Plain-language summary

Commitments is a habit tracker that uses your iCloud account to store your data. There is no backend service we operate. We do not run analytics, do not include third-party SDKs, and do not sell, share, or have access to anything you put into the app.

The rest of this page explains the same thing in more detail, the way Apple's App Store requires.

About this website

The pages at commitments.app are a static marketing site, separate from the iOS app. The data picture for visiting these pages is simple:

Privacy-friendly analytics. We use Umami, an open-source analytics tool that we self-host on the same Hetzner server as the website. No third party is involved. Umami records aggregate page views, referrer (where you came from), screen size, and a country derived from your IP (the IP itself is discarded after that derivation, never stored). It does not use cookies, does not assign you a persistent identifier, and does not track you across sites. No analytics from Google, Plausible cloud, Fathom, Mixpanel, Meta Pixel, Microsoft Clarity, or Hotjar are ever loaded.
Your right to opt out. Browser-level Do Not Track is respected. You can also block the analytics endpoint directly via uBlock Origin or any similar extension by blocking analytics.commitments.app. The rest of the site continues to work normally.
No cookies. If you toggle the theme (light/dark), that preference saves into your browser's localStorage so it persists on your next visit. localStorage never leaves your device. The language (EN/DE) is reflected in the URL, not stored.
No third-party scripts or CDNs. All assets (fonts, scripts, images, the analytics tracker) are served from domains we control on the same Hetzner server. We don't load anything from Google Fonts, jsDelivr, Cloudflare CDN, Stripe, Intercom, or any third party.
Server logs. Like every web server, ours records each request your browser makes: timestamp, requested URL, response status code, User-Agent, and IP address. These access logs are kept on the server for at most seven days for security debugging (e.g. investigating brute-force attempts) and are then automatically rotated. They are never shared, aggregated, or used for analytics.
Hosting. The site runs on a single Hetzner Cloud VPS in Falkenstein/Nuremberg, Germany. Hetzner is the data processor (GDPR Art. 28) for the IP-address-in-log-files matter. Their data processing agreement is at hetzner.com/AV.
TLS. All traffic is HTTPS, encrypted end-to-end. The certificate is issued by Let's Encrypt and publicly verifiable via the Certificate Transparency log at crt.sh.
No contact forms or signups. The only way to reach us is the email address at the bottom of this page.

The rest of this policy concerns what happens when you actually install and use the iOS app, which has a much larger data picture. Almost all of it stays between you and your own iCloud account.

What Commitments collects

When you use Commitments, the following information is created and stored in your personal iCloud account:

The title, emoji, color, recurrence, and notes of each commitment you create
For commitments you track by quantity rather than as a yes/no (e.g. glasses of water, pages, minutes, reps): the unit, the daily or total target, and the per-tap step size you chose
A record of each time you tick a commitment off as complete, including the amount you logged for quantity-tracked commitments
Photos you choose to attach to a commitment (see "Photos" below)
Nudges you send to or receive from other Circle members. Each carries the sender's display name and avatar, the recipient, the commitment it concerns, and a timestamp (see "Nudges" below)
The Circles you create: a name, color, emoji, and the list of members
Activity records inside each Circle: short rows describing recent events like "Maximilian ticked Drink water" or "Anna joined the circle", used to render the Circle's activity feed (see "How sharing with other people works" below)
Sparks ledger entries: small records of in-app points credited or revoked when you complete a commitment or undo a tick, and records of Streak Freezes you purchase or apply (see "Sparks and Streak Freezes" below)
Per-commitment streak counts: how many consecutive days or weeks in a row you've completed each commitment
Your display name, the avatar (emoji or photo) you set in your in-app profile, and an Apple-issued user identifier obtained through Sign in with Apple
Your "Vibe": a personal setting (from gentle and forgiving to focused and firm) that controls how the app phrases its own encouragement, reminders, and rules toward you about your commitments, plus any fine-tune overrides. It syncs across your devices and is never shared with other Circle members.
Whether you currently have a Commitments+ subscription or the lifetime purchase, i.e. your entitlement status. We store only that status, never any payment details (see "Commitments+ (paid subscription)" below)

We do not collect:

Your email address (Sign in with Apple gives us only a stable identifier unless you choose to share your email; we never use that information for anything other than Apple-mandated authentication)
Your location
Your contacts
Device identifiers, advertising IDs, or any tracking data
Crash reports, telemetry, or analytics events

Where your data lives

Everything you create in Commitments is stored in two places:

On your device, inside the app's local database
In your iCloud account, in a CloudKit container reserved for Commitments

If you've installed the optional Apple Watch companion, a small working copy of today's commitments also lives on the paired Watch, mirrored from your iPhone over Apple's on-device WatchConnectivity framework, not over the network (see "Apple Watch companion" below).

