PhewlyPrivacy Policy
Phewly is a daily "I'm OK" shared with the people who love you. It was built so that we know as little about you as possible. What you share with your loved ones is end-to-end encrypted: only their phones can read it. Nobody else can read what you share, not even us.
In short
- No account, email or phone number. You're a random ID.
- Your name, check-in times, status, info pack and pets are encrypted on your phone before they're sent.
- Your mood diary, medicine names and photos stay on your phone. A weekly care summary, if you turn one on, shares only what you choose, end-to-end encrypted.
- No ads, no tracking, no selling of data. Ever. Crash reports carry no ID.
What stays on your phone
Your check-in history, check-in times, medicines and their photos, pet details and photos, photo reminders, alarms, your mood and sleep diary, and your settings are stored only on your phone, in a private folder that is not included in iCloud Backup. Deleting Phewly, or using Me › Privacy and Security › Delete Everything, removes them.
The one exception is the weekly care summary (Phewly Plus), and only if you turn it on: once a week it sends the people you choose what you chose to include, end-to-end encrypted. That can be the days you checked in (and which were by your steps), how many medicine doses you marked as taken and the times of any you didn't (never which medicine), and, only if you include them, the How I’m Feeling faces you picked. Turning it off, or taking someone off, deletes their copy.
Apple Health (optional, Phewly Plus)
If you switch on a Health tool, Phewly reads only what that tool needs from Apple Health, on your phone: falls recorded by Apple Watch, your step count, or your sleep times. Nothing else, and never heart rate or other medical readings. Health data is never sent to us. If your watch records a possible fall and you don't answer "Are you OK?", the time of that possible fall is added to your encrypted status, which your loved ones can see only during an alert. The server only ever sees an earlier check-in deadline, never why.
What our server keeps, and why
To ask your loved ones to check on you when your phone can't, a small server has to know a few things. It never sees your name or anything you write.
| What | Why |
|---|---|
| A random ID and its public keys | To recognise your phone's signed requests. Not linked to your name, email or number. |
| The time your phone last contacted the server | So a copied request can't be sent again. Deleted with your account. |
| Your phone's notification address | To deliver alerts and reminders from loved ones. |
| Your next check-in deadline, and the wait before each loved one is asked | So loved ones are asked if you don't check in, even if your phone is off. |
| Who you're connected with (as random IDs), and when an alert started or was answered | To ask the right people, in your order. |
| Encrypted messages between connected phones (your status, info pack, pets, and with Phewly Plus the weekly care summary you choose to send) | Passed along only. The server cannot open them. The latest status replaces the previous one. |
| With Missed-Dose Alerts: the times of your next doses (never which medicine) | So a loved one is told if a dose isn't marked taken. |
| With a stand-in (Phewly Plus): who stands in, for whom, until when, and who has agreed (as random IDs and times) | So the stand-in is asked first until the date you chose, and your usual order comes back on time. Deleted when it ends or is cancelled. |
| With Phewly Plus: your subscription's level, renewal date and whether it will renew, Apple's transaction IDs for your purchases, and family codes (stored as a scrambled hash) | So Plus works on any phone and codes can be checked. |
| With Sign in with Apple: a scrambled form of Apple's anonymous ID for Phewly | So you can get your account back on a new phone. We don't ask Apple for your name or email. |
| A set-up code from "Set Up for Someone Else", encrypted | Held for at most 24 hours and deleted the first time it's opened. |
| Short-term counters to stop abuse, using a keyed scrambled form of your network address, or of your random ID | Rate limits. Deleted within a day. |
| Crash and performance reports from Apple's MetricKit, with no ID attached | To find and fix bugs. Not linked to you. Deleted after 90 days. |
Old data is deleted on a schedule: messages after 30 days at most, used invites after a day, undelivered notifications after 7 days. After an account is deleted or moved, we keep only its random ID and public key, and erase them after a year (see "Your choices"), apart from the purchase lists below.
Two lists about purchases are kept after an account is deleted. If Apple refunds or revokes a purchase, we keep Apple's transaction ID for it, so it can't turn Plus on again. For each subscription, we keep Apple's original transaction ID and a count of how many family codes it made, so a code given out before is never made again. Neither says whose account it was.
Shared only if you choose
- Last known battery and location on alert (Phewly Plus, off until you turn them on) are encrypted for the people you share with, and only released to them while an alert about you is on. Location is taken only while you're using Phewly.
- Your info pack and pets go only to the people you pick, encrypted. Stop sharing with someone and their copy is deleted.
- A sitter PDF you send yourself is not encrypted once it leaves Phewly; the app warns you.
Other services Phewly uses
- Supabase (hosted on Amazon Web Services in the United States) runs our server and database.
- Apple Push Notification service delivers alerts. Notifications carry only a type and a random ID; your phone adds the name itself.
- MET Norway (api.met.no) provides the weather if you turn it on. Your phone sends your location, rounded to the nearest 0.1° (about 10 km), straight to them, and it's never sent to us.
- Apple Maps tells the app which country that rounded location is in, so Help shows your country's helplines. Only the country is kept, on your phone.
- The helpline list is downloaded from phewly.app. Nothing about you is sent with it.
- Good news: the app asks our server for the day's good-news headline. It sends your phone's date (and, if your phone passed over a headline, which try this is). Like every request, it's signed by your random ID; nothing else about you is sent.
- Apple App Store handles purchases. We receive the signed transaction to confirm it.
- Sign in with Apple, if you use it. We ask for no name or email.
Analytics
We use Apple's own tools only. App Store Connect shows us totals like downloads and crashes, from people who chose "Share with App Developers" in their iPhone's settings. Apple's MetricKit crash and performance reports are sent to us with no ID and nothing personal. We don't use advertising or tracking services, we don't track you across apps or websites, and our website keeps no request logs.
Your choices
- Turn any shared feature off in the app at any time.
- Remove a connection: they stop seeing your check-ins, and anything you shared is withdrawn.
- Delete Everything (Me › Privacy and Security) removes your account and data from our server and your phone. People you were connected with are told you're no longer connected.
- After you delete your account, or move it to a new phone with Sign in with Apple, we keep the old random Phewly ID and its public key (the half of its key that can only check a signature). That's so an old phone can't quietly bring the account back, and only that phone can be told what happened. No name, contact details or anything else is kept with it, and it's erased after a year.
Phewly isn't an emergency service
Phewly asks the people you choose to check on you. It can't call emergency services. In an emergency, call your local emergency number.
Children
Phewly is for people aged 13 and over.
Changes
If this policy changes, we'll update the date above and explain anything important in the app.
Contact
Questions about your privacy: support@phewly.app.