Your privacy in Life So Far

Last updated October 20, 2026, from the app's PRIVACY.md

Life So Far collects nothing. Not what you write, not your photos, not your places, not how you use the app. Life So Far is a view of your own data: your photos, your walks, your plans and your own words, read and shown on your iPhone. None of it reaches us.

We are Sand Collective, the people who make Life So Far. We run no server for Life So Far. There is no account to make, no sign-up and no email to give us. The app contains no analytics, no ads, no trackers and no third-party code of any kind. That isn't a policy we could change behind your back; it is how the app is built: Life So Far has no code that could send your journal to us. The App Store privacy label for Life So Far is Data Not Collected.

Where your data goes

Your data goes only to places that are yours, and to the Apple services you choose to use:

Your own iCloud, so your journal is the same on each of your devices. It is encrypted on your iPhone before it leaves, with a key only your devices hold. Apple can't read it, and neither can we.
Apple services you use, each given only what it needs and never your journal: Apple Maps gets the area of a map on screen and any place you type into a search; Apple Weather gets a rough area (about 25 km), and only if you turn weather on; Siri gets what you say to it when you use it with Life So Far, and iOS keeps its own record of that request; the App Store handles the purchase.
Wherever you send something yourself through the iOS share sheet: a picture, video or GIF you choose to share, an entry's words, a photo, a backup file, a readable copy of your journal, a technical report for support. Life So Far never sends any of these on its own.

That is all. The complete, exact list is under Everything that leaves your iPhone below. This document is the source of truth for the App Store privacy label, the app's own privacy wording and anything we say in public: it describes the app as built, not a plan.

The short version

Nothing reaches us. No server of ours, no account, no analytics, no crash reporter, no ad identifier, no third-party SDK.
It all happens on your iPhone. The AI, dictation, reading your photos, naming places and finding things in your journal all run on the device. None of it sends your data to a cloud service.
Encrypted, always. Your journal is encrypted on your device with a 256-bit key only your devices hold.
Sync is yours. Your journal syncs through your own iCloud as encrypted data that only your devices can read. To keep it on one iPhone, turn on Keep this journal on this iPhone only; to remove it from every device and iCloud, use Delete my journal everywhere (both in Backup and Restore).
What you share is your own act. Life So Far shares only when you tap Share: a picture, video or GIF it draws and shows you first, an entry's words, or a photo. It hands each to the iOS share sheet and uploads nothing.
You can leave with everything. Export a restore file or a readable copy at any time, even without buying.

