Privacy Policy
Ballast is a tool for tracking and changing a private habit. Everything below follows from one decision: the app has no account, no login, and no server of its own. What you write in Ballast stays on your phone.
This policy covers two things. Most of the page applies to Ballast 1.0.1, the version on the App Store today, and to later versions. The section labelled Version 1.1 and later adds what changes with that update, which has not been released yet.
What Ballast stores on your device
All of it stays in Ballast's own storage on your iPhone, and Ballast transmits none of it:
- your start date, streaks, and logged urges and slips, including any triggers and notes
- your daily check-ins and written reflections
- the reasons you write during setup, and the optional picture you can keep with them
- your if-then plans, your course progress, your weekly reviews, your habits and their completion history
- which articles you've read, milestones you've celebrated, and program steps you've completed
- the name, phone number and message for your optional support contact
Deleting the app deletes it from the phone. Ballast keeps no other copy, and I have no way to recover it or reach it.
Apple's device backups are the exception Ballast doesn't control. If iCloud Backup is on, or you back the phone up to a Mac or PC, those backups can include Ballast's data automatically, under Apple's terms, and can outlast deleting the app. You can turn this off for Ballast in Settings, under your Apple Account, iCloud, Manage Account Storage, Backups.
What leaves your device
Purchases. Ballast uses RevenueCat to manage subscriptions and restore purchases. When you open Ballast or come back to it, and when you buy, restore or open the paywall, Ballast asks RevenueCat whether you have Pro. Each time, RevenueCat receives purchase and receipt information, an anonymous app user ID it generates, a device identifier, and basic app and OS version details. This is used to work out whether you have an active subscription, and nothing else. It is not used for advertising, and it is not shared with data brokers. RevenueCat's own policy is at revenuecat.com/privacy.
Apple. Purchases are processed by Apple under Apple's own privacy policy. I never see your payment details.
That is the complete list. There is no analytics SDK, no advertising SDK, no crash reporter, and no third-party tracking of any kind in this app.
Files you choose to share. A data export or appointment summary goes only where you send it through the share sheet.
Things people reasonably assume, that aren't true here
- Ballast does not read your browsing, your screen time, or any other app. It knows only what you type into it and the settings you choose.
- Ballast does not access your photo library. The optional picture beside your reasons is chosen through Apple's photo picker, which runs outside the app: Ballast is handed the one image you pick and nothing else. The date and location your camera attached to it are removed before it is saved.
- Ballast does not access your contacts. The optional support contact is a name and number you type yourself, stored on your device. Ballast never uploads it.
- Ballast does not send messages for you. Tapping "Text" beside a contact opens Apple's Messages app with a draft. You decide whether to send it.
- Face ID / Touch ID. If you turn on the app lock, authentication is handled entirely by iOS. Ballast is told only whether it succeeded. Your biometric data never reaches the app.
- Notifications are scheduled locally on your device. Nothing is sent through a server.
- Widgets and Siri shortcuts read from a shared container on your device only.
Tracking
Ballast does not track you. It does not link your data with third-party data for advertising, and it does not share data with data brokers. It never requests the advertising identifier.
Your data, your control
- Export. Settings → Export my data produces a JSON file of your start date and settings, urges and slips, check-ins, reasons and habits, to read or send wherever you like. It leaves out your if-then plans, course progress, steps, weekly reviews and the picture.
- Delete. Deleting the app removes your entries from the device. Files you saved elsewhere, and Apple device backups already made, stay where they are. For purchase records held by RevenueCat, email me and I will request deletion on your behalf.
This website
This site sets no cookies, runs no analytics and loads nothing from third parties. The plan builder runs in your browser and sends nothing anywhere. The host, GitHub Pages, may keep ordinary server logs under GitHub's own policy.
Children
Ballast is rated 17+ and is not directed at children under 13. I do not knowingly collect any information from children under 13.
Not medical advice
Ballast is a self-tracking and educational tool. It is not treatment, it does not diagnose anything, and it is not a substitute for professional care. If this is affecting your work, your relationships or your safety, please talk to someone qualified.
Changes
If this policy changes, the date at the top changes with it, and material changes will be noted in the app's release notes.
Contact
Questions about privacy, or a deletion request: atabany.apps@gmail.com
Version 1.1 and later
Not released yet. None of this section applies to the version on the App Store today. It applies from version 1.1, in addition to everything above.
What else Ballast stores on your device
- your clear days, and the tools you used during an urge
- any plan drafts, and the answers you write in the course
- your Shield settings, including any cool-off you chose and a salted hash of a trusted-person code (not the code itself), and the websites you add to the filter
Shield and Apple's Family Controls
Shield uses Apple's Family Controls and Managed Settings, with your permission, to turn on the adult-website filter and to shield apps you choose. Here's what that means for your data:
- No browsing data reaches Ballast. Ballast tells iOS to turn the filter on. iOS does the filtering. Ballast never sees which sites you visit or which were blocked.
- No app data reaches Ballast. You choose apps in Apple's own picker, and Ballast receives opaque tokens to pass back to iOS. It can't read the names of the apps you picked and doesn't see how you use them. Your choices stay on your device.
- Nothing about this leaves your phone from Ballast. No browsing or app-usage data is read by Ballast or sent to me or anyone else by Ballast, because there's no server to send it to. Apple's own handling of iOS features is covered by Apple's privacy policy.
- Trusted-person code. If you use the commitment lock, Ballast makes a code and you send it yourself, once, through the iOS share sheet to whoever you choose, using whichever app you choose. That message is between you, them and that app. Ballast keeps only a salted hash and forgets the code.
- Sites you add. The websites you add to the filter stay on your phone and are handed to iOS, which does the blocking. Ballast doesn't send them anywhere, and they're never in a backup file, an export, a widget, a notification or a log. Apple's device backups can include them, as described above.
- You can withdraw permission at any time in Settings. The Shield screen will then say the shield is down.
Backup, restore and deleting
- Backup and restore. A backup is the full copy of your history, plans and progress: a file you save through the share sheet and restore yourself. Ballast keeps no copy. Shield settings, including the sites you add, stay on this phone and aren't in the file. A backup holds your private entries, so keep it somewhere you trust. Restoring reads the file on your phone.
- Delete. Apple doesn't document whether a website filter or app shield outlasts deleting the app, so it may. If something is still blocked afterwards, look in Settings, under Screen Time.
