Privacy Policy

Effective September 8, 2026 · Atreeum for iPhone, iPad, and Mac

Atreeum is a journal. What you write in a journal is among the most personal data there is, so Atreeum is built so that we hold as little of it as possible: no account, no ads, no trackers, and no Atreeum servers that store your journal. This page explains exactly what happens to your words.

The short version

• Your journal is stored on your device, encrypted at rest.
• If you turn on sync, your journal is end-to-end encrypted with a passphrase only you know before it ever reaches your iCloud, so no one else can read it there.
• AI analysis is optional and asked about up front. It never trains on your words, and entries you mark private are never analysed.
• Anything you attach, photos, voice notes, or a place, stays inside that same encrypted journal.
• Your raw health readings stay on your device. If you turn on Body & Mind, only coarse patterns, never your numbers, may inform your reflections.
• If you subscribe to Atreeum Plus, your payment is handled by the App Store. We never see your card or your name; a subscription service confirms your purchase under a random identifier.
• There is no Atreeum account and no tracking. We collect anonymous, aggregate usage, like which screens are opened, and anonymous crash reports, never linked to you and never including your journal. You can turn both off together in Settings.

Your journal on your device

Entries are saved locally on your device and encrypted at rest with industry-standard authenticated encryption. The encryption key lives in your device Keychain, protected by Apple's security hardware. You can additionally require Face ID or Touch ID to open the app.

Syncing through your own iCloud

Syncing is optional. When you turn it on, Atreeum seals your journal with a passphrase that only you set and only you know: your entries are end-to-end encrypted on your device before they are placed in your personal iCloud storage. We never receive that passphrase, so no one, not us and not Apple, can read your journal in iCloud. The sealed copy syncs to your other devices, where your passphrase unlocks it.

This storage lives under your own Apple Account, and no copy of your journal ever touches a server we operate. Because we cannot read your synced copy, we also cannot recover it: if you forget your passphrase, the copy in iCloud stays sealed, though the journal already on each of your devices is unaffected. Heart readings are excluded from sync entirely.

AI analysis, only if you choose it

Atreeum can reveal patterns in your writing: tags, moods, connections between entries, and a written reflection. When you turn insights on, the journal content you allow is sent over a secure, encrypted connection to Anthropic, our AI service provider, for analysis. Depending on the features you use, that content includes: the entries you write, spoken or typed guided session conversations as they happen, the short companion memory lines those sessions distil, your active intentions, recent entries used to write your daily notes, files you import (large text files in parts, PDF files as whole documents), and, only if you turn those options on, coarse well-being patterns with rounded daily context (like hours slept) and the place names you attach. Three commitments hold at all times:

• Your words are never used to train AI models. Our provider processes them only to produce your result, under API terms that exclude training.
• Entries you mark private are never analysed. The private flag is enforced in code at every path that could reach the AI.
• You can turn it off anytime in Settings. Off means nothing is sent for analysis, and the rest of the app keeps working.

Requests travel through a secure relay we operate so that the app never carries service credentials. The relay forwards your text and does not store or log it. To keep the relay from being abused, the app attaches a random, rotating token that confirms the request comes from a genuine copy of Atreeum; that token is not tied to you or to your journal. Importing a file with Smart Import works the same way and asks for its own consent first.

Voice

Dictation and the guided journal listen with Apple's on-device speech recognition, and Atreeum will not start listening on a device that cannot do it on-device. Your voice is transcribed on your device, so only the text goes anywhere: the audio of dictation and spoken sessions is never uploaded, to us or to anyone. Voice notes you choose to record are attachments and are covered in the next section: they stay on your device and, when sync is on, travel only inside your end-to-end encrypted journal, through your own personal iCloud. When the guided journal speaks, or Atreeum narrates your graph or a morning greeting, those spoken lines are turned into audio by ElevenLabs; your recordings and transcripts are not part of that request.

Photos, voice notes, and places you attach

You can attach a photo, a voice recording, or a location to an entry. These stay on your device and, when sync is on, travel only inside the same end-to-end encrypted journal, sealed with your passphrase. Photos and voice recordings are never sent for AI analysis. If you attach a place and you have insights turned on, only the place's name, never its coordinates, may inform your reflection.

Health data

With your permission, Atreeum reads heart rate, heart-rate variability, sleep, time in daylight, and activity from Apple Health around the moments you write. Reading is the only automatic Health access. Separately, if you turn on Save feelings to Apple Health, Atreeum can write a State of Mind entry to Apple Health after you journal, and only after you confirm each one; it never writes anything else and never on its own. Your heart readings stay on your device: they are never sent to us, never synced through iCloud by Atreeum, and never sold, shared, or used for advertising.