Apple manages the iCloud storage. We do not operate any server that holds, processes, or has access to your commitments, your entries, or your circles. The developer cannot read your data.

If you sign out of iCloud, delete the app, or sign out of Sign in with Apple, the local copy on the device is removed. iCloud copies remain under your control through your Apple account settings.

How sharing with other people works

Circles let you share commitments with another person. Sharing happens through Apple's CloudKit Sharing:

You create a Circle on your device
You generate an invitation link (a CKShare URL hosted by Apple)
The recipient taps the link and the Circle's data becomes visible in their app

The invitation link points to Apple's iCloud servers. We do not see the link, the participants, or the contents. Recipients must have an Apple ID and the Commitments app installed; they accept on their own device.

When you join a Circle, the display name on your iCloud account becomes visible to other members of that Circle, so they can see who is participating. This information is provided directly by Apple's CloudKit Sharing between iCloud accounts. Commitments doesn't transmit or store names on any server we operate. You control the name your iCloud account exposes via iOS Settings → [your name] → Name, Phone Numbers, Email.

If you customise your in-app profile (display name, emoji avatar, or photo avatar), that customised information is shared with the other members of any Circle you belong to, so they can see who ticked a commitment or attached a photo. Your in-app profile photo is not your iCloud profile photo (Apple doesn't expose that to third-party apps); it's the picture you explicitly chose in the app's profile sheet. You can change or remove it at any time and the change syncs to other Circle members within a few seconds.

You can stop sharing at any time from inside the Circle's settings.

Activity feed inside a Circle

Each Circle has a "Recent activity" view inside its details sheet that shows the last few member actions: a tick on a commitment, a join, a leave, a photo attachment, a nudge. These actions are recorded as small Activity rows in the Circle's CloudKit shared zone, so every member sees the same feed. Each row carries the actor's display name and avatar, what they did, the commitment it concerns (when applicable), and a timestamp. Activity rows are visible only to members of that Circle; they're not synced anywhere else and are deleted along with the Circle if you delete it.

Pacts

A Pact is a one-to-one commitment you make with one other person, a shared daily promise that both of you tick to keep. A Pact is just a commitment shared between the two participants through the same Apple CloudKit Sharing mechanism described above, so the same rules apply: each participant can see the shared commitment, whether the other kept it, and the related activity; the data lives in your two iCloud accounts, not on any server we operate; and either person can leave. Inviting someone to a Pact, or accepting one, is always free.

Photos

Commitments lets you attach photos to a commitment, for context ("here's what I want to track") or as proof you completed it. Photos follow the same storage rules as the rest of your data: they live in your iCloud account, and if the commitment belongs to a Circle, they become visible to every member of that Circle through Apple's CloudKit Sharing. The developer never has access to them.

To pick or take a photo, the app uses two iOS APIs:

Photo library. The app uses Apple's privacy-preserving photo picker (PHPickerViewController), which presents the system picker in a separate process. The app only receives the specific photos you pick. It cannot browse, list, or scan the rest of your library, and no library-access permission prompt is shown.
Camera. Taking a photo in-app uses your device's camera. iOS shows a permission prompt the first time; you can revoke camera access at any time in iOS Settings → Commitments.

Photos you attach are downscaled (max 1280 px on the long edge) and JPEG-encoded before they sync to iCloud, to keep storage and bandwidth modest. Each attached photo also carries the display name and avatar of the person who attached it, so the other Circle members can see who contributed it.

You can delete a photo you uploaded at any time from inside the photo detail view; deletion syncs to all Circle members. Photos uploaded by other Circle members can't be deleted by you (only by the original uploader, or by deleting the parent commitment).

Nudges

Inside a Circle you can nudge another member about one of their commitments. It's a friendly "hey, do this" cue. Sending a nudge creates a small record carrying your display name and avatar, the recipient, the commitment, and a timestamp. It syncs through the same CloudKit shared zone as the parent Circle, so the recipient's device receives it through the same path used for ticks and other circle activity. On the recipient's device the nudge surfaces as a local notification and, on next foreground, a one-tap sheet.

The developer doesn't operate any push or relay server; nudges are delivered entirely through Apple's CloudKit. Nudges that belong to a Circle you leave become invisible to you on that device.

