By default, your data stays on this phone; family mode syncs only through your family’s own iCloud.

Effective date: 10 October 2026
Applies to: ByIntent for iPhone (iOS 17.0 and later) and this website, byintent.app
Operated by: MG CYBER SOLUTIONS LIMITED
Contact: support@byintent.app

1. In one paragraph

ByIntent runs locally on your iPhone. It has no third-party analytics or advertising SDK and no advertising identifier. By default, your rules, your usage events and the apps you picked in the system picker all stay on this one device, and the app sends none of your data to our server. If you use family mode, family data syncs between the parent’s and the child’s phones through the family’s own iCloud, and the developer cannot access it — see section 11.

The app has three optional online features — iCloud sync, the weekly tier upload and the beta study counts. All are off by default, each has its own toggle, and none goes online until you switch it on yourself. What each sends, where, and who can see it is in section 5. Whichever you turn on, app names, usage events and usage durations never leave the device (in family mode, the child phone’s total minutes for the day go to the parent through iCloud — see section 11); the four system extensions contain no networking code.

Two more things can go online, and only through your own actions: a feedback message you choose to send, and an invite — if you arrived through someone’s invitation and then subscribe. Both are in section 6. Subscriptions are bought and billed through Apple (section 10).

Sections 2 to 12 are about that app. This website is a separate matter — it does have a server: the support forum accepts what you submit, and each page view is counted. Both are covered in section 13. They are kept apart from the app’s data; nothing flows between them.

2. What we record

ByIntent records “events” locally, which is how the numbers you see in the app are computed. Each event holds:

Besides events, the device stores: the rule values you set (quota, counts, windows), the guard list and essential-apps allow list you picked in the system picker (as opaque iOS tokens), your palette preference, and the commitment-mode switch and self-declarations.

3. What we never record

• No content inside apps: no chats, posts, videos or search terms — iOS never hands us those.
• No app names. We only ever receive opaque tokens and labels the system renders itself.
• No screenshots, no screen recording, no screen-content analysis.
• No location, contacts, calendar, photos, microphone, health data, keyboard input or browsing history.
• No advertising identifier (IDFA), no profiling, no cross-app tracking.
• No free text in the event log. The session review has three fixed answers (did it / didn’t finish / rather not say). A feedback message you write and send yourself is separate — see section 6; so are the appeal messages a child writes to a parent in family mode — see section 11.
• No account sign-in or sign-out events — identity actions are kept out of the behavioural event log.

4. Where the data lives

On your iPhone: the app’s own sandbox database, plus an App Group container the system extensions read and write (rules file, state file, event file, palette file). These files are protected by iOS data protection.

• On the device by default. All of the above stays on the device by default. What each of the three optional online features sends once switched on is in section 5; what family mode syncs between family members through iCloud is in section 11; usage events themselves are never uploaded.
• Picked tokens stay on the device. By Apple’s design, the tokens you pick in the system picker are device-bound, and iCloud sync does not carry them either.
• Retention. Events stay on the device until you delete them; this release does not auto-prune them. If a retention cap is introduced later, we will update this policy and explain it in the app.
• Deleting the app removes its sandbox and App Group container, and everything in them.

5. Optional online features (all off by default)

The three features below go online. Each is off by default, has its own toggle, and is never bundled with the others or folded into one blanket consent. With all three off, the app sends nothing to our server or to your iCloud (family mode aside — see section 11), apart from the feedback and invite steps in section 6, which happen only through your own actions. Whichever you turn on, app names, the tokens you picked, usage events and usage durations are never sent.

iCloud sync

• What is sent: one rules record — your rule settings (limits, counts, time windows, day boundary, commitment mode and so on), a random device identifier generated on this device the first time (to tell which device wrote it), and the edit time.
• Where it goes: the CloudKit private database in your own iCloud account, stored by Apple.
• Who can see it: your devices signed in to the same Apple Account. The private database is not readable by us, the developers; we cannot see this record.
• How to turn it off: the “iCloud Sync” toggle in Settings.
• After you turn it off: this device stops reading and writing iCloud, and your rules keep working locally. The record already in iCloud stays (another device may still use it); to delete it, remove ByIntent’s data under iCloud storage management in your iPhone settings.