If you additionally turn on Let reflections consider your body, your reflections may consider coarse derived patterns only: your heart described as calm, near resting, or elevated, never as readings, and your recent sleep, daylight, steps, and workouts as rounded daily amounts, like hours slept. When insights are on, that daily context, never your heart readings, is included in the analysis request that produces your reflection. Entries you mark private never contribute, and turning Body & Mind or insights off stops this entirely.

Notifications

Reminders and daily notes are scheduled on your device, and there is no push server. When insights are on, eligible daily notes may be written by Anthropic from recent entries you have not marked private; otherwise notes come from a built-in library on your device.

Anonymous usage analytics

To learn which parts of Atreeum are used, and where to improve, the app records a small set of anonymous, aggregate events, for example that a screen was opened or an entry was created. These events carry no journal content, no titles, no free text, and no identity: there is no Atreeum account to attach them to, and nothing is ever linked back to you. They are never used for advertising and never sold or shared with data brokers. You can turn this off at any time in Settings under Privacy & Data, and when it is off nothing is sent.

Crash reports

If Atreeum crashes, a technical report of the crash, such as the point in the code where it happened, the device model, and the OS version, is sent to a crash-reporting service so we can fix it. These reports carry no journal content, no screenshots, and no identity, and they are never used for advertising. Crash reporting shares the same switch as usage analytics: turn it off in Settings under Privacy & Data and nothing is sent.

Subscriptions

Atreeum Plus is an optional subscription purchased through the App Store. Apple processes your payment; we never receive your card details, billing address, or name. To unlock Plus on your devices, a subscription-management service validates your App Store receipt and keeps a record of the purchase under a random identifier that is not tied to your name, your Apple Account, or your journal. It is never used for advertising or tracking.

Service providers

Atreeum relies on a small number of vetted providers to deliver specific features. Each one processes data only to provide its feature and is contractually bound to protect it:

• Apple: iCloud storage under your own Apple Account, on-device speech recognition, Apple Health, and the location service that turns coordinates into a place name when you attach one. Your journal in iCloud is sealed so that Apple cannot read it either.
• Anthropic (AI analysis): analyses the journal content you allow, as described in the AI section above, under API terms that exclude model training. It receives the content needed for your result and nothing else about you: Atreeum has no accounts, and no name, contact details, or profile are attached to the request (what you write in an entry is sent as written). Under Anthropic's standard API policy, inputs and outputs are deleted within 30 days, except where a different retention arrangement applies or longer retention is required for usage-policy enforcement or legal compliance.
• ElevenLabs (voice): turns the guide's own spoken lines into audio. Those lines can reflect your journal context, since the guide replies to what you share. It never receives your recordings or transcripts.
• Infrastructure providers: run the secure relay that lets the app reach the AI provider without ever carrying credentials. They do not store your journal content.
• An analytics provider: receives the anonymous, aggregate usage events described above to help us improve Atreeum. It never receives your journal, your identity, or any account, and never uses the data for advertising.
• A crash-reporting provider: receives the anonymous crash reports described above. It never receives your journal or your identity.
• A subscription-management provider: validates App Store purchases of Atreeum Plus and records them under a random identifier. It never receives your payment details, your name, or your journal.

For security, we describe most of these providers by the role they play rather than by name, so as not to publish a map of how Atreeum is built. Apple, Anthropic, and ElevenLabs are named because your content, or text derived from it, reaches them. The specific companies behind the other roles are available on request at hello@getatreeum.com.

Your control and deletion

• Mark any entry private to keep it out of all analysis.
• Turn AI insights off entirely in Settings.
• Delete any entry; deletions sync to your other devices.
• Deleting the app removes your journal from that device. Your iCloud copy is under your control in iCloud settings.

Because there is no Atreeum account, there is no personal profile of you for us to delete, export, or lose. What we collect is anonymous usage analytics and anonymous crash reports, neither linked to you, and both switched off together in Settings. Subscription records live under a random identifier and follow your App Store purchase, not you.

Children

Atreeum is not directed at children under 13.

Changes to this policy

If our practices change, we will update this page and note the new effective date. Material changes to what leaves your device will always be asked about in the app, not slipped into a policy.

Contact

Questions about privacy: hello@getatreeum.com