An honest word on privacy.

Some of our apps run entirely on your device. Some need an account, because their whole point is coordination between people. This page is honest about which is which, and what that means for your data.

§ 01Always true, in every app

• No advertising. No app in the catalog carries advertiser-funded content.
• No third-party trackers. No analytics SDKs, social pixels, attribution services, or cross-app tracking.
• Never sold. Your data is not sold, brokered, or rented. There is no alternative business model.
• Minimum collection. We collect only the data an app needs to do its job.
• Plain-English policy. Written in sentences, not legal jargon.
• Founder support. Privacy questions are answered directly by the engineer who built the app.

§ 02What each app collects

Gag Order — on-device only

No account. Nothing is uploaded to Clarendon. Votes, prompts, and gameplay stay on your device. Purchases are handled by the Apple App Store; we see only aggregated, anonymized reports.

Rolligan — on-device only

No account, no online requirement. Scores and gameplay never leave the device. Purchases are handled by the Apple App Store; we see only aggregated, anonymized reports.

YulePick — account-based, by necessity

YulePick coordinates people across devices, so it needs an account. Hosted on Supabase, it stores:

• Your email address — for sign-in and transactional emails.
• Your display name — visible to participants in your exchanges.
• Exchange information — group names, dates, rules, budgets, exclusions.
• Your wishlist — items and links you add.
• Your draw assignment — private, visible only to you.
• Diagnostic data — crash logs via Apple, containing no personal content.
• A device push token — stored only if you enable notifications (opt in or out anytime in iOS Settings).

YulePick does not collect your contacts, location, or photos. No profiling is performed, and nothing is shared with other services.

Borea — on-device, with optional AI features

No account. Your food log, weigh-ins, settings, and Apple Health data live on your device. When — and only when — you use AI features, Borea sends what the feature needs:

• Meal descriptions, photos, and voice notes — to the AI provider, for macro and calorie estimation.
• Coach questions — plus a recent window of your log for context.
• Spoken replies — reply text goes to a speech provider to generate audio.

These requests are processed transiently and are not stored as a history or profile. Your data is never used to train AI models. Apple Health data is never sold and never shared with data brokers. Subscriptions are handled by Apple; we see only aggregated, anonymized reports.

§ 03Storage & protection

YulePick's database is Supabase (managed Postgres) in commercial-grade US data centers. All connections use TLS 1.2+ in transit, with encryption at rest. Sign-in uses Supabase Auth with passwordless email links. Access to production data is limited to the founder — no contractors, vendors, or advertisers.

§ 04What we don't do

• Never sell, rent, or broker data.
• No ads in any app.
• No third-party analytics SDKs, attribution kits, or social pixels.
• No cross-app or website tracking; no App Tracking Transparency prompts, because there's nothing to ask about.
• No advertising profiling or audience building; no data shared with ad networks.
• No AI model training on your data.

§ 05Third-party processors

A short list, each contractually limited to its job:

• Supabase — database & authentication for YulePick. SOC 2 Type II, US-based.
• Resend — transactional email for YulePick sign-in links and notifications. No marketing.
• Anthropic — AI processing for Borea's calorie estimates and coaching replies. Processed, not retained as a profile.
• ElevenLabs — speech synthesis for Borea's spoken coach. Receives reply text only.
• Apple App Store — distribution, payment, and crash reporting, governed by Apple's privacy policy.

§ 06Retention & deletion

Gag Order & Rolligan: we never receive your data; deleting the app removes everything.

Borea: your log lives on-device and in Apple Health. AI requests are processed transiently and not stored. Deleting the app removes all local data.

YulePick: delete your account anytime in Settings → Danger zone → Delete account — it permanently removes your profile, organized exchanges, wishlists, draws, and assignments. Data is kept while your account is active; accounts inactive for 24+ months are deleted automatically. For same-day deletion, email hello@clarendon.dev — we confirm within seven business days, and deleted data rolls off backups within 30 days.

§ 07Children's privacy

Our apps are not directed at children under 13, and we do not knowingly collect data from them. YulePick requires an Apple ID and email account (minimum age 13 in the US, 16 in some jurisdictions). Parents or guardians can contact us to request deletion of a child's data.

§ 08Your rights

Depending on where you live — including California (CCPA) and the EU/UK (GDPR) — you have specific rights to access, correct, port, or delete your personal data. Email us and we'll honor them within the timelines the law requires.

§ 09Changes to this policy

Substantive changes are announced in-app and in the newsroom, and the last-updated date above will reflect them. We will never reduce existing protections without explicit notice.

§ 10Contact

Questions go to the founder, not a queue or a chatbot.

hello@clarendon.dev
Clarendon Labs LLC
4801 N. Clarendon Ave., Chicago, IL 60640, United States