In short
Twentry keeps your journals on your iPhone and works on them there. The developer never receives your journals, and the app has no account, no servers of its own, no analytics, no advertising and no tracking. Your journal leaves the iPhone only if you connect GitHub, and then only to your own repository.
On your iPhone
Your journals, their backups, your settings, downloaded models and the AI's work are kept in the app's own storage on your iPhone, protected by iOS. Before every change, the app keeps the previous version of the journal's files, for the last 50 changes of each journal. All of this is also in your iPhone's backups (iCloud or a computer) if you have backups on. The optional lock hides the app behind Face ID or your passcode; the files themselves are protected by iOS, as for other apps.
GitHub, if you connect it
If you connect a GitHub repository, the app sends your journal there with the access token you give it. The token stays in this iPhone's Keychain and goes only to GitHub. Before the first upload and before every later one, the app asks GitHub whether the repository is private, and sends nothing to a repository that is public or whose privacy GitHub doesn't confirm. A private repository isn't encrypted: GitHub, and anyone you give access to it, can read the journal. GitHub's privacy policy covers what it stores.
AI models, if you download one
A model is downloaded from its repository on Hugging Face, or from the address you type. Like any download, that server sees your IP address and which file was asked for. Nothing from your journal is sent. Proposals, questions, dictation and reading screenshots all run on the iPhone. A model stays on the iPhone until you delete it in Settings › Models.
Dictation and pictures
Twentry's Dictate button uses Apple's speech recognition on the iPhone only, never a server; for a language the iPhone can't recognize offline, the AI model writes it down, or the app asks you to type. The audio isn't kept. The microphone on the iOS keyboard is Apple's own dictation, covered by Apple's privacy policy.
A screenshot or text you share to Twentry from another app waits in the app's storage on this iPhone until you open Twentry, which reads it and then deletes it. Text in a picture you share or pick is read on the iPhone, and the picture is deleted after reading.
What the developer receives
Only what you choose to send, and nothing from your journal: an email you write to support; anonymous crash reports, if you allow sharing with app developers in iOS Settings, passed on by Apple; and, if you join a beta test through TestFlight, the name, email address and feedback that Apple shows developers. They are used only to answer you and to fix the app, and deleted when no longer needed. Write to support@twentry.app for a copy, or to have them deleted.
The website
The website is static: no cookies, no scripts and no analytics. Cloudflare, which hosts it and forwards support email, handles those requests under its own privacy policy.
Deleting and revoking
Removing a journal (Settings › Journals, ⋯, Remove from this phone) deletes its files, its backups and its token from this iPhone; a GitHub repository keeps its own copy. Deleting the app deletes everything it kept on the iPhone, though not your iPhone's backups or your GitHub repository; a token it kept in the Keychain is removed when the app is next installed. You can revoke a token on GitHub at any time, which ends the app's access at once.
Children
Twentry isn't made for children.
Changes and contact
This policy is the responsibility of Twentry's developer, named as its seller on the App Store. A new version of this policy will be in the app and on the website, with its date. Questions: support@twentry.app.