Privacy Policy
Sensory Budget · Last updated 17 September 2026
Sensory Budget works out how demanding your day is likely to be. To do that it reads your calendar and, if you let it, health and noise data. Almost all of that stays on your iPhone.
This policy describes what the app actually does. Where something only happens if you switch it on, it says so, and every one of those switches starts off.
The short version
- Your scores, learning and reminders are worked out on your iPhone, not on a server.
- Event titles, health data and what you tell us about yourself stay on the device.
- You need an account to use the app, but signing in does not switch syncing on.
- We do not sell your data, show advertising, or track you across other apps or websites.
- You can export everything, and delete everything, from inside the app.
What stays on your iPhone
These never leave your device, whatever your settings:
- Event titles, notes, locations and attendee names. The app reads them to work out what kind of event something is, then keeps only the category, the times and a few anonymous details.
- Health data. Sleep, heart rate, heart-rate variability and environmental sound levels are read from Apple Health, used on the device, and never uploaded. Live readings are deleted after 48 hours.
- How you describe yourself. If you tell the app you are autistic, ADHD, burnt out or sensitive to noise, that stays on the phone. It is never sent anywhere, and it never changes a number — it only changes how quickly the app learns from your own answers.
- The name you are greeted by, and any words you write yourself.
Your account
Sensory Budget requires an account, so that your history can survive a new phone and so your subscription is attached to you rather than to a device. You sign in with Apple or with Google.
Our authentication provider stores the stable user ID that Apple or Google gives us, and the email address they return. If you use Sign in with Apple and choose “Hide My Email”, that address is Apple’s private relay, and we never see your real one. Nothing else about your identity is kept — there is no name or email column in our own database.
Signing in does not turn on syncing. With syncing off, your account holds a user record, a random salt used for scrambling identifiers, and your privacy switches. Nothing else.
What you can switch on
Syncing
When you turn syncing on, a derived version of your budget is stored so a new phone can restore it: event times, categories and costs, your ratings, your model’s learned numbers and your settings. Identifiers are scrambled with a key unique to you (HMAC-SHA256), and no event title, name or free text is included.
Smarter event classification
Some events are hard to categorise from their shape alone. If you switch this on, a redacted title may be sent to
a large language model to be classified. Before it leaves the phone, email addresses, web links, phone numbers and
digits are removed, and roughly 6,400 first names are replaced with [name]. The model never produces a
score — it only suggests a category, and your own answers always outrank it.
Personalised daily notes
The one-line note on the Today screen can be phrased by a language model. It is given numbers your phone has already calculated, never your event titles unless you separately allow that, and it cannot invent a number: anything it writes is checked against the figures your device sent, and thrown away if it does not match.
Anonymous analytics
Off by default. When on, it records which screens are used and whether features work — never your content.
Location and weather
If you allow it, the app asks for your approximate location — an area of a few kilometres, never a precise position — so the daily note can mention weather that may cost you, such as a heatwave or a storm.
- It is read once, when your day is planned. Never in the background.
- It is stored nowhere. It exists for the length of one request.
- Our server looks the forecast up on your behalf, so the weather service never sees you.
- If you decline, there is no fallback — no place of any kind is sent, and the note simply has no weather in it. We do not infer your location from your time zone or your IP address.
The weather never changes a number. It only changes wording.
Calendars
You can connect your calendar in two ways.
Apple Calendar is read on the device through iOS. Nothing about it crosses the network for that to work, including calendars from a Google account you have added to your iPhone in Settings.
Google Calendar, connected directly, is the one case where calendar data crosses the network: the app asks Google for your calendar list and your events over an encrypted connection, using read-only access. It can never write to, change or delete anything in your calendar. What comes back is turned into the same anonymous shape as everything else; titles are kept on your device only, in an offline cache that is erased when you disconnect Google, when a different account signs in, or when you delete everything.
Subscriptions
Subscriptions are sold by Apple and managed through your App Store account. We use RevenueCat to tell whether your subscription is active. They receive an identifier for your account and the purchase details Apple provides; they do not receive your health, calendar or budget data. Cancelling is done in your iPhone’s Settings, as Apple requires.
How long things are kept
| Data | On your iPhone | On our server |
|---|---|---|
| Live heart rate and noise readings | 48 hours | Never stored |
| Health daily summaries | 400 days | Never stored |
| Calendar events | 400 days after the event | Without titles, until you delete them |
| Notification history | 90 days | 90 days |
| Your ratings and learned model | Until you delete them | Until you delete them |
Deleting and exporting
Delete everything is in the app, under Settings › Privacy & data. It removes every row we hold and your account itself, signs you out, cancels pending reminders, and wipes the database on your phone.
If your phone cannot reach our server at that moment, nothing is deleted and the app tells you, so that you are never left believing a copy is gone when it is not. You can try again.
Export gives you a JSON file of everything held on the device — including the titles and the self-description that never left it — because it is yours.
Two things we cannot do for you: an Apple subscription must be cancelled in your iPhone’s Settings, and RevenueCat’s own customer record is removed on request.
Children
Sensory Budget is not directed at children and we do not knowingly collect data from anyone under 13.
Changes
If this policy changes in a way that affects what leaves your device, the app will say so before the change takes effect. The date at the top always reflects the current version.
Contact
Questions about this policy, or about your data: CONTACT_EMAIL.