Weekly tier upload (Ladder)

• What is sent: once a week, just three things: a random token not linked to your identity, the ISO week (e.g. 2026-W38), and your tier for that week (a number from 1–5).
• Where it goes: our server hosted on Vercel (byintent.app/api/ladder), kept in Vercel’s storage service.
• Who can see it: us. Publicly, only the total number of people in each tier is shown. Anyone holding a Ladder page link that includes your token can see that token’s week-by-week tiers — treat the link as something that can reveal your history.
• About the token: it is generated on this device the first time you turn the toggle on and kept in this device’s Keychain (this device only, not synced to iCloud Keychain). It is not linked to your Apple Account, email or any identity. But it stays the same from week to week, so the server can link the weeks of one installation together; and, as iOS behaves, the token may survive deleting the app, so a reinstall may keep using the same token.
• How to turn it off: the “Upload weekly tier” toggle under Settings → Data & deletion.
• After you turn it off: future uploads stop immediately and your on-device data is unaffected; tiers already uploaded are not withdrawn automatically (see “Data on our server” below).

Beta study counts

• What is sent: once a week, with the same token and week as above, six non-negative whole numbers: regular opens, how many of those ended early, first-step taps on the shield, emergency passes, Screen Time permission revocations, and whether you relaxed a rule that week (0 or 1). If only this toggle is on, the tier field is empty.
• Where it goes: the same request and the same server as the tier upload.
• Who can see it: us. The server keeps these six numbers per token and per week, to sum them per week and to compute per-token study measures such as “does it reappear after a one-week gap”. Publicly, only the weekly total across everyone is shown, never one token’s study numbers.
• How to turn it off: the “Join the public beta study” toggle under Settings → Data & deletion, independent of the tier upload.
• After you turn it off: future uploads stop immediately and your on-device data is unaffected; counts already uploaded are not withdrawn automatically.

Data on our server: retention, deletion and IP addresses

• Retention: tiers and study counts have no automatic expiry at present. They are kept until you ask us to delete them or we retire the feature; if we set a retention period, we will update this policy.
• Deletion: the app currently has no button that deletes server data; “Delete all history” only clears on-device events and does not touch tiers or counts on the server. To delete them, write to support@byintent.app with your Ladder page link (it contains the token) and we will delete the records under that token.
• IP addresses: every network request carries your IP address. Our code only uses it briefly in memory as a rate-limit key; it does not store it or use it to identify you. Our host, Vercel, briefly sees it and records it in its request logs, handled under Vercel’s privacy policy. No cookie is set for these features.

6. Feedback and invites

These have no toggle in section 5 because each one goes online only when you do something: send a message, open an invite link, or subscribe after being invited. Like everything else, they never send app names, the tokens you picked, usage events or usage durations.

In-app feedback

• What is sent: only when you tap “Send” on the Feedback screen in Settings: the category you chose (Problem / Idea / Question), your message (its first line doubles as the title), your email address only if you typed one in, and a random identifier generated for this installation, used only to limit how many messages one device can send. No device model, system version, diagnostics or logs are attached. If you later reply to us from the same screen, your reply text goes to the same service.
• Where it goes: our referral and feedback service, RefHub (refhub-mg.vercel.app), hosted on Vercel.
• Who can see it: us, so we can read and answer it. The app keeps a receipt for each message you sent (the thread’s identifier and access key) in this device’s Keychain, this device only, so you can read our replies under “My feedback”.
• Retention and deletion: messages stay on the service so we can follow up. “Delete account” removes the receipts on this device, but messages already sent are not tied to an account and stay on the service; to have them deleted, write to support@byintent.app and tell us roughly when and what you wrote.