On your iPhone, and only there

The AI is on-device. The lines Life So Far writes about your days, a question back after you write, the week and year in your books, Thread names and the answers in Find come from Apple's on-device model. Your entries, plans and places are given only to that model on your iPhone. There is no remote model, no Private Cloud Compute and no call to any AI company; none is built into the app. Where the model isn't available, Life So Far writes plainer lines of its own on the device. The daily questions are written by people; the on-device model only helps choose one.
Dictation is on-device. Life So Far's own microphone button uses the on-device speech recognizer only. If a device can't transcribe locally, dictation is simply not offered; your audio is never sent anywhere to be read.
Voice notes are encrypted here. A voice note's audio is encrypted on your iPhone, and its words are read on the device by Apple's SpeechAnalyzer (which may download Apple's language model, never your audio) or by the older on-device recognizer. The audio stays on your iPhone unless you turn on audio backup or move a recording to iCloud yourself (see What syncs).
What was around a voice note is opt-in, and heard here. With the Voice notes source on (off by default), Apple's on-device sound classifier listens to a recording for what was around it: rain, a crowd, birdsong. Your own voice is never one of the answers. What is saved is a few words, encrypted, with the voice note, and they sync with it. Turn the source off and nothing new is heard; words already saved stay with their voice note until you delete it.
The recognizer is told your own words, and they go no further. To catch names it has never heard, the on-device recognizer is given a short list of hints from your journal: people and places you wrote about, your plans, your towns. The list is built in memory, never written to disk, never synced, and given only to the on-device recognizer.
Photos are read on the device. The timeline stores a photo's date and place, not the photo. It follows your library: a photo you delete or hide in Photos leaves your journal, checked on the device. With the Photos source on, Life So Far also works out two wordless things on the device: a quality score (so a book leads with your best shots) and where the eye goes in the frame (so a crop keeps the subject). Turn on What's in your photos (Sources → Photos → Refine, off by default) and Apple's on-device Vision also reads what a photo shows ("a dog", "the beach"), any words in it, and how many faces it holds (a count, never who), so you can find a photo by what is in it. On iOS 27 the same switch lets the on-device model write one plain line about a photo, and it is told never to say who anyone is. Pixels are read in memory and never stored. The results are encrypted, stay on this device and leave when their photo leaves your journal: deleted in Photos, older than How far back, or left out by the albums you chose or by turning screenshots or videos off. Turning What's in your photos off removes what it read and keeps only the score and the crop point. If you turn off Life So Far's access to Photos and leave it off, they are all removed the second time you open the app. A day's summary, which stays on this device, may mention one. This reading may also run while the phone charges overnight; it is the same reading, on the same device, under the same switches.
People are named by you, never recognized. A name goes on a day or a photo only when you add it. Life So Far doesn't read faces and doesn't ask for your Contacts. Suggestions come only from words you already wrote or put in your calendar: a plan called "Dinner at June's" suggests June. Names are encrypted and sync like your entries, and so do the people you choose for the Album look and any birthday you add for them; Life So Far works out an age only from a birthday you gave. So the right photo shows a name on each of your devices, a name on a photo is stored with that photo's iCloud Photos identifier; this device's link from those identifiers to its own photos stays on this device.
Custom scrapbooks sync encrypted: their titles, the days and places they hold, and the people they are for. A scrapbook you make is saved as its question and its days, never as pages, maps or photos: each of your devices makes the pages from its own journal, with its own Privacy Zones and hidden moments. A day leaves a scrapbook's saved days when an entry, photo or moment on it is deleted, and comes back only while it still fits the scrapbook's question. A cover is named by its photo's iCloud Photos identifier, like a name on a photo.
What you choose for a scrapbook is saved with it, encrypted, and syncs. For a scrapbook you make and for the Scrapbook itself, that is the photos you pick for a page, the pages' order, the pages you leave out, the cover and the cloth; for one you make, also what kind of book it is and how many of its best days it keeps. A photo you pick is named by its iCloud Photos identifier, like a cover, or by this iPhone's own when iCloud Photos can't name it, and then only this iPhone shows it. When a day leaves a scrapbook, the photos picked for its page and its place in the order go with it. A title the on-device model suggests is saved only if you choose it, and then it is your title, like one you typed.
Describing a scrapbook happens on this iPhone. What you type or say to describe a scrapbook is read here, by Life So Far or Apple's on-device model, and is never saved. The book keeps only the rows it fills in, as if you had chosen them. With What's in your photos on, Apple's on-device model may also look at up to three of the book's photos to choose its cover; nothing it sees is saved.
Finding things is on-device. Find and Threads reach past exact words using Apple's on-device text model, which may download Apple's model files, never your words. Your entries become numbers stored encrypted on this device, never synced.
Each entry is read once, here. So your books, Patterns and Find can draw on everything you wrote, the on-device model notes what each entry is about: a few topics, the people and places it names, the feelings it voices. A name is noted only if it is in your entry. The notes are encrypted, stay on this device and are removed with the entry, whether you delete it here or on another device.
Place names come from the app itself. The names of the towns, regions, countries and continents you've explored, and every "near …" line, come from map data shipped inside the app (GeoNames, Natural Earth and the U.S. Census Bureau). No coordinate is ever sent anywhere to be named.
Files you bring in are read here. GPX routes, an imported map file and a backup you restore are read and stored on the device like everything else.
Unfinished writing stays local. Words you are still writing, and a recording you pressed Keep on whose save didn't finish, are held as encrypted recovery copies on this device. They never sync, are never in an export and are never read by the AI, and they are cleared when you save or discard.

