Privacy
bud i is a free app for tracking your own habits, health measurements and hobbies. It has no ads, no tracking, and no analytics, and your data is never sold or shared.
What we store
- Your account. For each of your devices, a random device ID and a scrambled (hashed) version of a secret the device generates. No password. If you add a name, we store it.
- Signing in with your email (on our website, or in the app): we store the address you sign in with. To sign in, we email you a 6-digit code through our email provider; we keep only a scrambled version of the code, it works once for a few minutes, and it's deleted within a day. If you use Sign in with Apple, on the website or in the app, Apple gives us a private identifier for you and, if you share it, your email address (which may be one of Apple's private relay addresses). Signing in with the same email or Apple ID on the website and in the app opens the same account.
- If you link an Apple ID (so a new phone can get back in): Apple's identifier for you, and the email Apple shares — which can be a Hide My Email address if you chose that. We also keep a token from Apple solely so we can tell Apple when you delete your account.
- Your time zone, so a habit's "day" matches yours.
- What you enter: habits, check-ins, honesty ratings, notes, missed-day answers, weekly reviews, breaks (dates and a reason such as "sick"), health measurements and readings, hobbies and sessions, the categories you choose for them, and reminder times.
- bud i Plus, if you subscribe: payment is handled entirely by Apple — we never see your card or Apple ID. We store whether you have Plus, until when, which plan, and the App Store's transaction number, so one subscription stays with one account. Apple's own privacy policy covers the purchase itself. TestFlight testers get Plus free while testing: the app passes on Apple's signed note that it came from TestFlight, and we store only until when.
- Stays on your phone, never sent to us: photos and recordings you add to a hobby's portfolio (photos are saved without their location), a habit's link to Apple Health, and what Kri remembers. They're part of your iPhone's own backup; deleting the app or signing out removes them.
- Medicines, if you add them: each medicine's name, what it's for (a condition such as diabetes — only if you choose one), your own note of the dose, the times you take it, whether each dose was taken or skipped, and — only if you choose to count what's left — how many you had when you last counted or refilled and how many make a dose. This is sensitive health information: it's used only to remind you and to show you what's been missed, it's never shown to a witness, and it's deleted with your account. bud i never suggests, checks or changes a dose — it doesn't replace your doctor's or pharmacist's instructions.
- If you invite a witness: which habit, when they accepted, and a scrambled (hashed) copy of the invite code until it's used.
Apple Health
bud i reads Apple Health only if you connect a measurement to it, and then only that one kind of data (for example, steps), and only as one number per day — never individual samples, locations or anything else. Those daily numbers are stored like readings you typed in, marked as imported. You can disconnect at any time in the measurement's settings or in the Health app; readings already imported stay until you delete them. bud i never writes to Apple Health. Data from Apple Health is never used for advertising or marketing, never sold, and never shared.
Setting up by voice
If you choose to set bud i up by talking (the microphone tab in the middle), the conversation runs through Cartesia, a speech company that hears you and replies. Cartesia's AI writes the guide's replies with a language model from OpenAI, so OpenAI also receives, through Cartesia, the text of the conversation and the details below that go with it — never your voice. It passes through our server on the way (so our key to Cartesia never has to be on your phone); our server doesn't record or keep the audio or the conversation — only a short quality note about it (see Improving the guides below). What goes to Cartesia: your voice while the conversation is on, what's said, your first name, and the names of the habits, measurements, hobbies and medicines you already have (so it doesn't suggest them twice) — and anything you tell it, such as a medicine you'd like reminders for. The app asks before your first conversation. Nothing it proposes is saved until you check the list and tap Save — except a check-in you confirm out loud ("I did it"), which is logged straight away and can be undone. If you ask Kri how your day went, or to plan your day, it also receives a summary of that day — which habits you did, readings against your targets, hobby time, which medicine doses were taken or missed, and the fixes you wrote after missed days or in your weekly review — but never your written notes. If you talk through your weekly review, it receives the last seven days in the same way (and last week's "one thing I'll change"), and your answers and grade are saved to your account as you give them, like the written review. What Kri remembers: times you planned with Kri and small things you agreed to try are kept on your phone for a week, and sent to Cartesia only during a conversation, so Kri can ask how they went. You can see and clear them in You → Settings → What Kri remembers; they're never sent to our server. If you choose to hear Kri's voice on your last-call reminder, Cartesia also turns one short sentence into speech: either a neutral line, or — only if you choose "by name" — a line with the habit's name. If you tap Hear my day on Today, the app writes a few sentences about your day — what's on it and when, including the titles and times of your meetings from your calendar — and our server has Cartesia say them in Kri's voice and sends the sound back; neither keeps the words or the sound. Cartesia and OpenAI keep logs according to their own policies; we don't use them for anything, and never for advertising. If you never use Talk, nothing goes to Cartesia.
