Private isn’t a setting here. It’s the structure.

Lightbulb on your phone

This section describes the native Measrd Beta, including iOS version 0.1.0 (3) on TestFlight and Android version 0.1.0 (version code 2) on Google Play’s internal testing track. Your journal stays on your device, with no journal sync or automatic server backup. These builds add optional Mina readings: entry text is sent for analysis only after you agree and request a reading, as explained below. Earlier iOS builds 1 and 2 and Android version code 1 do not include AI analysis. The sections farther down this page describe Measrd’s hosted products; their journal-storage behavior does not apply to your native journal.

Your beta account

An account is required. The beta uses a separate staging account service provided by Supabase. It stores your email address, first name, optional last name, account identifiers and sign-in sessions. You sign in with a code emailed to you. Account and email requests can produce delivery, security and service records; the app does not send journal text with these requests. Sign-in credentials are kept in the device’s secure storage when it is available. This account is separate from an account on the live Measrd service.

Your writing and encrypted copies

Entries and saved readings are stored in an encrypted database on your device, in a separate store for each account, with the key in secure storage. The app does not upload your journal for sync or automatic server backup. If you choose to request a Mina reading, the entries for that period are sent as described below. Signing out leaves your journal and saved readings on the device. Signing in on another device does not download them, and Measrd has no server copy of your journal to recover for you.

Settings lets you make a passphrase-protected encrypted copy of your entries and saved readings, then save or share it through the device’s file and sharing controls. The destination or person you choose receives that file; Measrd does not receive an automatic copy. Restoring requires the file and its passphrase. Measrd cannot recover a forgotten passphrase. Your device’s own backup service is separate from Measrd; do not rely on it or on reinstalling the app to recover writing.

Mina readings: only when you ask

Mina is Measrd’s reading experience, currently in development. In this beta, readings are powered by Anthropic (Claude). Analysis is off until you agree in Mina settings. Agreement is separate from signing in and applies to your account on this phone. Turning it on, opening Mina or reopening a saved reading sends no entries by itself. You must also request a reading of a complete day, week or month; each period can be read once.

When you request a reading, Measrd’s server sends every session in that period to Anthropic in full, as you wrote it, including anything pasted and any personal details in the text. The request includes each session’s date, morning/midday/evening window, whether you started from the prompt or a blank page, and which parts were pasted. Measrd does not add your account’s name or email to the provider request, and it does not include other periods.

Anthropic’s API terms say it deletes what it receives and writes back within 30 days, keeps it for up to 2 years if its safety systems flag it as breaking its usage policy, and may keep it longer where the law requires. By default, it does not use that content to train its models. This is not a zero-retention arrangement.

Measrd’s server processes the request without storing your entry text. It temporarily holds the finished analysis, encrypted, so your phone can retrieve it if the connection drops. The analysis can quote your entries. The encrypted result is removed from the live analysis store when your phone confirms it has saved it, or within 72 hours if it never does. Account-linked request and usage records remain to enforce the one-reading-per-period rule and usage limits; those records contain no entry text. Recovery backups are separate: encrypted results and service records already captured in a recovery copy can remain until that copy is retired, as described under “Kept safe, then let go” below. The 72-hour limit applies to the live result, not every recovery copy.

Your phone keeps the saved reading alongside your entries and includes it in an encrypted copy when you make one. You can turn analysis off at any time to stop new requests. Readings already saved remain on your phone, and turning analysis off does not erase copies Anthropic already holds.

Account requests and removal

Request deletion of your staging account in Settings → Measrd account → Delete account. You have 48 hours to change your mind: sign back in and choose Keep my account before deletion processing begins. Signing in alone does not cancel the request. After the deadline, Measrd processes deletion automatically; this does not promise that every step finishes at that exact time. Temporary failures are retried, and unresolved failures are flagged for support follow-up. This staging process does not delete an account on the live Measrd service.

If this staging account has a subscription, renewal is stopped shortly after the request. Keeping the account does not restart renewal; that is a separate choice. Deletion does not automatically issue a refund. Associated Balanced cleanup uses the same deadline. The partner keeps their own account and writing; billing is not transferred to them.

Account deletion does not remotely erase your local Lightbulb entries, saved readings or exported copies. Make an encrypted copy first if you want to retain your writing. Manage files saved or shared elsewhere where you put them; copies managed by your device’s backup provider are separate from Measrd.

Account removal does not mean immediate erasure of payment records, service and security records, recovery backups, support correspondence or app-store testing records. For access, correction or questions about the data covered by a deletion request, email mtthw@measrd.com from that account’s address. We do not promise immediate erasure of every copy or record.