What "encrypted" means here

Every file of journal data is encrypted with AES-GCM-256 before it touches disk. That covers all of it: entries, feelings and moments, the timeline (photo references and places), paths, explored cells, names, day summaries, card history, goals, Privacy Zones, and the search data Life So Far derives on the device.
The key is a random 256-bit key made on your iPhone and stored in iCloud Keychain, Apple's end-to-end encrypted store. It reaches your other devices through iCloud Keychain, which Apple itself can't read. It is never sent to any server, never logged, and never written into a file except a backup file you export yourself. The copy on this device is set to this-device-only: a backup of the phone can hold it, locked so that only this iPhone can use it. The copy iCloud Keychain carries between your devices, like your saved passwords, can be included in an encrypted computer backup, protected by that backup's password; so can your random ID, the trial date and, if you use Sign in with Apple, its identifier and your first name. Life So Far's files aren't in the backup (next point), so the key there opens nothing in it.
Life So Far's encrypted files are excluded from iCloud and computer backups of the device too. A new phone gets your journal back through your iCloud sync or a backup file you exported, not through a device backup. A backup file you open in Life So Far from Mail, AirDrop or Files leaves the folder that backups include as soon as it arrives, and Life So Far's copy is deleted when the restore finishes or you close it. Copies an earlier version left there are removed when Life So Far starts.
Life So Far's settings file. iOS keeps each app's settings in a file that every backup of the phone includes. Life So Far's holds your switches and choices, a random ID and bookkeeping, such as when each part of your journal last synced: never your words, places, trips or people. The places your map has counted, the dates of trips away from home, the map's chosen dates and last visit, the size and date of recordings moved to iCloud, and which of Today's maps have flown today are in encrypted files that never sync and stay out of backups.
When the key can be read. The key and every file of your journal can be read only while your iPhone is unlocked. When the phone locks, Life So Far finishes what it was writing and lets go of the key; seconds later iOS closes the files, Life So Far's copies of Apple Health data included. A locked phone gives forensic tools that copy it nothing of your journal they can open, even if it has been unlocked since it started. When you unlock it, Life So Far reads the key again. App Lock guards the app itself, not the files underneath it.

What syncs to your iCloud

Sync uses CloudKit's private database in your own iCloud account. There is no database of ours. What is uploaded is the already-encrypted file: Apple stores encrypted data it can't read, and the key stays in your Keychain.

Always synced, encrypted: your entries (with the place, if you turned on place tagging), the feelings, moments and notes you add, the words of your voice notes, the names you add to days and photos, the people you choose for the Album look and their birthdays, your custom scrapbooks (their titles, the days and places they hold, and the people they are for), what you choose for any scrapbook's pages (the photos you pick, their order, the pages you leave out, a cover and a cloth), your goals, your card history, and the list of places you cleared inside a Privacy Zone (so every device clears them; the zones themselves stay on the device you drew them on). The day summaries and daily questions Life So Far writes stay on each device, and each device keeps only the last 30 days of questions.

Gathered things stay on each device. Photos' places, walks and workouts with their routes, plans, sleep, mindful minutes and a State of Mind you log in Apple Health are not synced; each device gathers its own from your library, Apple Health and your calendar. Once a day Life So Far checks them against the source: a workout, mindful session, State of Mind or night of sleep you deleted in Apple Health, or a plan you deleted or moved in Calendar, leaves your journal (a workout with its route). A read that fails or comes back empty removes nothing, since Apple Health answers the same way when access is off. Sources → Health → Remove what Health brought in, and Remove what Calendar brought in while Calendar access or gathering is off, remove the rest. What you write on a gathered moment carries a little of it along, encrypted in your iCloud: a note on a photo, workout, plan or feeling travels with that moment's short summary ("A walk · 32 min · 2.5 km"), its time and its place (for a workout, where its route began) so it reads the same on each device. Earlier builds synced a State of Mind; this build takes those copies out of your iCloud, and a device that received copies from another offers once to remove them (Sources → Health).

Only if you turn it on (Settings → Backup & sync → Backup and Restore, off by default): your voice-note audio, and your map: logged paths, an imported map and the explored cells. Routes of workouts from Apple Health never go to iCloud; each device draws its own from Apple Health. You can also move a single recording to your iCloud to free space.

Never synced, under any setting: your Privacy Zones, what Life So Far works out on the device (the readings of your entries and photos, search data, weather, the places your map has counted, a day's summary), what you hid, unfinished writing, this device's photo links, and what this device remembers about your trips and your map. A backup file you export yourself carries your whole journal, Privacy Zones included, so a restore brings everything back.

The one thing about iCloud we don't control (metadata). Because sync uses CloudKit, Apple can see that encrypted records exist, how large they are, when they changed, and each record's name, which says what kind of data it holds (for a backed-up map, which month). Apple can never see what is in them: no words, no places, no feelings. Sizes are a rough hint that you write more or less. Turn off iCloud for Life So Far and none of this exists.

