Shaterian keeps what you tell it on your iPhone.
There is no account to create. There is no server of ours. There is no analytics, no crash reporting service, no advertising, and no third-party company that receives anything about you. Nothing you record is sold, shared, or used to train anything.
Five things can leave your iPhone. Two happen only if you switch them on, one only if you choose to sign in, and two happen while you are using features that need them. All five are described below, in full.
| What | Where it is kept |
|---|---|
| Memories, body notes, medication history, settings | A database file inside the app on your iPhone |
| The full text of a document you import | The same database, whole and unabridged |
| Your portrait, and the colours read from it | The app’s own storage on your iPhone |
| Your face photograph, face shape and the head fitted to it | Files on your iPhone, excluded from iCloud Backup |
| Routines you ask Smith for (their words, days and times) | The same database on your iPhone; the reminders themselves are held by iOS on this iPhone |
| Scanned place maps | The app’s own storage on your iPhone |
| Your chosen voice | iOS preferences on your iPhone |
| Apple Health figures | Not copied. Read live when shown, and not stored |
When you import a document, iOS gives the app a temporary copy. Shaterian reads the words out of that copy and deletes it. Your original file is never moved or changed.
iCloud backup is off by default. It is switched on in two ways, both of them yours: by turning it on in Settings, or by signing in with your Apple ID, which turns it on for you the first time. Signing in is a deliberate act, and a copy of your memories is most of what it is for. If you have ever switched backup off yourself, signing in again does not switch it back on.
When it is on, a copy of your memories is written to your own iCloud private database.
That is your iCloud account, not a server belonging to us. School Fab Lab has no credentials for it, no way to read it, and no way to list who has records in it. Apple cannot read a private database either.
For each memory, the copy contains exactly:
Not included in the copy: your face photograph, your face shape, the colours read from your portrait, your name, your Apple identifier, your hand-typed health figures, and the diagnostics log.
One thing to know: if you import activity from Apple Health, it becomes a memory — and memories are what this backup copies.
Signing in is optional and skippable, and nothing in the app is locked behind it. If you do sign in, Apple returns an identifier that is specific to this app and, on the first sign-in only, your name.
Both are written to the database on your iPhone and go nowhere else, because there is no server to send them to.
Your email address is never requested. The app asks Apple only for your name.
When you speak to Shaterian, it asks iOS to transcribe on the device wherever your iPhone supports it. On a device or a language where on-device recognition is not available, iOS sends that audio to Apple’s speech recognition service. An app cannot force an on-device model to exist, so we tell you rather than imply otherwise.
If you import photos, the coordinates stored in them are sent to Apple’s geocoding service to turn them into a place name — “Lakeview”, not a latitude. The photographs themselves are never sent anywhere.
What is in a photograph is worked out on your iPhone. Apple’s Vision framework names what it recognises, and on iOS 27 one photograph from each day is shown to Apple’s on-device model, which writes a sentence about it and picks the themes and the feeling the app files it under — from the app’s own short lists, never a name. That happens entirely on the phone; it is the same model that answers Smith, and it needs no network.
Separately, choosing to open a place in Maps hands that location to Apple Maps.
Settings offers an experimental voice that is not Apple’s. It is a small speech model that runs on your iPhone. If — and only if — you tap to try it, the app downloads about 89 MB of model files from Hugging Face, a public site that hosts open machine-learning models.
What travels is the download itself. Nothing about you goes with it: not your name, not a memory, not a word you have spoken. Once the files are on your iPhone the voice works with no connection at all, and everything it says is produced on the device.
If you never tap to try it, nothing is downloaded and no connection is made.
Smith answers your questions with a model that runs on your iPhone. Settings can offer a switch, Let Smith ask a bigger model, which uses a larger Apple model that runs on Apple’s servers, through what Apple calls Private Cloud Compute. The switch is off unless you turn it on, and it only appears on iPhones and builds that can use it.
While it is on, each question you ask Smith, and the short excerpts of your memories he needs to answer it — the same few he would read on the phone — are sent to Apple’s servers to be answered. Apple states that Private Cloud Compute uses this data only to answer the request, does not store it, and that it is not accessible to Apple. We do not run those servers and we do not see the requests. Nothing else goes: not your face or your photograph, not your health records, not your diagnostics log, not your name.
Every answer says where it came from — press and hold it — so you can see which model spoke. There is a daily allowance set by Apple, which an iCloud+ plan can raise; past it, or without a connection, Smith answers on your iPhone as before. Turn the switch off and nothing is sent again.
The only third-party components bundled with the app are local ones: an on-device database, a file-path helper, and the system web view. None of them sends anything anywhere.
| Permission | What it is used for |
|---|---|
| Microphone and Speech Recognition | Speaking a memory, and asking questions |
| Photos | Optional import of days and places from your library |
| Calendar and Reminders | Your calendar is read, never copied: when you ask Smith what is on today or when your next appointment is, the events for those days are read on your iPhone to answer, and not stored. Smith asks for this permission the first time you ask; without it he answers from your routines and reminders and can open the Calendar app for you. Reminders are treated the same way: if you connect them, what is due is read to answer and for the daily reminder, and nothing is copied in. Adding an appointment you ask Smith for goes through Apple’s own Add Event screen, which needs no permission and shows the app nothing |
| Contacts | Names, so people in your life are recognised — and, when you ask Smith to call or message someone, that person’s number. Read at the moment you ask; never kept |
| Apple Health | Read only. Steps, resting heart rate, HRV, sleep, walking speed and steadiness. Shaterian never writes to Health |
| Camera | Capturing your face for the twin, and scanning a room |
| Location (while using the app) | Answering “where am I” and guiding you home |
| Notifications | One daily reminder, if you want it — written on your iPhone from your calendar for that day and your own earlier years, never sent anywhere; any reminder you ask Smith to set; and routines — repeating reminders such as pills at 8 and 8, with a Taken button that records the dose |
Every source can be switched off in Your things, and what has already come in can be removed at the same time — you are asked about those separately, because stopping and erasing are different wishes.
