Acta Privacy Policy

Last updated: 2026-10-23 · Applies to the iOS app “Acta” (知行录), its Apple Watch app and widgets

1. Overview

Acta is a personal growth tool for daily records, awareness and review. It is local-first: records stay on your device by default, and go to your own iCloud only when you turn iCloud sync on.

We operate one server (api.done2ai.com, hosted on Cloudflare). It is used to verify membership; to keep purchase records (after you delete your account, identifiers are replaced with pseudonyms and financial fields such as amounts are kept); to process account deletion; to serve a public lock-screen wallpaper gallery; and, after you have agreed to this policy and turned on anonymous usage analytics, to store aggregated usage counts. Our server does not store your records, tasks, awareness answers or reviews, and it does not receive or recognize your voice. Speech recognition runs on your device only and is not sent to Apple's servers. If the device cannot do this, voice input is unavailable. Acta does not keep audio.

This policy explains what we process, why, and how you control it. When you first open the app, we ask you to read this policy and choose whether to agree.

2. How we handle your data

2.0 First-launch consent and Limited Mode

On first launch you can choose “Agree and Continue” or “Disagree”. If you disagree, you can still use records, awareness, review, reminders, calendar writing, voice input and already-downloaded on-device models on this device. Online features — purchasing and restoring Pro, iCloud sync, Sign in with Apple, cloud AI, the wallpaper gallery and model downloads — are unavailable, and the app makes no related network requests. You can agree at any time from within the app.

After agreeing, you can also withdraw consent in Settings → Privacy Center. The app then enters Limited Mode and you can keep using the local features above. Cloud AI, diagnostics and analytics are turned off, iCloud sync stops, and the app signs you out of Sign in with Apple. Data already synced to iCloud or sent to a provider is not deleted as a result. If you agree again later, these optional items stay off until you turn them back on.

2.1 Local-first storage

Everything you create — daily records, lever actions, awareness Q&A, reviews, identity and vision, AI memory, theme and language — is stored on your device. To show the same content on Apple Watch and widgets, the app writes necessary snapshots to an App Group container that remains on your device.

2.2 iCloud sync (optional, Pro)

When enabled, your records are stored in the private CloudKit database of your own iCloud account; we cannot access it.

• After you turn sync off, new data is no longer uploaded. Turning sync off does not delete data already in iCloud. Withdrawing consent to this policy also does not delete data already synced to iCloud or already sent to a provider.
• “Reset Data” in the app deletes only data on the device. It does not delete records in iCloud (your CloudKit private database). If sync is still on, those records may come back to the device the next time it syncs. To delete them from iCloud, use Settings → Apple Account → iCloud → Manage Account Storage.

Apple's privacy policy: apple.com/legal/privacy

2.3 Subscriptions and payment

Purchases go through the Apple App Store; subscription status is managed by a third-party subscription service.

• Payment details are handled by Apple; we never receive or store them.
• The app sends the purchase receipt and a user identifier to the subscription service to confirm membership. Before sign-in this is a random anonymous ID. After Sign in with Apple, the identifier is “apple:” followed by the user identifier Apple returns (not your Apple ID email). Our server uses that identifier to associate purchase records.
• When the paywall is shown, the app reports it to the subscription service. That report is not controlled by the “Anonymous Usage Analytics” switch. Before a purchase, the app records the paywall entry point and a one-time flow ID. The subscription service notifies our server of purchase events. We store the user identifier, product, transaction ID, purchase/expiry time, price and currency, trial/renewal/cancellation status, paywall entry point and one-time flow ID, for entitlement checks, support and accounting. We do not store receipts, payment details or email. After you delete your account, identifiers in purchase records are replaced with irreversible pseudonyms, and financial fields such as amounts are kept.

2.4 AI features (optional)

AI review assistance can run in two ways:

• On-device model: runs entirely on your device after download; nothing leaves the device and no extra consent is needed.
• A third-party AI service you configure (e.g. OpenAI, Anthropic, Google Gemini or any address you enter): your device sends requests directly with your own API key, not through our server. Keys are stored in the iOS Keychain and never uploaded.

When you use a third-party AI service you configure, the content sent includes: the day's tasks and ratings, awareness answers, review text, a profile/identity summary, AI memory, summaries of recent days and your growth trajectory.

• Before your first use of cloud AI, the app asks for your separate consent and shows the current provider. If you choose “Not now”, nothing is sent.
• One consent covers all cloud AI providers. If you later switch providers in Settings, the app will not ask again; content will be sent to the provider selected at that time. You can see the current provider in Settings → Privacy Center.
• You can turn off “Cloud AI” in Settings → Privacy Center at any time; sending stops immediately. Content already sent to a third party is governed by its privacy policy and retention; we cannot delete it on your behalf.
• Some providers are outside your country or region; see Section 5.

2.5 Anonymous usage analytics (optional, off by default)

“Anonymous Usage Analytics” is off by default. Only after you have agreed to this policy and turned it on in Settings → Privacy Center will the app:

• send paywall_view, purchase and trial_start to TelemetryDeck (TelemetryDeck GmbH, Germany). These events include the paywall entry source; purchase and trial_start also include the selected plan;
• report the event name and entry point to our operations backend. The server stores only aggregated counts by date, event name and entry point, kept for 90 days. Abuse prevention uses a SHA-256 hash of the IP address.