One small status record per journal. Next to the encrypted records sits a record, named from a one-way hash of the journal's random id, that says only whether the journal syncs between your devices, stays on one device, or was deleted, with random ids that tell a deleted journal from one restored later. Nothing from your journal is in it. Every device reads it before it syncs.

Keep this journal on this iPhone only (Backup and Restore, off by default). Turning it on checks that this iPhone holds its own copy of the key, stops sync, tells your other devices through the status record (they stop syncing and keep what they have, and offer to remove the journal from themselves), removes the journal's records from your iCloud, and only then removes the key's copy from iCloud Keychain. From then on nothing of the journal is in iCloud, and if you lose this iPhone or delete Life So Far the journal is gone unless you exported a copy. Turning it off puts the key back in iCloud Keychain and syncs again.

Location, exactly

Location is the most sensitive thing a journal touches, so here is the whole picture:

Privacy Zones (a circle you draw, such as home) are checked the moment a place is recorded: a path point, an explored cell, an entry's place tag, or the place of a photo, plan or workout inside a zone is never written. Zones never sync. A zone added later offers, after asking, to clear what is already saved inside it: the places of moments, the paths, the map's explored cells, an imported map, and the weather for that ~25 km square, for every day up to the clearing. The clearing itself syncs, encrypted, as an area and a date, so your other devices clear the same area, and nothing from iCloud, and nothing gathered again later (a photo, workout, plan, imported path or map dated before the clearing), brings it back. Ground you cover there afterwards is new ground.
The map is drawn and stored on the device. When the map takes your location to show the blue dot (opening it, the locate button, or while path logging is on), it also notes the ~22 m cell you are in, never the exact point, so the fog clears where you stand. Those cells pass the Privacy Zone rule first.
Path logging, place tagging and weather are each off until you turn them on. Logged paths stay on this device unless you turn on map backup, and then they go only to your own iCloud, encrypted.
You can delete your path history (Sources → Places → Path history), all of it or everything before a day you choose. Logged paths, imported paths and workout routes from before then go, with the places they cleared on the map. Ground with no date of its own is dated so the same rule applies: a Fog of World import by the day it was imported, a track without times by its file's date, and places explored before Life So Far saved dates by the day this version first saw them. Those dates sync, encrypted, and the earliest one wins. Deleting all of it removes everything. The deletion syncs, encrypted, as a date, so your other devices delete the same history, the copies in your iCloud are replaced, and nothing from iCloud or a path saved while locked brings it back. A backup file you exported before the deletion still holds what it held; restoring it brings that back unless iCloud carries the deletion to the restored journal. Workout routes stay in Apple Health, and Life So Far doesn't gather deleted ones again. Places on entries, photos and moments are not path history and stay. You can also keep path history for 1 year or 3 years: older history is then deleted each day the same way. Turning path logging off stops new paths and deletes nothing.
Paths logged while your iPhone is locked can't be written into your journal, because its key can be read only while the phone is unlocked. So each stretch, with the cells it cleared, is sealed into a file of its own with a public key that can add but never read (derived from your journal's key; it opens nothing). Points inside a Privacy Zone may be sealed too, when the zones themselves can't be read while locked; when you next unlock, Life So Far opens the files, removes every point and cell inside a zone, adds the rest to your map and deletes the files. Until then they wait on this iPhone, sealed, out of every backup. What a sealed file holds can't be read, but anyone with the phone's files can see when each was made, whether it holds a path, an entry or a feeling, and how large it is. Before the first unlock after a restart nothing can be sealed, and a walk then waits in memory for the unlock.
An entry's place tag syncs, encrypted. With place tagging on, an entry's place travels inside the encrypted entry to your own iCloud so it reads the same on your other devices. No one but you can read it, but the encrypted bytes do leave the device. For no location in your iCloud at all, leave place tagging and map backup off.
Weather is opt-in, off by default. With Local weather on (Sources → Places → Refine), Life So Far asks Apple Weather about the places your days held: the centre of a ~25 km square, at most 3 a day, never a place inside a Privacy Zone. A day keeps that square's weather, never the place itself, and loses it when you turn weather off on that phone or when the day falls outside How far back. A phone restored from a backup keeps the backup's weather; the switch starts off there, and nothing new is looked up until you turn it on. Off, no coordinate goes to a weather service.