Weather on Today. If you've set your town (in Explore) and an outdoor habit is still ahead today, the app asks Apple Weather for today's hourly forecast at that town — just the place, never who you are — so Today can offer to move the habit out of the rain. Apple's policy covers the request; we don't see it.
Explore (the strip on a hobby or habit, such as "Explore Tennis"): the town you enter is kept on your phone, never on our server. To find places near it, your iPhone asks Apple Maps for the kind of place (for example "tennis club") around that town, as any map search does; we don't see it. Videos for the topic are found by our server, which sends YouTube only the search words (such as "tennis drills") — never who's asking — and keeps the results for a day for everyone; they play in YouTube. Classes and the people to follow open in Apple Maps, Instagram or TikTok, under their own policies. A place you add to your plans is saved like any other plan in MyDen. For a hobby or habit bud i doesn't already know (say, "bonsai"), our server sends just its name — never who you are — to Anthropic (Claude), once, to write the page's guide (events, what to search for); the guide is shared with anyone else who has that hobby. Anthropic doesn't use it to train its models.
Improving the guides. After each conversation with Kri, Theo or Ivy, our server keeps a short quality note: which guide, how long, whether you were on the phone's speaker or headphones, and counts of what went wrong or right — the guide repeating itself, being cut off, background noise, a "no" or a "yes" to what it said, a tool that failed. It also keeps up to eight of the guide's own sentences behind those counts (never your words), with numbers, email addresses, links and your name removed. The sentences are deleted after 14 days and the counts after 90. Once a day the notes are added up into a report for bud i's team; to write it, a summary of the day's notes — with no name, email or account id — is sent to Anthropic (Claude), which doesn't use it to train its models. The notes are included in your data export and deleted with your account. "Last time" notes: a one-line note of your last few conversations with each guide is kept on your phone (never on our server) and sent to Cartesia at the start of your next conversation, so the guide can pick up where you left off.
MyDesk, the work side (the MyDay | MyDesk | MyDen switch at the top): your calendar stays on your phone — bud i reads the calendars on this iPhone to show your meetings and never sends them to our server. Recordings you make of a meeting or a class stay on this iPhone unless you share them yourself, or — only if you've connected NeXtory, and only after you confirm that everyone in it knows and agreed — you send one to NeXtory (A3i) to be written up. The audio goes from your phone straight to NeXtory, never through our server; our server only asks NeXtory for the one-time upload link and passes the title, kind, length, start time and the names of who was there. NeXtory doesn't keep the audio once it has written it up, and bud i deletes the phone's copy when NeXtory's notes are ready; the notes live in your NeXtory account under its own policy. A recording you haven't sent to NeXtory is deleted from this iPhone after 7 days. Tell people before you record, and recordings are limited to 90 minutes. Tasks (your one-off work items) are saved to your account like everything else, and included in your export. If you talk to Theo, the work guide, the conversation runs through Cartesia in the same way as with Kri, and Theo also receives the next seven days of meetings from your calendar (times, titles, places, and the first names of the people invited — not notes or email addresses) and your open tasks, for that conversation only. If you ask about another day (up to about four months ahead), the app reads that day from your calendar and gives Theo the same details for it, plus when you're free. The notes bot address you can save is kept on this iPhone. If you ask Theo about a past meeting (Ask A3i, only for accounts linked to NeXtory), our server sends your question to NeXtory and passes back its short answer from your meeting notes; we don't keep either. When accepted, a time Theo or you find for a task is added to your iPhone's calendar ("Focus: …") by the app itself; so is a work habit with a time, if you ask, as a weekly repeating event for four months (taken off again if you delete the habit).
Pulse makes you a short daily brief on what you follow. You pick the areas (and a few topics) in bud i; they're saved to your account, and our server asks Morning Brief, a service from A3i, to write the briefs. Morning Brief receives only a random id for you, those interests and topics, your time zone and the time you want it — never your name, email or anything else. Turning Pulse off (or deleting your account) deletes that profile there too.