What the app cannot do is hand a permission back. iOS has no way for an app to revoke its own access, by design. The system-level switch stays on until you turn it off in iOS Settings → Privacy & Security.
You can ask Smith to call someone, FaceTime them, start a message, put an appointment in your calendar, or remind you of something. Each works the same way, and none of it happens on its own:
“My daughter” and the like: the only relationship Smith knows is the trusted contact you set in Settings. If none is set, he says he does not know who that is rather than guessing.
This is the part of the policy about the face capture, set out point by point.
What is collected. If — and only if — you choose “Give it your face” on the Twin tab and take the shape, the app uses the iPhone’s TrueDepth camera (Apple’s ARKit face tracking) for a few seconds, once, and collects three things: the geometry of your face as ARKit measures it (1,220 points, in millimetres, with the eye positions), a single photograph cropped to your face, and the head the app builds from those points on your iPhone (see below). Nothing is collected unless you start the capture, and the capture can be refused or removed at any time.
What it is used for. One purpose only: to build and colour the 3D twin that represents you inside the app. The face data is not used to identify you, to authenticate you, to recognise you or anyone else, for advertising, for analytics, or to train any model — ours or anyone’s.
Where it is stored. In three files in the app’s own storage on your iPhone. They are marked so that iOS excludes them from iCloud Backup, and they are not part of the optional iCloud copy of memories described above. They are never written to any server, because there is none: Shaterian has no server of its own.
Who it is shared with. Nobody. The face data never leaves your iPhone. It is not sent to us, to Apple, or to any third party, and no third-party software receives it. The head is built on the device by code inside the app, from an open statistical model of the human head (Google’s GNM Head, Apache-2.0) that ships inside the app and needs no connection.
How long it is kept, and how it is deleted. It is kept until you delete it. “Remove it” on the face screen deletes all three files immediately; “Forget everything” under Your data deletes them with everything else; deleting the app deletes them with it. There is no copy anywhere to delete afterwards.
Diagnostics. The diagnostics log records that a capture happened, how many points were measured and how well the head fitted (a number in millimetres). It never contains the points, the photograph or the head.
Until an earlier version no photograph was kept; the wording in the app changed when the fact changed.
What bounds it:
From the shape, the app builds a complete head for your twin on your iPhone — a statistical model of the human head (Google’s GNM Head, an open model that ships inside the app) fitted to the points the camera measured. That fitted head is a third file, kept beside the shape under the same bounds: on your iPhone only, excluded from iCloud Backup, not in the diagnostics log, and deleted with the rest when you remove your face. Nothing is sent anywhere to build it.
The portrait on the Twin tab is a separate thing. Three colours are read from it on the device — skin tone, hair colour and eye colour — to colour your twin. They are six hex digits each. Nothing about your shape, age, health or identity is derived or kept, no image is uploaded, and the colours are cleared when you change or remove the portrait.
Shaterian reads from Apple Health and never writes to it. Figures are read when they are shown, and are not copied into the app’s own storage.
Health information is never used for advertising, never shared with anyone, and never used to make decisions about you.
If you import activity from Apple Health it becomes a memory, and if you have also switched on iCloud backup, that memory is copied to your iCloud like any other. If you would rather no health-derived information reached iCloud, leave the backup switch off, or do not import workouts.
Shaterian is not a medical device. It does not diagnose, treat or give medical advice, and it is not a substitute for your doctor, nurse or specialist. Questions that call for a medical decision are redirected to your care team before they reach any model.
Settings → Diagnosis and logs keeps a record of what the app did, so a fault can be described instead of guessed at. It is the one thing in the app built to be sent to us, and two rules hold it:
It holds the last 500 lines and you can clear it from that screen.
Each of these can be removed on its own, inside the app: your memories, your body notes, your portrait, your face, health figures you typed yourself, and your medication history. There is also a twice-confirmed Forget everything.
Two things you should know, because they are true and it would be easy to leave them out:
Signing out of Apple is available in your profile. Because signing in creates nothing on any server of ours, signing out and deleting the app removes everything that sign-in produced.
Deleting the app removes the database, the portrait, the face photograph, the face shape and the head fitted to it from your iPhone. It does not remove an iCloud copy, which is removed as described above.
Shaterian is made for adults and is not directed at children.
If what the app does changes, this page changes in the same release, and the date at the top changes with it. That has already happened once: when the app began keeping a face photograph, the wording on the capture screen and in this policy changed in the same build, because leaving it would have made the app lie.
Questions, corrections, or a request about your data:
[email protected]