InnerPulse is privacy-first from the start. There is no server, no account, no analytics. This chapter explains what that means technically.
Everything stays local
The app stores your entries, check-ins, factors and settings in a SwiftData database inside the protected app container on your iPhone or iPad. This container is shielded by iOS against access from other apps. Nothing of it leaves the device through InnerPulse as long as device sync is off.
Photos and files you attach to entries also live in the app container, with the strictest file protection level of iOS: while your device is locked, nobody can read them. InnerPulse saves photos without location and camera data (EXIF). The app does not store videos. The app keeps other files such as PDFs unchanged. Attachments never go to Apple Health, to the Apple Watch or into widgets.
Apple Health data that InnerPulse reads stays in Apple Health. The app doesn't copy it into its own store. It only evaluates it at runtime to generate factor suggestions.
No account, no cloud of our own
You don't sign in. You don't create a password, besides the device passcode. There is no InnerPulse server. The Apple Watch syncs directly with your iPhone. iPhone and iPad keep separate journals until you turn on device sync on both. Every install starts with an empty database.
Device sync
With the optional Device sync you keep iPhone and iPad on the same state. It is off by default. You turn it on separately on each device: Settings > Privacy & data > Device sync, switch Sync on this device. Before the first sync, the app shows the prompt Turn on device sync?. It explains that entries, questionnaires and factors go encrypted to your iCloud, that this is health data, and that you can withdraw at any time. Only Turn On starts sync.
How InnerPulse protects your data: Sync uses your private iCloud database (CloudKit). There is no server or account with us for this either. The app encrypts every record on the device with AES-GCM and a 256-bit key before it goes to iCloud. It stores the key in your iCloud Keychain, which Apple encrypts end to end even without Advanced Data Protection (Apple overview). Neither we nor Apple can read what you write. Apple only sees when and how many encrypted data packets are stored; the app pads their sizes in steps.
What syncs: entries with mood, note, feelings and factors, questionnaire results, factors and categories, and the display settings (chart styles, row layout, entry layout, pattern threshold). Stays on each device: reminders, app lock, Apple Health, weather, theme and language.
Photos and files: With Sync photos and files on the device sync page, you add attachments to sync; the switch is off by default. When you turn it on, the app shows the estimated space needed in your iCloud storage. Sync transfers photos and files up to 25 MB including previews; larger files stay on the device. The app encrypts each file with its own key derived from the sync key and pads it to steps of 128 KB. Upload only over Wi-Fi is on by default. You can't limit downloads to other devices to Wi-Fi. If you remove an attachment, it disappears on all devices and iCloud frees the space. Turning the switch off deletes nothing, not even in iCloud.
Merging: Sync merges identical entries into one, for example after an export and import. The same applies to an entry whose content is fully contained in another one. If anything differs, both entries stay. Factors with the same name count as the same factor; a different spelling creates two factors. If two devices change the same note, the entry keeps both versions. If they change different fields, both changes stay.
Apple Health: Only the device that wrote an entry to Apple Health updates or deletes the matching sample.
Second device: The key arrives via your iCloud Keychain. This can take a few minutes, and Passwords & Keychain must be turned on in your iCloud settings. If app lock is off on the new device, InnerPulse suggests turning it on, because the device now shows all entries.
Deleting: If you delete an entry or questionnaire, only an encrypted deletion marker without content remains in iCloud: no note, no values, no factor names. It lets your other devices apply the deletion.
Protection against mass deletion: If you delete many entries at once (at least 10 and at least a quarter of all entries), sync pauses and asks: Don’t delete or Delete everywhere.
Turning off and deleting: If you turn sync off, your data stays on the device and the copy stays in iCloud. Delete iCloud copy removes the copy; all devices keep their entries and turn sync off. If you lose a device, first remove it under Settings › Apple Account › Devices, then delete the iCloud copy and turn sync on again.
Different iCloud account: If you sign in with a different account, sync pauses. Nothing goes to the new account without asking.
The Apple Watch keeps syncing only with the iPhone. What helps with problems is in Troubleshooting.
Which permissions the app uses
InnerPulse only asks for what it needs, and only when you activate the respective feature:
- Notifications: for journal and questionnaire reminders. Asked as soon as you turn on reminders.
- Face ID, Touch ID, device passcode: for app lock. Asked as soon as you activate the lock.
- Apple Health: for factor suggestions and optional writeback. Asked per data type.
- Location (while using the app only): for weather factors. Asked as soon as you activate weather.
- Camera: only when you take a photo under Photos & Files in an entry. iOS asks the first time.
- Photos: You pick from your library through Apple's photo picker. InnerPulse only receives the photos you select and needs no access to your whole library. The app writes nothing to your library.
- Microphone and speech recognition: for voice dictation of notes. Asked on the first tap of the mic button. Recognition runs via Apple Speech on the device if it supports your language locally. Otherwise iOS can forward it to Apple servers.
You can revoke or grant each permission again in iOS under Settings, Apps, InnerPulse.