Beta diagnostics and feedback

Apple automatically collects beta crash and usage information and shares it with Measrd, including installation, device, operating-system, session and crash information. Email-invited testers’ identity and invitation status are also visible to Measrd. If you send feedback, Apple and Measrd receive your comments and screenshots. These can contain writing even though the app has no journal-sync feature. Use fictional or nonsensitive test writing, and avoid including private entries or sign-in codes in feedback.

The Android beta is distributed through Google Play. Google’s privacy policy applies to information Google processes to distribute and operate its service. If you send Measrd feedback by email, we receive the message and any attachments you choose to include. Use fictional or nonsensitive test writing, and avoid sending private entries or sign-in codes.

Measrd uses beta diagnostics and feedback to investigate problems and improve the app. Apple describes its own collection and retention in its TestFlight privacy notice. Contact mtthw@measrd.com with privacy questions or requests about your beta account or feedback.

The privacy boundary in Measrd apps is enforced inside the database, not by the interface. Row-level security rules decide what any request can return, and an automated test suite proves those rules hold before any change ships. Sealed means refused by the database, not hidden by a screen. Each app has its own seal (Balanced’s two-person reveal, Lightbulb’s sealed-once-written pages, Echo’s contribute-before-you-read rooms), and each app states its own rules where you write.

Your account: the email you sign in with and a display name if you set one. Your content: what you write in each app, held under that app’s seal rules. Operational records:timestamped events like “opened a ritual” or “sealed a session,” kept for safety and rate-limiting; they never contain what you wrote. App-specific records can include relationship or collaboration membership, shared media, generated results, progress and lifecycle state, email delivery and preferences, gifts and referrals, and bounded safety/rate-limit records; each app describes its exact inventory. Billing: your subscription state and a Stripe customer reference; card numbers live at Stripe and never touch our systems.

There is no advertising identity and we do not sell a behavioral profile. Aggregate service analytics and app-specific operational records are described here and in each app.

We measure whether the apps are used: page views and visit counts through Cloudflare Web Analytics, which sets no cookies and builds no cross-site profile, and product tallies of our own — like how many rituals complete — counted inside the product, never sent to any analytics service. What you wrote is never analytics data in any form. Counts and cadence, never content.

We never sell your data, to anyone, for anything. We never show ads or share anything with advertisers or data brokers. We never train AI models on your content, and our AI provider doesn’t either. Content sent to power a feature you invoked is used to produce your result, full stop. And nobody browses your words: production access is restricted, credentialed, and used for operating the service, not curiosity.

A short, deliberate list of processors, each doing one job: Supabase hosts the database (on AWS, US-East); Cloudflare serves the apps and the cookie-free analytics; Stripe handles payment; Resend and Google Workspace deliver email; Anthropic processes the words you send into an AI feature, only when you invoke it; and Cloudflare R2 plus ephemeral GitHub Actions jobs hold and verify encrypted database backups. Primary service data stays in the United States, encrypted in transit and at rest.

Durability is part of privacy: the database can rewind to any two-minute point in the last seven days, and an encrypted backup leaves for separate storage every night, where it is automatically test-restored to prove it works. A deletion request for one product revokes only that product’s access and removes or de-identifies its separable authored data; it does not delete the shared Measrd identity, another product, or the shared Stripe customer unless that product says so explicitly. Genuinely shared spaces follow each app’s stated survivor rules. Provider recovery and encrypted logical backups cannot be edited one account at a time, so deleted data may remain until a backup is retired and must be deleted again after any restoration. The repository does not currently encode an automatic expiry window for nightly and monthly R2 backup objects, so we do not claim that they roll off within a shorter period.

Ask and you’ll get: a copy of your data in a plain, portable format (portability is a promise here: your data lives in ordinary, well-named database tables), corrections to anything wrong, product-scoped deletion, or deletion of your whole Measrd identity subject to the shared-space, payment-record, and encrypted-backup behavior above. Whole-account deletion is a separate operator-assisted request: it removes sign-in and access to every Measrd product, while required Stripe transaction records and genuinely shared spaces can survive for their stated retention or survivor periods. Start from your accountor email mtthw@measrd.com from your account address and a person handles it. Measrd is for adults (18+); we don’t knowingly hold children’s data, and we’ll delete any we learn of.

If this policy changes, the date at the top changes, and material changes are announced by email before they apply. The promises above (enforced in the database, counts never content, never sold) are the architecture, and they don’t change. Measrd LLC, Indiana, USA · mtthw@measrd.com · see also the terms of service.