Invites and the clipboard

• Invite links: if you open the app through an invite link, the app sends the invite code in that link to the same referral service, which replies with who invited you and any offer; the subscription screen then shows an invite banner. The service returns a one-time invite token, kept in this device’s Keychain (this device only).
• The clipboard, once: the first time you open the app, it may read the clipboard once to look for an invite code. iOS may ask whether to allow pasting; declining changes nothing in how the app works. Only text in the format of an invite code is kept, in this device’s Keychain; anything else on the clipboard is neither stored nor sent. Reading it sends nothing at that moment, and the app does not read the clipboard for this again.
• When an invited user subscribes: if the app is holding an invite token, then the next time it verifies a purchase of yours (normally when you subscribe), the App Store’s signed record of that transaction (JWS) is sent, together with the invite token, to the referral server (/v1/attribution/bind), so the invite can be credited to the person who invited you. This signed record describes the purchase — such as which plan, when, and transaction identifiers — and does not contain your name, email address or card details. It does also carry a purchase account identifier (appAccountToken): if you are signed in with Apple, it is derived one-way from your Apple user identifier and is the same on all your devices; if you are not signed in, it is a random value generated on this device.
• Retention and deletion: once the invite has been credited (or the token has expired or been used), the app deletes the token from this device. “No thanks, skip the offer” only hides the banner; the token stays, so a later purchase can still credit the invite. “Delete account” removes the invite token on this device; invite records already on the referral service are not removed by that — to ask for their deletion, write to support@byintent.app.

Apple’s subscription notifications (all subscribers)

• Who sends it: this is not sent by the app; it is sent by Apple’s servers. In App Store Connect we have set the address for App Store Server Notifications (V2, production and sandbox) to our referral service, so for every subscription transaction (start, renewal, refund, expiry and so on), invited or not, Apple pushes a transaction notification to that service. The ByIntent app itself makes no request for this.
• What is sent: Apple’s signed notification and transaction record, which describe the purchase itself — notification type, transaction and original transaction identifiers, plan, price and currency, purchase and expiry times, App Store storefront, whether it was refunded, and the purchase account identifier (appAccountToken, if the transaction carries one; see the previous subsection for where it comes from). It contains no name, email address or card details.
• Where it goes: the referral service RefHub (refhub-mg.vercel.app), hosted by Vercel.
• Purpose: to reconcile subscription status and, when a subscription belongs to an invite, to credit it to the person who invited you and calculate their invite reward. The referral service also forwards the same notification unchanged to our own revenue-statistics service (also hosted by Vercel) to count subscription revenue; that service likewise has no automatic deletion period, and deletion is likewise by writing to us.
• Retention and deletion: notifications for transactions that belong to no invite are stored too, and we have not set an automatic deletion period for them. To have them deleted, write to support@byintent.app with the transaction identifier or roughly when you subscribed.

7. Screen Time and permissions

ByIntent uses the following system permissions, each requested only when it is needed:

• Screen Time (Family Controls) — required. It is what lets you pick the apps to guard in the system picker, and what lets ByIntent appear when you open them. What we receive is a set of opaque tokens, not a list of apps. We do not detect which apps you have installed.
• Notifications — optional. One reminder each when a plan ends, when a quota is close, and for the weekly digest. Nothing is re-sent, and declining does not affect how rules are enforced.

The system’s Screen Time statistics belong to iOS. ByIntent can embed Apple’s report view inside the Insights screen, but cannot read or store any number in it — that is Apple’s boundary, not our choice.

You can revoke the authorization at any time under Settings → Screen Time. When you do, ByIntent stops claiming to protect you and shows a repair screen instead; recorded data is unaffected.

8. Sign in with Apple

Signing in is entirely optional — every core feature works without an account.

• Signing in only establishes a local identity: the user identifier Apple returns, plus the name and email you chose to share.
• These credentials live in the device Keychain, marked this-device-only, so they are not synced to the iCloud Keychain and never enter the App Group (all four system extensions are unable to read them).
• Signing in sends nothing to our server and changes none of your rules. The one exception: if you are signed in and make a purchase after being invited, the purchase account identifier sent with the transaction record to the referral server is derived from your Apple user identifier (see section 6). Separately, Apple’s servers send a notification for every subscription transaction directly to that service (see “Apple’s subscription notifications” in section 6); that is sent by Apple, not by signing in or by the app.
• “Sign out” clears the signed-in state on this device only; rules, history and the guard list all stay.