No tracking
InnerPulse contains no analytics, no tracking pixels, no Firebase, no Sentry and no other third-party SDK for behavioral telemetry. At runtime, the app makes not a single network call to InnerPulse servers. There aren't any. The only external endpoints the app reaches at all are Apple-owned services:
- WeatherKit, if you have weather factors activated.
- App Store Connect for in-app review dialogs, if you tap the rate-the-app button.
- Apple Speech, if your device doesn't recognize the dictation language locally and iOS forwards the recognition to Apple.
- iCloud (CloudKit), if you turned on device sync. It only holds encrypted records.
iCloud backup
If you have iCloud backup enabled, InnerPulse is typically included like every other app, along with the photos and files attached to your entries. The data lands in an encrypted copy in your iCloud. Apple can hand out this copy under certain legal conditions, as long as your iCloud is not protected with Advanced Data Protection.
If you want to avoid this, you can check in iOS Settings, Apple Account, iCloud, Manage Storage, Backups, [device name], Apps whether InnerPulse appears in the list and disable it. iOS however doesn't show every installed app in this list, usually only those with a larger data footprint. If InnerPulse currently uses only a few megabytes, it may not be listed individually and is automatically included in the overall backup, without you being able to deselect it individually.
The safest option, if you want to fully control the backup path, is a regular manual data export as CSV plus complete deactivation of iCloud Backup for the device. Alternatively, you can wipe the app fully in the privacy center before the next backup starts.
App lock
In Settings you activate the app lock. The app then asks the next time you open it, depending on timeout, for Face ID, Touch ID or device passcode. Until authentication, InnerPulse shows an empty lock screen; no app content is visible. This is a second layer of protection if someone gets hold of your unlocked device, e.g. partner, family or at checkpoints. While the lock is active, the Today's Entry widget shows neither note nor factors, only mood and time.
The lock screen covers everything, including an open editor. While the app is locked, none of your entries' colors shine through. InnerPulse only releases the app after a successful check. Anything you've already typed in the editor is kept.
Pick the timeout matching your security needs:
- Never: no lock. Default after install.
- Immediately: lock on every app switch. Secure but inconvenient.
- 1 minute, 5 minutes, 15 minutes: lock after background time. Good middle ground.
Sharing without private data
When you share a milestone, your year in pixels or an insight, InnerPulse creates a separate image card. It isn't a crop of a screenshot, so nothing from the screen underneath can slip in. Notes, factors, feelings, questionnaires and the dates of individual days never appear on the card.
Three switches decide what the card shows: Mood colors, Month names and Number of days. By default it shows only the number. For the format, pick Portrait for stories or Square. Every card carries the InnerPulse logo and name at the bottom. The image only leaves the app through the iOS share sheet when you tap Share image.
Privacy center
In settings, tap Privacy and Data to open the privacy center. It shows:
- Counters of your journal entries, questionnaire results and custom factors.
- Quick access to export, import and delete functions.
- The Device sync row with its state (On or Off).
- A footer text that explains where your data lives: without sync only on the device, with sync also as an end-to-end encrypted copy in your iCloud storage.
Hide mood score
In the privacy center, under Privacy, you'll find the switch Hide mood score. It affects the lock screen accessory: when it's active, it shows only a neutral symbol instead of your mood value. Handy if your lock screen is also visible to others and your mood score shouldn't lie open. More on the widgets themselves is in the chapter Widgets & Lock Screen.
Delete all data
In the privacy center you'll find a red button Delete all data. It asks for confirmation twice. On click, the following are deleted:
- all journal entries,
- all photos and files attached to entries, immediately and without a waiting period,
- all questionnaire results,
- all custom factors and custom categories,
- all smart suggestion data (weekday patterns, co-occurrence scores).
If device sync is on, the app also asks where to delete: Only on this device turns off sync here, On all devices also deletes the entries on your other devices.
What is not deleted:
- Apple Health samples that InnerPulse itself wrote. If you used the writeback to Apple Health, those samples stay in your Apple Health. Delete them as needed in the Health app.
- iCloud backups, if active. Apple manages those separately. Earlier backups can still contain data until they are overwritten by a new backup or you manually delete the backup image.
- The iCloud copy of device sync, if you choose Only on this device. You delete it under Device sync with Delete iCloud copy.
Deleting data by uninstall
When you delete the app from the home screen, iOS removes the complete app container, including the database. That is the final variant, though without a confirmation dialog from the app. Apple Health samples and iCloud backups remain as described above.
CSV exports are unencrypted
CSV files from the export are in plain text, and so is the ZIP file with your media. Treat them like your medical records. If you share them by mail or cloud, watch the recipient and use end-to-end encrypted channels if possible. PDF exports are also unencrypted. More tips on secure sharing are in the chapter Export your data.
What to know
- InnerPulse sends no data to the developer, third parties or ad networks.
- The app has no ads, neither banners nor interstitials. It is a paid app, not data-financed.
- The app lock is optional but recommended if the device is also used by other people.
- If you really want to stay anonymous and don't want to use existing iCloud backup configuration, export manually on a regular basis. More on this in Export your data.