Privacy Policy

SubraLabs ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how our products (iOS apps, web products, AI tools) handle your information.

Information We Collect

Our apps are designed with privacy at the core. We minimize data collection to what is strictly necessary for app functionality.

• Local data. App data (tasks, settings, preferences) is stored locally on your device using Apple's SwiftData framework. This data never leaves your device unless you explicitly enable iCloud sync.
• iCloud sync. If you choose to enable sync, your data is stored in your personal iCloud account via Apple's CloudKit. We do not have access to your iCloud data — it is encrypted and managed entirely by Apple under your Apple Account.
• Health data. Some of our apps may request access to Apple HealthKit data, including steps, calories, body mass, and workout information. This data is accessed only with your explicit permission and is used solely within the app to provide health and fitness features.
• Audio data. Some of our apps process audio through your device's microphone. All audio processing happens locally on your device and is never transmitted to external servers.
• No account required. None of our products require you to create an account or provide personal information such as your name, email, or phone number, unless explicitly stated for a specific product. The newsletter on theonemancompany.com is the only exception (opt-in email only).

How We Use Your Information

Any data processed by our apps is used exclusively to provide the features and functionality you expect.

• Display and manage your content within the app
• Sync your data across your own devices (if iCloud sync is enabled)
• Provide health and fitness insights based on HealthKit data (where applicable)
• Process audio in real time for audio tool features (where applicable)

We do not use your data for advertising, profiling, or any purpose beyond the app's core functionality.

Data Storage and Security

Personal app content is stored in one of two places, both controlled by Apple's security infrastructure:

• On-device. Data stored locally via SwiftData is protected by your device's built-in encryption and passcode.
• iCloud. Data synced via CloudKit is stored in your personal iCloud account, encrypted in transit and at rest by Apple. We cannot access, read, or decrypt your iCloud data.

We do not collect advertising analytics or crash reports from our products. Sense-Calibrator has one narrow exception: a user may choose to share anonymous technical data with the SubraLabs calibration telemetry service. Nothing is sent until the user answers the tool's notice, and choosing not to share discards what was waiting and stops all sharing. The tool continues to send one record per complete Quick calibration through its original endpoint: controller board and firmware, before-and-after calibration measurements, pass values, stability events, the selected gate, and a timestamp. The current version also sends typed events: the type and outcome of each calibration; before-and-after radial offsets and signed per-axis median residuals for Quick and guided runs, also measured after each Quick pass; the stability and acceptance of existing Quick verification attempts, including the retry hold result, and the missing Range completion checks and reverse-turn progress; each attempt to write to controller memory and its result; how an unsaved calibration ended (saved, disconnected or page closed, with the reason writing was blocked if it was); at most 8 short summaries per visit of how much the sticks move while nobody touches them, each also saying how long ago the last Quick or guided calibration of the visit was (rounded to 10 seconds, at most one hour), which kinds of operation came after it (Range, a write to memory, reconnecting the controller, a restart or a confirmed power-off) and how many times a stick was released since; and at most two summaries per visit of where each stick stopped after it was pushed and let go, with the median stopping point, how much the stopping points vary and the last 20 of them, each rounded and timed only relative to the last calibration. These events contain no serial number, device identifier, text typed by the user, or client timestamp, and no clock time: apart from durations, the only times are counted from the last calibration; a random code generated for each page load, never stored by the tool, links the events of one visit, and the service records only the day each event arrived. The requester's IP address is held temporarily in server memory only to enforce the per-minute rate limits; periodic cleanup removes it, and it is never written to the telemetry records. The records contain no User-Agent, account, name, email address, or other request metadata. Declining does not affect the calibrator. When the shared fields change, the notice appears again before the updated events are sent.

Sense-Calibrator diagnostic reports. Separately from telemetry, a user can record up to 30 minutes of diagnostics in the tool (kept in memory in that browser tab) and send the recording to SubraLabs. A report is sent only after the user presses Send to the developer and confirms a dialog that shows its size and contents; it never leaves the browser otherwise, and it can also be downloaded instead. It contains times counted in milliseconds from the start of the recording; connections and disconnections with the board revision, firmware version and memory status; each drift test and calibration with its result, as the same typed events described above; whether the calibration was saved and whether a power cycle was requested; where each stick stopped after every release; and, once per second, the median position and spread of each stick. It contains no serial number, device identifier, controller color, firmware build date, error message, typed text, raw stick readings or time of day. The service stores the report as it is, plus the day it arrived, under a random code (SC- and 8 characters) that it shows to the user to quote in a GitHub issue; the file's modification date is set to midnight UTC of that day, so the time of receipt is not kept. Reports are deleted after 180 days. The calibration events inside a report carry their own code and numbering, not the visit code, but their values are the same ones telemetry sends, so if the user also shares telemetry, a report can be matched to the telemetry events of the same visit by comparing them. Sending a report does not depend on the telemetry setting. As with telemetry, the IP address is held in server memory only to limit how many reports one connection can send, and is never written to the report.

Web server logs. Like every request to subralabs.com, telemetry and diagnostic report requests are recorded in the web server's access log (nginx). For each request the log contains the IP address, the exact time, the requested path and the browser's User-Agent. We keep these logs to debug the server and to protect it from abuse, not to analyse telemetry, and they are deleted after 14 days (the logs rotate daily and the last 14 are kept). Requests also pass through Cloudflare, which processes the same data under its own privacy policy.

Exception: server-side products that explicitly require an account (e.g., admin tools delivered to clients) operate on client-managed infrastructure and follow that client's data practices.

Third-Party Services

Our iOS apps do not integrate third-party analytics, advertising SDKs, or tracking frameworks. Specifically:

• No tracking. We do not use any advertising identifiers, fingerprinting, or cross-app tracking.
• No third-party analytics. We do not use Google Analytics, Facebook SDK, or any similar services in our iOS apps.
• Apple services only. The only third-party services used are Apple's own frameworks (CloudKit, HealthKit, StoreKit) which are governed by Apple's privacy policies.
• Subscriptions. In-app purchases and subscriptions are processed by Apple through StoreKit 2. Payment information is handled entirely by Apple — we never see or store your payment details.

AI Processing

Some of our apps use Apple Foundation Models for AI-powered features. All AI processing happens entirely on your device. No data is sent to external servers, cloud APIs, or third-party AI services. Your content remains private and local at all times.

HealthKit Data

For apps that access Apple HealthKit:

• HealthKit data is accessed only after you grant explicit permission through the iOS Health permissions dialog
• We read only the specific data types required for the app's features (e.g., steps, active calories, body mass, workouts)
• HealthKit data is used solely to display insights and track progress within the app
• HealthKit data is never shared with third parties, used for advertising, or transmitted off your device
• You can revoke HealthKit access at any time through Settings > Health > Data Access on your device

Children's Privacy

Our apps do not knowingly collect personal information from children under the age of 13. Since our apps do not collect personal data or require account creation, there is no mechanism through which such data could be gathered. If you believe a child has somehow provided personal information to us, please contact us and we will take appropriate action.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

Contact

If you have any questions about this Privacy Policy or our data practices, you can reach us at:

[email protected]