Privacy, plainly.

The short version

Everything stays on your phone. I do not run servers, so there is nothing for me to see. There is no account to create, no analytics, no tracking, no ads, and nobody I pass your data along to. The only things that ever leave your device are the two you switch on yourself: an iCloud backup into your own Apple account, and questions to the AI advisor, sent with your own Anthropic key and with your contacts’ names stripped out first.

Where your data lives

Your contacts, notes, interactions, promises and goals live in one SQLite database file inside Rootkeep’s own storage on your device. The app works offline. It needs no network connection to do anything at all except back up and ask the advisor.

I hold no copy. There is no mirror, no shadow database, no anonymised aggregate kept somewhere for later. That cuts both ways and I would rather say it out loud: if you lose your phone and never turned backup on, the data is gone. That is the honest price of a design with nowhere to send anything.

No account, no analytics

There is no sign-up, no email address, no password, no profile. Rootkeep ships without an analytics SDK, without crash reporting, without an advertising identifier, and without any third-party tracker. Nothing counts your taps and nothing reports how often you open the app, because nothing is listening.

iCloud backup

Backup is optional and off by default. Turn it on and Rootkeep writes a copy of your database into your own private iCloud container, under your Apple ID. It travels from your device to Apple and it lives under Apple’s terms, not mine.

I cannot read it, list it, or restore it. Turn the setting off and the copy stops being updated. Remove Rootkeep’s data from your Apple ID storage settings and the copy is gone.

The AI advisor

The advisor is optional and stays off until you set it up. It runs on your own Anthropic API key, which you create in your Anthropic account and paste into Rootkeep. The key is stored on your device. Requests go straight from your phone to Anthropic. They do not pass through me. I never see the key, the questions, or the answers.

Before anything leaves the device, the text is rewritten:

• Names become codes. Every one of your contacts is swapped for a code before the request is built. The advisor reasons about the architect you have not spoken to in eleven days, never about Jake Morrison. When the reply comes back, the codes are turned back into real names on your phone, for your eyes only.
• Emails and phone numbers are redacted outright. They are removed from the text before it is sent. The advisor cannot read them, repeat them, or write them, because it never receives them at all. Your phone already knows how to place the call.
• Ambiguity is left alone on purpose. If a bare first name matches two of your contacts, Rootkeep leaves the word as you wrote it instead of guessing the wrong person. That is a small, deliberate exposure of a first name, traded for an answer that is actually about the right person.

What does travel is the substance of what you wrote: what happened, what you promised, what someone is working through. If a note holds something you would not want a third party to process, leave the advisor out of it or edit the note first. Anthropic’s handling of those requests is covered by their own terms and privacy policy, since the account is yours.

Notifications

Follow-up reminders and birthday nudges are local notifications. Your phone schedules them and your phone fires them. Nothing is sent to a push service, and there is no push service to send it to.

Importing from your contacts

If you import people from your phone’s address book, Rootkeep asks your permission first, and everything it reads goes straight into the local database. The whole import happens on the device. Your address book is not uploaded, indexed, or matched against anything. You can decline the permission and add people by hand instead, and the app will be exactly as useful.

Deleting everything

Settings has a Delete All Data button. It clears the local database: contacts, interactions, promises, goals, all of it. Deleting the app removes the local data too. If you had iCloud backup switched on, remove Rootkeep’s data from your Apple ID storage settings as well, since that copy sits in your account rather than in the app.

Changes to this policy

If what Rootkeep does with your data ever changes, this page changes first and the effective date at the top changes with it. I am not going to quietly widen it. And if a change ever meant something new leaving your device, it would arrive switched off, the way backup and the advisor did.