9. Export and deletion

• Export. Settings → Data & deletion → Export events writes out the raw events.jsonl file, with exactly the fields listed in section 2. Where it goes is up to you.
• Deletion. “Delete all history” on the same screen clears every event on this phone. It asks for confirmation and cannot be undone. Rules and the guard list are kept.
• Export and deletion are free forever and will never sit behind a paywall.

10. Subscriptions and payment

ByIntent offers an optional auto-renewing subscription, ByIntent Pro, in two plans: monthly and yearly (the family plan is not sold in this version). Eligible Apple Accounts get a one-month free trial. Pro unlocks all 20 color themes and iCloud sync across devices.

• Apple handles payment. Every purchase happens inside the app through Apple’s in-app purchase; payment methods, billing, renewals and refunds are handled by Apple, and we never receive your card details. This website sells nothing and collects no payment information.
• Renewal and cancellation. The subscription renews automatically until you cancel it in your Apple Account’s subscription settings (Settings → your name → Subscriptions). Deleting the app or the in-app account does not cancel it.
• What the app keeps. The app checks Apple’s signed purchase records on this device to decide whether Pro is unlocked. If you arrived through an invite, the signed record of a purchase is also sent to our referral server — see section 6.

Blocking features — the shield, intent gate, basic limits, emergency passes, commitment mode, export and deletion — and Insights stay free.

11. Minors and family mode

ByIntent’s adult self-management features are intended for people aged 18 and over. Minors can use ByIntent only through family mode: a parent sets the rules on their own iPhone and they are enforced on the child’s iPhone. We do not knowingly collect information from minors outside family mode.

How parental consent is obtained. Before a child’s iPhone can take a parent’s rules, it needs Apple’s Screen Time (FamilyControls) “child” authorization: the child must be in the parent’s Family Sharing group, and the parent approves the request with their own Apple ID. Without that step ByIntent can do nothing on the child’s phone. We treat this parental authorization as the guardian’s consent to processing the child’s data, and rely on it whatever the child’s country, region or age.

The developer cannot access family data. Family-mode data syncs only between the family’s own iCloud accounts — the plan in the parent’s iCloud private database, the child’s replies in the child’s iCloud private database, each shared read-only with the other through iCloud sharing. We (the developer) cannot access this data, and it never passes through any server of ours.

Age thresholds. We handle children’s data under the rules below, always on top of the parental authorization above:

• European Union: GDPR Article 8 requires consent from the holder of parental responsibility for children under the age set by each member state (between 13 and 16).
• United States: COPPA requires verifiable parental consent before collecting personal information from children under 13.
• New Zealand: the Privacy Act 2020 sets no fixed age of consent and leaves it to whether the child can understand; ByIntent does not make that call, so minors in New Zealand likewise use family mode only with the parent’s authorization.

What family mode syncs:

• From parent to child: the rules the parent sets (limits, schedules and so on), the number and opaque tokens of guarded apps (not app names), the four locks, the child’s age band (one of four: 6–8, 9–12, 13–15, 16 and over — not a date of birth) and when the parent confirmed it, and the parent’s answers to requests and appeals.
• From child to parent: a summary of the day — the date, total minutes used that day, how many emergency passes were used, how many locks are on, and the last sync time — overwritten daily, with only today kept; the child’s “more time” requests (minutes only); the child’s appeals and proposals (up to 200 characters per message); how many extra apps the parent added on the child’s phone (a count only); a slot number assigned by the parent; and a random child identifier that contains no name or device name.
• Never synced: the parent code is kept only in the child phone’s Keychain (as a slow hash); it is not uploaded and never passes through the parent’s phone.

What the parent can and cannot see. The parent sees the rules they set, the child’s requests and appeals, the daily summary above, and when the child’s phone last synced. The parent cannot see who the child talked to or what about, what they searched for, which web pages they visited, or where they are, nor which apps the time went to or exactly when. The child sees the same explanation on their own phone.

The child’s phone uploads nothing to the developer. The child’s iPhone has no paywall, and the weekly tier upload, the beta study counts, in-app feedback and invites are all unavailable on it; emergency passes always remain and the parent cannot turn them off.