Sharing

When you share a Scrapbook page, a map of a trip, a trip's stickers, a book's photo pages turning, or a card from your year or Patterns:

Life So Far draws the picture on your iPhone and shows it to you first. You choose what goes on it.
It goes only where you send it, through the iOS share sheet. Life So Far uploads nothing and keeps no copy. The file is written fresh, with no location or camera data in it, into a temporary folder that is deleted when the preview or the share sheet closes.
A video or GIF of a trip's map or a Scrapbook page is made the same way, on your iPhone, from the same picture: every frame leaves out everything the picture leaves out. It has no sound, no location and no camera data; a video holds only the moment it was made, which the video format requires. It is made only while Life So Far is open, and stops and is deleted when you change it, close the preview or Life So Far locks.
A book's photo pages turning (any Look back book, as a video or GIF) opens on the book's cover, with its name and dates, then turns its Scrapbook pages that have photos, each with only its photos and its date. A custom scrapbook's cover reads Scrapbook, not the name you gave it. Pages without photos and anything you wrote are left out.
A trip map is found from your own paths, the entries and moments you added, and photos taken with this iPhone. Apple Health, your calendar and photos someone sent you never place a trip. None of your paths, places or stickers is drawn within 35 km of your home. No path or explored spot is drawn inside a Privacy Zone or near where you slept on the trip, each widened a different, fixed way on each device so the picture can't be traced back to it. The map under it is a public map shipped in the app (Natural Earth), never Apple Maps.
A Scrapbook page shares its photos and its date. Its title and place are added only if you turn them on, and Life So Far offers them only for a page away from home that ended at least 2 days ago.
Cards from your year and Patterns hold no words from your journal and nothing from Apple Health or your calendar.
A photo from the photo viewer goes straight to the share sheet as a fresh copy of what you see: its pixels, without the place, time or camera data your library keeps with it, in a temporary file deleted when the share sheet closes. Videos and animated images aren't offered.
An entry (its long press, or More on its page) is shared as plain text: its words, the question it answered and its date. Never its place, a voice note or anything else from that day.
With App Store link on, Messages and Mail also get a plain link to Life So Far on the App Store, with nothing that identifies you or the picture. Messages may show a preview of that App Store page, fetched by Messages.
Don't want the suggestion after a trip? Turn off Trip pictures in Settings → Suggestions.

