Last updated: 2026-10-07

Privacy Policy

Last updated: 2026-10-07

This Privacy Policy describes what Unprompted ("we") collects, how we use it, and the choices you have.

1. Data we collect

Account data. Handle, display name, email address or phone number, password hash (bcrypt), and a coarse age bucket (13-17, 18-24, 25-34, 35-plus). We do not store your exact date of birth; the DOB entered during signup is held in the device Keychain and only the derived age bucket is sent to us.

Content. The posts and comments you publish, including the time of posting.

Provenance aggregates. For every post we store device attestation signals provided by Apple's App Attest service: an attestation key identifier, the device's attestation certificate, and an opaque receipt. We also store coarse-grained composition metadata such as elapsed composition seconds and a focus-loss count.

Device identifiers. The App Attest key ID and user key ID associated with your device. These are generated by Apple on your device and are specific to our app.

2. Data we deliberately do NOT collect

Raw keystroke timing or biometric timing. Any typing-cadence signals are

aggregated on-device before transmission; the raw per-keystroke timestamps never leave the device.

Advertising identifiers (IDFA). We do not request tracking permission.
Precise location. We do not collect GPS.
Contacts, photos (beyond the ones you explicitly upload as an avatar), or

the device address book.

3. How we use data

To operate the Service (deliver posts, authenticate you, verify humanity).

To enforce the Terms and respond to abuse reports.

To prevent fraud and automated account creation.

We do not sell your data. We do not share it with advertisers.

4. Third parties

We use the following service providers:

Apple — for App Attest and APNs. Governed by Apple's privacy policy.

Resend — to deliver email verification codes. Receives the recipient

email address and the code only.

Twilio — to deliver SMS verification codes. Receives the recipient

phone number and the code only.

Our cloud infrastructure provider — stores encrypted backups of the

Postgres database and the S3-compatible object storage holding avatars.

We do not embed third-party analytics, advertising, or tracking SDKs in the iOS app.

5. Retention

Account data: for the life of the account.

Posts and comments: until you delete them or your account.

Verification codes: ≤ 10 minutes.

Backups: ≤ 30 days.

6. Your rights

You can:

Delete individual posts, comments, or your entire account from inside the

app at any time.

Change or remove your email / phone / handle in Settings.

Email privacy@unprompted.app to request a copy of the data we hold about

you, or to invoke rights under GDPR / CCPA / other applicable law.

7. Children

The Service is not intended for users under 13 (or under 16 in the EU/EEA/UK). We do not knowingly collect personal information from such users. If you believe we have inadvertently collected data from an underage user, contact privacy@unprompted.app and we will delete it.

8. International transfers

Our servers are located in the United States. By using the Service you consent to the transfer of your data to the United States.

9. Changes

We will notify you in-app of material changes.

10. Contact

privacy@unprompted.app