOS.
- Calendar
- Read-only, with your permission. The titles and times of events you choose to import become fixed blocks in your day and can be included in a planning request. The app never adds, changes or deletes calendar events.
- Microphone and speech
- You can dictate your weekly review. Audio is transcribed on your iPhone where the device supports it, and otherwise by Apple’s speech recognition service under Apple’s terms. Audio is never stored by the app. Only the text you confirm is sent with your review.
- Location
- Never requested. The app has no location code. If you type a postcode or ZIP, it stays on your device and is sent only with the two features that need it (prices and local resources).
08Purchases and BlueprintOS Pro
BlueprintOS Pro is bought and billed by Apple through your Apple Account. We never see your card or payment details. To know whether Pro is active, the app and our relay check the subscription with RevenueCat using the anonymous purchase ID and the App Store receipt. If you restore purchases on a new phone, the same check runs again.
The relay also keeps the fair-use counters described in section 05, so that Pro features have the allowances shown in the terms.
09How long data is kept, and how to delete it
| Data | Kept | Deleted when |
|---|---|---|
| Everything in the app | On your iPhone, for as long as the app is installed | You tap Settings › Your data › Erase everything on this iPhone, or delete the app |
| Weekly backup files | Files › On My iPhone › BlueprintOS, last six | Deleting the app removes its folder; copies you moved elsewhere are yours to remove |
| Content of Pro requests | Not kept by our relay | — |
| Relay Pro check | 10 minutes | Expires by itself |
| Relay usage counters | Up to 2 days (daily) or 32 days (monthly) | Expire by themselves |
| Subscription record | By Apple and RevenueCat under their policies | Per their policies; the anonymous ID links to no name or email |
| Email you send us | In our mailbox | On request, or when no longer needed to help you |
Because we hold nothing that identifies you, there is no account to close. Erasing from Settings, or deleting the app, removes everything it stored on your iPhone; your backup files are left for you.
10Security
- Everything between the app, our relay and our providers travels over HTTPS (TLS).
- The credentials for the AI provider live only on the relay, never in the app, so they cannot be taken from a phone.
- The relay accepts only requests shaped like the app’s, rebuilds each one from an allow-list, and keeps no copy of the content.
- Data on your iPhone is protected by the device’s own encryption and your passcode, like any other app’s data.
No system is perfectly secure. If you believe you have found a security problem, email security@blueprintos.io and we will respond quickly.
11Your rights and choices
Depending on where you live — including the EU and UK (GDPR), Canada (PIPEDA and British Columbia’s PIPA) and California and other US states — you may have the right to ask what personal data we hold about you, to have it corrected or deleted, to receive a copy of it, to object to or restrict how it is used, and to complain to your data protection authority. We honour those requests for everyone, wherever you are.
In practice, almost everything is already in your hands:
- See your data: it is all in the app. Settings › Backup exports the whole lot as one file you can open.
- Delete it: Settings › Your data › Erase everything on this iPhone (the app tells you first that there is no other copy, and where your backups are), or delete the app.
- Stop a permission: iPhone Settings › Apps › BlueprintOS, or the Health app for Health access.
- Stop AI requests: cancel your subscription. A locked app sends no AI requests.
For anything on our side — the anonymous counters, or an email you sent us — write to privacy@blueprintos.io. We will answer within 30 days, usually much sooner. Because our records are anonymous, we may need a little help from you to find the one you mean.
We do not sell personal data and do not share it for cross-context behavioural advertising, so there is nothing to opt out of under US state privacy laws. We do not use automated decision-making that has legal or similarly significant effects on you; plans are suggestions you accept, edit or skip.
12International transfers
Our providers operate in the United States and other countries. When you use a Pro feature, the content of that request is processed there. Where the law requires safeguards for data leaving your region, such as the EU or UK, we rely on our providers’ standard contractual clauses and equivalent commitments. Data that stays on your iPhone is not transferred by us at all.
13Children
BlueprintOS is not directed at children under 13 (or the higher age your country sets for consent to data processing, such as 16 in parts of the EU), and we do not knowingly collect data from them. If you believe a child has used a Pro feature, email us and we will remove any related relay record.
14Changes to this policy
If we change what the app does with your data, we will update this page, change the date at the top, and say what changed. For a change that matters to you — a new provider, or a new kind of data leaving the phone — we will also tell you inside the app before it applies.
15Contact
The developer of BlueprintOS
British Columbia, Canada
Privacy questions and requests: privacy@blueprintos.io
Security reports: security@blueprintos.io
Everything else: support@blueprintos.io