What the rest of your phone can see

Widgets show the look's colors, today's card, a question from Life So Far's own collection, how much of a place you chose you've explored, and what your look's widgets show from your journal: photos from today or from this day in an earlier year and how many you took today, a trip's town and day and your last trip's town and dates, the towns you've stamped this year and the day each was stamped, your latest routes as shapes with the town where each began, its date and its length as Life So Far measures it from the saved route, cut at your Privacy Zones (never Apple Health's own distance, climb or time, which Life So Far holds in memory only), this week's distance by day, this season's distance, how many stories you've written this year, which days this week hold a feeling (never which), and on Album's page the name of someone you chose, their age in years and months (never a birthday) and the photos you named them in. Today's page shows these for your focus. Never your words: the files hold no journal text, no photos and no coordinates; a photo is named only by its Photos id, and the widget asks Photos on your iPhone for it, never the network. Each is in the files only while a widget that shows it is on your iPhone, and none with App Lock on. These files can be opened while your iPhone is locked, after it has been unlocked once since it started, so what they name can be read by a tool that copies a locked phone; the list of places Explored offers is in a file your iPhone opens only while it's unlocked. On the Lock Screen a widget never shows a person's name, but it can show a count of photos or of days with a feeling, an age or a distance. To hide photos, towns, routes, names and percentages while your iPhone is locked, turn off Lock Screen Widgets under Allow Access When Locked in Settings → Face ID & Passcode. A feeling you add with a sticker or a word on a widget reaches Life So Far as a request iOS may keep its own record of, as it does for Siri. iOS keeps its own picture of each widget as drawn, and may keep the place you chose with the widget's settings. With App Lock on, every widget shows your cover's book in its color, closed: a picture with no name and no photo on it. The files then hold no places and no card, and Choose a Place offers no places.
Apple Watch shows the look's colors and type, today's card, and today's and tomorrow's questions from Life So Far's own collection, sent from your iPhone to your own paired watch. Nothing you wrote, no places, no counts. With App Lock on, your iPhone sends no card and no question, and the watch shows only that Life So Far is locked.
Spotlight never receives anything from your journal. Its index sits outside the journal's encryption, so searching your writing happens only in Life So Far's Find.
Notifications are made on your iPhone, never sent from a server. They carry a year ("You wrote something on this day in 2024"), that a report is ready, a general line inviting you to write, or, when you turn on the weekly story reminder, that week's question from Life So Far's own collection. Never an entry, a plan's name, a feeling or a photo.
Siri. When you use Siri or Shortcuts, Apple handles what you say before Life So Far sees it, and iOS keeps its own record of each request, outside Life So Far's encryption. That record can hold what you said: a thought you gave Siri, the feeling you named, the question you asked. Life So Far can't see or remove it. Life So Far's own answers never repeat your journal: it answers "Added." without repeating your words or your feeling, an entry Siri saved is named by its date, World Explored says only how much of the world you've explored, and Ask Life So Far opens Life So Far and shows the answer there instead of speaking it. When Siri asks Life So Far for an entry while your iPhone is unlocked and App Lock is open, it gets that entry's words, and iOS may keep those too; while your iPhone is locked or App Lock is closed, it gets only the entry's date. A thought you give Siri goes straight into your encrypted journal; a place Siri offers with it is not saved. While your iPhone is locked, a thought or a feeling you give Siri is sealed the same way as a locked walk and joins your journal when you next unlock it; before the first unlock after a restart, Siri asks you to unlock first. To change what Siri learns from Life So Far, go to Settings → Apps → Life So Far → Siri; Siri & Dictation History is in Siri's own settings.
The iOS keyboard belongs to iOS. Its own dictation key and Writing Tools work as Apple describes them; Life So Far's own microphone button is the on-device one above. The keyboard can learn words you type, in Life So Far as anywhere. Life So Far turns autocorrection off for Privacy Zone names, people's names, goals and Find questions, which keeps those out of what it learns. Other fields, such as a custom scrapbook's title and its place search, use the keyboard as every app does. To clear what it has learned: Settings → General → Transfer or Reset iPhone → Reset → Reset Keyboard Dictionary.