This does not include the text of your records and is not used for advertising or cross-app tracking. Turning it off stops sending to TelemetryDeck and the operations backend immediately. Reports to the subscription service about the paywall and purchases are not controlled by this switch; see section 2.3. TelemetryDeck privacy policy: telemetrydeck.com/privacy

2.6 Crash and performance diagnostics (optional, off by default)

Only after you turn on “Crash & Performance Diagnostics” will the app send to Sentry (Functional Software, Inc., USA): stack traces, error messages and preceding breadcrumbs (screen names, request URLs and status codes), device and OS information, sampled performance data and a random installation ID. No record content, name, email, Apple ID, IP address or IDFA. Data is kept up to 90 days. Sentry privacy policy: sentry.io/privacy

2.7 Notifications

Review and awareness reminders are local notifications and do not use a push server. If you set up “Important Message Alerts” (iOS 27+), an automation you create in Shortcuts passes the source app, title, subtitle and body of matching notifications to the app; they are processed on device only, and resulting to-dos or notes sync to your iCloud if sync is on.

2.8 Sign in with Apple (optional)

Used to restore Pro across devices and to show your account in the app. The app requests your name and email (you may hide your email) to display your account and help restore purchases; these are stored on your device. After Sign in with Apple, the user identifier used by the subscription service is “apple:” followed by the user identifier Apple returns, and our server uses it to associate purchase records. When you delete your account, the app asks you to verify with Apple again; the server deletes your customer record at the subscription service, replaces the identity in purchase events with an irreversible pseudonym, and revokes the Apple authorization. Not signing in does not affect core features.

2.9 Calendar

When “Sync to Calendar” is on, the app writes lever actions and awareness entries only to a calendar named “知行录” and does not read your other events.

• iOS 17 and later: the app requests “Add Events Only” access.
• iOS 16: the system has no add-only option, so the app must request full calendar access; even with full access, the app only writes and never reads your other events.

Turning it off stops writing.

2.10 Voice input

Speech recognition runs on your device only and is not sent to Apple's servers, whatever you choose in the app. If the device cannot do this, voice input is unavailable. Acta does not keep audio. Third-party cloud speech services are not currently offered.

2.11 Lock-screen wallpaper gallery

When you open the wallpaper feature, the app requests a public list of backgrounds from our server. The request carries no user identifier; your IP address is used only for short-term rate limiting and is not written to a database. Gallery images are generated daily by us with AI models and AI-reviewed; they are unrelated to your content.

3. Permissions

All permissions can be declined or revoked in system Settings without affecting core features. We do not use App Tracking Transparency (ATT) and do not request the advertising identifier.

4. What we don't do

• We don't sell, rent or trade your personal information;
• We don't read your contacts, precise location, call logs or messages;
• We don't use ad networks or track you across apps;
• We don't store your records, tasks, awareness answers or reviews on our server.

5. Third parties and cross-border transfer

Our website, done2ai.com, uses Cloudflare Web Analytics to count visits and see where visitors come from. It does not use cookies and is not used to track individual visitors.

If you are in mainland China, some of this processing transfers information outside China. We ask for your separate consent before first use of cloud AI, and you may withdraw it at any time.

6. Children

The app is designed for adults and does not knowingly collect children's personal information. If you believe a child has provided information without guardian consent, contact us and we will delete it promptly.

7. Your rights and deletion

• Delete an entry: delete it in the app; it moves to Trash and is permanently removed after 30 days;
• Erase all data: Profile → Settings & Tools → Reset Data deletes only data on the device. It does not delete records in iCloud (your CloudKit private database). If sync is still on, those records may come back to the device the next time it syncs. Turning sync off or withdrawing consent also does not delete data already in iCloud; to delete it, use Settings → Apple Account → iCloud → Manage Account Storage;
• Manage consent: turn Cloud AI, diagnostics and analytics on or off at any time in Settings → Privacy Center, and see when each was last changed and your consent history. The consent history is stored only on your device, never uploaded, and kept for up to 12 months;
• Delete account: when you delete your account in account settings, the app asks you to verify with Apple again. The server deletes your customer record at the subscription service, replaces the identity in purchase events with an irreversible pseudonym (financial fields such as amounts are kept), and revokes the Apple authorization. Your Apple subscription itself is not cancelled; manage it in system Settings;
• Remove completely: uninstalling removes local data; remaining iCloud data can be deleted in system Settings;
• Revoke Sign in with Apple: Settings → Apple Account → Sign in with Apple;
• Export: Profile → Settings & Tools → Backup & Export.

Depending on where you live (e.g. PIPL, GDPR, CCPA), you may also have rights to access, correct, port, withdraw consent and complain; contact us below.

8. Security

Local data is protected by the iOS sandbox and device encryption; API keys are kept in the Keychain; all network traffic uses HTTPS. Server logs exclude tokens, authorization codes and unmasked user identifiers. No method is perfectly secure.

9. Changes

When this policy changes we update the “Last updated” date; for material changes we notify you prominently in the app and ask for consent again.

10. Contact

Terms of Use →