Sharing links, stopping management and retention. The sharing links between parent and child are read-only, but “anyone with the link who has ByIntent installed” can read them, so keep them like a password; the parent can tighten them to invited people only under “Manage sharing” on the family screen. When the parent chooses “Stop managing”, the four locks on the child’s phone are lifted, the requests, appeal records and parent code stored on the child’s phone are cleared, the appeal records in the child’s iCloud are deleted, and the sharing link the parent sent is revoked 24 hours later. The daily summary and the request log in the child’s iCloud are not deleted, and the sharing link the child sent to the parent is not revoked; both stay in the child’s iCloud until ByIntent’s data is deleted under iCloud storage management. The random child identifier stays on the child’s phone until ByIntent is deleted.

Contact for parents and guardians. If you are a parent or guardian with a question about a child’s data, or you believe a minor has given us information outside family mode, write to support@byintent.app. Because we cannot read family data, we cannot delete it for you. “Stop managing” only clears the family data on the child’s phone and the appeal records in the child’s iCloud (see the paragraph above); to delete all family data in the child’s iCloud, delete ByIntent’s data under iCloud storage management on the child’s iPhone.

12. Your rights

Because the data exists only on your device by default, you can exercise most of these yourself without asking us:

• Access and portability: export events.jsonl from within the app.
• Erasure: “Delete all history” in the app, or delete the app itself.
• Withdraw consent: revoke Screen Time authorization or notification permission in system settings; switch off any online toggle from section 5 in the app.
• Erasure of server data: tiers and study counts are deleted on written request — see section 5; so are feedback messages and invite records — see section 6.
• Object and restrict: ByIntent does no profiling, no automated scoring, and puts your data to no advertising use whatsoever.

If your jurisdiction grants you further rights, or you would like our help, write to support@byintent.app.

13. Support forum and site analytics

The twelve sections above are about the iPhone app. This website is a separate matter: it has a server, so it does take a few things in. This section spells that out. The app’s optional online features are in section 5; nothing that happens on the website flows back into the app, and none of it is linked to your app data.

What you choose to send: the support forum

When you post a question on the support page, we keep what you filled in:

• Nickname — optional; leave it empty and the post shows as “Anonymous”.
• The question itself — stored as you wrote it, up to 4000 characters.
• A screenshot — optional, up to 5 MB each.

No account, no email address, and we won’t ask for one. After posting you get a ticket for checking the status of your own post and reading our reply. The server keeps only a hash of that ticket, so we cannot store or recover the ticket itself — lose it and you’ll need to post again or write to us. Your browser keeps it for the current tab only (sessionStorage) so a refresh doesn’t lose it; close the tab and it is gone, and it is never synced anywhere. On a shared device, save a copy yourself rather than relying on the page to remember.

Every post is read by us before it is published. That keeps spam out, and it stops a screenshot that shouldn’t have been public from being exposed. Posts and screenshots awaiting review are held in non-public storage with no directly reachable public address.

Please leave ID numbers, phone numbers and addresses out of your post — we don’t need them and would rather not hold them. Before attaching a screenshot, take a look at what else is in it.

What is recorded automatically: site analytics

Each page on this site sends one count to our own server. It contains two things: the page path (for example /support.html) and the referring domain (for example news.ycombinator.com; navigation within the site is recorded as “internal”, and arriving directly as “direct”). The path and query string of the referrer are stripped in your browser and never sent to us at all — they often carry search terms.

What is stored is a per-day table of counts. We do not:

• record or store IP addresses
• set cookies, or use localStorage for analytics
• fingerprint your browser or generate any visitor identifier
• use a third-party analytics service (no Google Analytics or similar)

The cost is that these numbers are coarse: they cannot tell “one person visiting ten times” from “ten people visiting once”, and they cannot follow your path through the site. We think that trade is worth making. If your browser blocks the request, the page works exactly as before — it fails silently.

Website advertising (Google AdSense)

This website uses Google AdSense to show ads, which are served by Google. This concerns the website only: the app shows no ads and contains no advertising SDK (see section 14).