Everything that leaves your iPhone

Your encrypted journal, to your own iCloud: the synced parts, and with backup on, your voice-note audio and your map (see What syncs). Encrypted data only, in your own private iCloud.
The key, your identity and the trial date, through iCloud Keychain (Apple's end-to-end encrypted store). Your identity is a random ID made on your iPhone; the trial date is a date, never content. Sign in with Apple is optional and unlocks nothing: it only helps a new device find your journal. Its identifier and your first name stay in iCloud Keychain, and a record in your own iCloud links that identifier to your random ID, under a scrambled name.
Map pictures and search, to Apple Maps. To draw a map, Apple Maps is asked for the area on screen: the map tab while you look at it, the small map beside an entry, photo, walk or voice note, the maps in your books, the map at the top of Today that flies your trip's walks or your route, and the map you use to draw a Privacy Zone. Today's map asks for your trip's or your route's area when it flies: by itself once a day, and again when you tap Fly again. With Low Data Mode on, it asks only when you tap Fly. You can turn it off in Top of the page. A Scrapbook page that flies your walk asks for the walk's area when you turn to it, or a page or two before it so its map is ready (with Low Data Mode on, only when you tap Fly). When you type a place into the timeline's Where filter, those letters go to Apple's map search while you type. The request carries an area or your typed letters, never your words, and Apple Maps isn't tied to your Apple ID. The small maps are never drawn for a place inside a Privacy Zone, and the routes on any map are cut at your zones before it is drawn. A picture of a trip you share draws its map from the chart in the app, never Apple Maps.
Weather, to Apple Weather, only if you turn it on (see Location).
Your own photos, from your iCloud Photos, only when you tap Download. A photo whose original lives in iCloud Photos shows the copy this device has. Download full photo, or Download in a share's preview, asks Apple's Photos to bring that one original down from your own iCloud Photos. Nothing else is fetched.
Siri, when you use it (see above).
The purchase, through the App Store. Life So Far is free to try for 3 days, then one purchase unlocks it, through Apple's StoreKit directly. Apple sees a purchase, never your journal. There is no subscription, no payments company in between and no account with us.
What you send yourself, each through the iOS share sheet:
- A picture, video or GIF you share (see Sharing).
- An entry's words or a photo you share (see Sharing).
- A backup file (.alcovebackup): your encrypted journal and its key, so one file restores everything. The key is locked with a password by default: a six-word passphrase Life So Far makes (words from the EFF Short Wordlist, picked on the device). You choose where it lives. "Keep it in iCloud Keychain" saves it in Life So Far's own item in your iCloud Keychain, Apple's end-to-end encrypted store, where your journal key already roams; a restore on your other devices fills it in. It isn't in the Passwords app, and it reaches your other devices only when iCloud Keychain is on. "I'll write it down" shows it and asks you to type it back before the file is made, and stores it nowhere. You can also use a password of your own, or, after two questions, make a file with no password. No passphrase is ever sent to us; there is no website or server of ours involved. Keep the file as safe as the journal itself: without a password, a copy saved On My iPhone goes into computer backups of your iPhone, and a copy in iCloud Drive isn't end-to-end encrypted unless Advanced Data Protection is on. The share sheet doesn't offer Copy or Print for a backup file or a readable copy.
- A readable copy: your entries, feelings, notes, goals, names, custom scrapbooks (each one's title, question and days, and what you chose for its pages, by day), what you changed in the Scrapbook's pages, day summaries and card history as plain text (JSON), so you can take your writing anywhere.
- A technical report (Settings → About → Technical report): app and iOS versions, whether the AI is available, and counts from your last backup and restore. No journal text, photos, recordings, places, dates or identifiers. Creating it sends nothing; you choose whether to send it.
- An email to support, if you write to us. We see only what you put in it.
One iOS setting, not Life So Far's. If you turn on Share With App Developers in your iPhone's Privacy & Security settings, Apple may send developers crash reports and usage statistics for their apps, Life So Far included. Life So Far adds nothing to them and they hold nothing from your journal. Leave it off and Apple sends us nothing.

That is the entire list. The app has no other way to reach the network: no web client, no sockets, no web pages inside the app. A few links (Support, this policy, the sources of the map data) open in Mail or Safari when you tap them.

Your control

Export everything at any time, even without buying (Settings → Backup & sync → Backup and Restore → Export a copy). The readable copy holds recording transcripts, not audio, and isn't a restore format. If part of the journal can't be read, the readable export stops rather than leaving it out without saying.
Delete my journal everywhere (Backup and Restore). It offers an export first, asks you to type a word, then: marks the journal deleted in its status record, removes the journal's records from your iCloud, removes everything Life So Far saved on this iPhone (with the widget's copy and what the Watch shows), removes the key from iCloud Keychain and this iPhone, with the Sign in with Apple details in Life So Far and any copies left by an earlier version of the app, then every setting; the next time Life So Far opens, it starts fresh. Your other devices delete their copy the next time they open Life So Far. Backup files you exported keep opening with their passphrase, which stays in iCloud Keychain if you saved it there. The status record stays, with nothing from your journal in it. Without an iCloud account on this iPhone, only this iPhone's copy goes. A journal you restore from a file afterwards is a new start, never deleted by the old record.
Deleting the app is not the same. It removes Life So Far's files on this iPhone, but not the journal key or your sign-in details, which iOS keeps in this iPhone's keychain and in iCloud Keychain, and not your encrypted iCloud copy. Use Delete my journal everywhere for that.
App Lock with Face ID, Touch ID or your passcode, and a veil that hides the journal in the app switcher. Anything open when Life So Far locks (a page, a photo, a map, a share sheet) closes or stays covered until you unlock. The veil wears your cover (Settings, Your cover): the name and the photo you choose for it show there to anyone who sees your screen while Life So Far is locked. They are saved encrypted on this iPhone and in its backups, are not synced, and never appear on a shared picture. The cover's painted book is drawn ahead and saved in this iPhone's caches so the veil is there at once: the book and its color only, never your name or your photo, which are added as the veil shows.
Privacy Zones for places that should never be recorded.
Each source is off until you turn it on: Photos, Places, Health, Calendar and Voice notes, each explained before iOS asks. How far back (Sources) limits how much of your past Life So Far gathers.
Hide anything from your timeline, books, map and shares.
Choose what backs up (Backup and Restore), and turn off Trip pictures, Photos to name or Card reminder (Settings → Suggestions).