MyDen, the household side: your errands (with any lists, shops and times), meal plans and routines (outings, trips and home jobs that repeat) are saved to your account like everything else, included in your export, and deleted with your account; their reminders are made on your phone. If you talk to the home guide (Ivy, unless you rename it), the conversation runs through Cartesia in the same way as with Kri, and the guide also receives this week's errands, meals and routines, for that conversation only. Fly (new things to do) works like Pulse: our server sends Morning Brief, an A3i service, only the topics you pick, your own words, the town you enter and your time zone, under a separate random id — never your name or email — and shows you what it finds.
Sharing MyDen with a partner (MyDen settings → Share MyDen): only if you invite someone with a one-time code and they use it. From then on each of you sees and can change the other's MyDen errands (with their lists), meals and plans, and sees the other's first name; nothing else is shared — not habits, health, medicines, hobbies, MyDesk, or your conversations with the guides. Either of you can stop sharing at any time; each then keeps what they added. Deleting your account ends the sharing and removes what you added.
Connect NeXtory (MyDesk settings → Integrate A3i): if you connect your NeXtory account (A3i), you sign in to NeXtory and allow bud i; NeXtory gives our server a key that works only for your account, which we keep encrypted and never send to your phone. It's used only when you ask Theo or Kri to book a meeting or answer from your meeting notes. Disconnect in MyDesk settings or in NeXtory at any time; deleting your bud i account disconnects it too.
Booking meetings by voice (only for accounts linked to NeXtory (formerly AI Note), an A3i product — not switched on for anyone else yet): when you ask Kri to book a meeting and say yes to it, our server sends the title, day and time, length and the other person's email address to NeXtory, which puts the event on the Google Calendar you connected there; Google then emails the other person the invite, from your calendar. We don't keep the meeting details. NeXtory's and Google's own policies cover the event from there.
People and Contacts. So you can book a meeting or have a guide write a message just by saying a name, bud i keeps a short list of people — a name and an email address or number — on your phone, never on our server: people you add, and anyone whose address you spelled out once for a meeting. If you allow it, the app also looks in your iPhone's Contacts (iOS lets you choose which contacts bud i can see), on the phone, for the one name you said. The guide hears the name you said; if that person has more than one address, the guide reads them out so you can choose. For a meeting, only the chosen email goes to NeXtory, as above.
Messages a guide writes (when you ask, for example, "text Sam I'm running late"): the guide writes it during the conversation, so its words go through Cartesia and OpenAI like the rest of the conversation. The draft is kept on your phone for three days; bud i never sends it. You open it in Mail, Messages or WhatsApp, check it and send it yourself, under that app's own policy.
What the guides did: the changes each guide made for you in the last week, each of which you can undo, are listed on your phone only (You → What the guides did). What the guides know (also under You) shows exactly what each guide is told when a conversation starts.
Your picture
If you choose an illustration, your account stores which one. If you use a photo, it stays on your iPhone — it is never uploaded; the account only notes that you're using one.
What we don't do
- No advertising, no third-party analytics or tracking SDKs, no data brokers.
- Your health and habit data is never used for advertising or marketing, and never sold.
- Other users can't see your data — with one exception you control: if you invite a witness for a habit, the person who accepts sees that one habit's name, its strength, whether you're on a break, and which days this week you kept it. Never your notes, honesty ratings, missed-day answers, other habits, health readings or hobbies. You (or they) can end it at any time.
- Doing a habit together works the same way, both ways: if you invite someone (or join with their code), each of you sees the other's first name, whether the other's habit is done today, and which days this week — never notes, honesty ratings, misses or strength. Each of you keeps your own habit; either of you can stop it at any time.
Where it lives
On our server, so you can reach it from the app. Your phone also keeps a copy so the app — and its widgets, Apple Watch app and Siri shortcuts — works without a connection. Reminders are scheduled on your phone; nothing about them is sent anywhere else.
Backups. Once a day we back up the database so nothing is lost if something breaks. Backups are encrypted before they leave our server, so the storage company that holds them cannot read them. Old backups are deleted automatically, normally within about 3 months.
The waitlist on our website
If you join the waitlist on the bud i website, we keep the email address you give, and, only if you choose to tell us, which side of bud i interests you and a short note. We use it only to tell you about bud i. It isn't linked to an app account and we never share or sell it. To be taken off the list, write to us (below) and we'll delete it.
Deleting your data
In the app, go to You → Delete account. That permanently erases your account and everything in it from our server straight away, and clears it from your phone. Copies inside encrypted backups disappear as those backups expire — within about 3 months.
Taking your data with you
In the app, go to You → Export my data for a complete copy of everything you've entered, as a JSON file you can keep or move elsewhere.
Contact
Questions or requests: kumarj@a3ik.com.