• Google and its partners may use cookies to serve ads and measure their performance based on your visits to this and other websites; where permitted, this includes personalised ads. These cookies are set by Google and its partners and are unrelated to our own site analytics described above.
• You can turn off personalised ads in Google Ads Settings (adssettings.google.com).
• How Google uses information from sites that use its services is explained at policies.google.com/technologies/partner-sites.
• Visitors from the European Economic Area, the UK and Switzerland first see a consent message; ads are shown according to the choices you make in it.

Where it lives, and who can see it

Forum content and visit counts are stored on Vercel’s storage service (this site is hosted on Vercel too). As the host, Vercel handles technical data such as server logs under its own terms; see the Vercel privacy policy. Beyond that we do not share, sell or rent this content to anyone.

How to have it deleted

To delete a question or screenshot you submitted, write to support@byintent.app with the ticket you were given (or tell us roughly what you wrote and when). We will delete the post and any attached image. For a post we decide not to publish, the screenshot is deleted the moment we reject it; the text is kept so you can still see the status with your ticket, and is cleared out periodically.

Visit counts are aggregate numbers with no identifier attached, so they cannot be traced to a person and cannot be deleted per person.

14. Third parties

ByIntent integrates no third-party analytics, advertising or crash-reporting SDK, and shares, sells or rents your data to no one. Only two outside parties are involved: Apple — system permissions, Sign in with Apple, iCloud sync (your own iCloud private database) and in-app purchases are handled by Apple’s platform services under Apple’s own privacy policy; and Vercel — when you turn on the tier upload or the beta study, that data is kept on our server hosted by Vercel (see section 5), and feedback, invite records and the subscription-transaction notifications Apple sends are kept on our referral and feedback service, also hosted by Vercel (see section 6), with a copy forwarded to our own revenue-statistics service, also hosted by Vercel. Apple pushing subscription notifications to that service is part of Apple’s platform services and adds no further party.

If you have opted in to sharing crash and usage statistics with developers in your iOS settings, Apple collects and aggregates that; we see only Apple’s aggregate reports, which contain nothing that identifies you.

15. Changes

As features change, fields and purposes change with them. Any material change will be announced on this page of the website and will update the effective date at the top, so you can always check back here. Actions that need your consent (for example reading the clipboard) ask for it at that moment through an iOS system prompt.

Change log

• 2026-10-10: section 11 is now “Minors and family mode”, stating that parental consent is obtained through the Screen Time “child” authorization, that the developer cannot access family data, the EU / US / New Zealand age thresholds, what is synced, what the parent can and cannot see, link revocation 24 hours after management stops, and how guardians can contact us; adjusted the page heading and sections 1, 2, 3, 4 and 5 to say family mode syncs through the family’s own iCloud.
• 2026-10-06: section 15 now says material changes are announced on this page with an updated effective date, and that actions needing consent are confirmed through iOS system prompts, rather than promising to re-ask for consent inside the app; added “Apple’s subscription notifications” to section 6, stating that Apple’s servers send a notification for every subscription transaction (invited or not) directly to our referral service, what is stored and for how long; adjusted sections 8 and 14 to match.
• 2026-10-05: added section 6, “Feedback and invites”, covering in-app feedback, the one-time clipboard check for an invite code and the transaction record sent when an invited user subscribes; rewrote the subscriptions section (now section 10) to describe the subscription now on sale; adjusted sections 1, 3, 5, 8, 12 and 14 to match. Former sections 6–15 are now 7–16.
• 2026-10-05: added “Website advertising (Google AdSense)” to section 12, stating that this website uses Google AdSense, the advertising cookies Google and its partners may use, where to manage personalised ads, and how consent works for visitors from the European Economic Area, the UK and Switzerland.
• 2026-09-24: added section 5, “Optional online features”, stating plainly what iCloud sync, the weekly tier upload and the beta study counts (all off by default) send, where, who can see it and how to turn them off; removed statements that no longer hold, such as the claim that the app made no network calls and “iCloud sync is off”; “anonymous token” now reads “a random token not linked to your identity”; described retention and deletion of server data and how IP addresses are handled.
• 2026-09-02: first published.

16. Contact

Privacy questions, data requests, or a case where this page does not match what the app actually does — all welcome at support@byintent.app.

ByIntent is a general wellness tool that supports self-management. It is not intended to screen for, diagnose or treat any condition.