Children

Life So Far has no accounts and collects nothing from anyone, children included: what a child keeps stays on their device and in their family's own iCloud, encrypted, exactly as described above. If you are under 13 (or under the age of digital consent where you live), please use Life So Far with a parent or guardian. If a child writes to us, we use the message only to reply, and a parent can ask us to delete it.

When you write to us

Email to support@meetalcove.com is the one way anything about you reaches us: your email address and whatever you choose to write. We use it only to answer you. We never use it for marketing, never sell or share it, keep it only as long as we need it to help you, and delete it when you ask. You can also ask us what we hold or to correct it, at the same address.

The website (lifesofar.app) sets no cookies and loads no trackers or analytics. Our web host keeps ordinary server logs, such as IP addresses, to deliver and protect the site; we don't use them to identify or track anyone. Because nothing tracks you, there is no Do Not Track or Global Privacy Control signal for us to act on: every visitor already gets that treatment.

Who we are, and changes

Life So Far is published by Sand Collective LLC. Questions about privacy, or any request about data we hold, go to support@meetalcove.com. If this policy changes, the date at the foot changes with it, and a change to what leaves your device will be stated here before the app does it.

Open edges (named, because a privacy story should name its seams)

Apple Health in your iCloud copy. Only what you add yourself to something from Apple Health (a note on a workout or a feeling) reaches your iCloud, encrypted, with that moment's short summary, time and place. A State of Mind and a workout's route stay on the device (build 55).
Place tags in sync. A tagged entry's place syncs encrypted to your own iCloud (see Location). For none, leave place tagging and map backup off.
CloudKit metadata. Inherent to iCloud sync, described above.
Your journal on an unlocked phone. The key and the files can be read only while your iPhone is unlocked (see When the key can be read). While it is unlocked, a tool that copies the whole phone can read what Life So Far can, as it can for every app on it.
Keeping the journal on one device. Keep this journal on this iPhone only (build 64) takes the journal and its key out of iCloud. A device on a build older than 64 doesn't read the status record: it keeps syncing and can put its copies back, so update every device first. The iPhone that keeps the journal takes the key out of iCloud Keychain again each time it is unlocked.
A build check that keeps server code out. Planned: a check that fails the build if a server SDK ever becomes part of the app.
Some things outlast their source. Turning Calendar or Health off stops new gathering without removing what they brought in (Remove what … brought in does that). A deleted entry or moment takes the lines Life So Far wrote from its day with it (the day's summary, the reports and Noticed lines that cover it, a Scrapbook page's words); words written from a day that changed in other ways go once that day is read again. What was heard around a voice note stays after the Voice notes source is turned off. Planned: a way to delete it. Path history can be deleted (see Location, exactly); turning path logging off still deletes nothing by itself.

Last checked against the code: 2026-10-20 (build 90: the name Life So Far and the Voice notes source; build 85: what a scrapbook saves of your choices, the Scrapbook's own included, and a suggested title only once you choose it; build 64: Delete path history, Delete my journal everywhere, the journal's status record in iCloud and Keep this journal on this iPhone only; build 52: sharing pictures and trip maps, the technical report, what Apple Health puts in your iCloud copy, the Privacy Zone map, what a day's summary may mention, the widget file and the Suggestions section; build 53: what Siri, the widgets, the keyboard and the export's share sheet can keep, what Life So Far's settings file holds, a backup file opened in Life So Far, what is removed with its source and what is not yet, how the key rides a backup of the phone, and what deleting the app leaves; build 55: the key and the files readable only while unlocked, what a locked walk and Siri seal and what a sealed file shows, Apple Health out of iCloud, deletions in Health and Calendar mirrored, cleared Privacy Zones held on every device and against gathering again, what a note on a gathered moment carries, and the backup file's passphrase; builds 56 to 63: videos and GIFs, a book's photo pages turning, sharing an entry's words and a photo, the pictures' temporary files, a custom scrapbook's saved days, and the keyboard in a scrapbook's fields; build 64: deleting path history and keeping it for a while). Keep this document honest: if the code changes, change this first.