Sparks and Streak Freezes

Commitments has a small in-app gamification layer. Sparks are a point currency you earn for completing commitments: a few sparks for each tick, a larger bonus for finishing a habit's week or for hitting a team-confirmation goal in a Circle. Streak Freezes are an in-app consumable bought with Sparks that protects a habit's streak on a single missed day.

There is no real money in the Sparks economy. Sparks and Streak Freezes are not in-app purchases: you can only earn Sparks by using the app, you can't buy them, and there is no link between your iCloud Sparks balance and your Apple-ID payment methods. (Commitments does offer one optional paid subscription, Commitments+, which is entirely separate from Sparks and is described in the next section.)

What's stored:

A small Sparks ledger of credit and revoke entries (e.g. "+5 for completing Drink water this week"). Used to compute your current balance and to make tick crediting idempotent so an un-tick reliably refunds the right amount.
A separate record for each Streak Freeze you've purchased or applied to a specific commitment-day.

Both records live alongside the rest of your data in your iCloud account. They sync to your other devices but are not visible to other members of any Circle you belong to. The Sparks economy is per-user, not per-circle.

Commitments+ (paid subscription)

Commitments is free to use. Commitments+ is an optional paid upgrade for people who want to host their own shared groups: creating your own Circle and being its host requires Commitments+. Everyone you invite uses those features for free. Joining Circles, ticking, attaching photos, sending nudges, and making Pacts with you all work without paying. (We call this "host pays": one paying host, any number of free guests.)

Commitments+ is sold through Apple's App Store / StoreKit as a yearly subscription (with a 14-day free trial), a monthly subscription, or a one-time "lifetime" purchase, and it supports Family Sharing so one purchase can cover your family group.

How this affects your data:

Apple processes the payment, not us. All billing happens through your Apple ID. Commitments never sees or stores your card number, billing address, or any payment details. Apple handles all of that.
What we store is only your entitlement status, whether you currently have an active subscription or the lifetime purchase. The app reads this from Apple's StoreKit on your device and caches it locally so it knows which features to unlock. It's tied to your Apple ID, not to a server we operate.
Subscriptions renew automatically through your Apple ID until you cancel. You manage, change, or cancel a subscription, and request refunds, in iOS Settings → [your name] → Subscriptions, the same place you manage every App Store subscription. Deleting your Commitments data (see "Your rights") does not cancel a subscription, because the purchase belongs to your Apple ID.

Apple Watch companion

If you've installed the optional Commitments app on your Apple Watch, the Watch mirrors today's commitments from the paired iPhone so you can tick them off from your wrist.

Communication between iPhone and Watch happens entirely on-device through Apple's WatchConnectivity framework. There's no network call, no third-party service, and the Watch app never talks to iCloud directly. When you tap a commitment on the Watch, the tick is forwarded to the iPhone over WatchConnectivity, and the iPhone's app applies it through the same path used for an in-app tap (so it syncs to your iCloud and to any Circle members who share that commitment).

The Watch app reads only what's needed to render today's list: title, emoji, color, and current progress per commitment. If you don't install the Watch app, no Watch-related data is ever created.

Home-screen widget and Live Activity

Commitments ships an iOS home-screen widget that shows today's commitments and lets you tick them off without opening the app. The widget reads its data from a snapshot stored in a private container that's shared between the app and the widget extension on your device. No additional data is sent anywhere. The widget is rendered entirely on-device from data already in your iCloud-synced store.

The optional Live Activity (off by default; you can enable it in Settings → Notifications → Live Activity) shows today's progress on the Lock Screen and in the Dynamic Island, with a "streak at risk" state late in the day if you have a habit-streak that would break. The activity is rendered on-device from the same data; nothing is sent to a server, and no additional information is collected to power it.

Notifications

Commitments uses three kinds of notifications, all delivered by Apple:

Local reminders that you set per commitment. These are scheduled on your device and never leave it. If you tick a commitment off before its reminder fires, the app cancels the no-longer-needed reminder for that day automatically, without any network call.
Streak-at-risk reminders. Late in the day, if you have a habit-streak that would break unless you tick the commitment before midnight, the app may post a single nudging local notification ("Drink water. Keep your 12-day streak"). This is computed entirely on-device from your existing data and scheduled through the same local-notification system as the reminders above. It never involves a server and never leaves the device.
Circle activity notifications when another member of one of your Circles ticks off a commitment, accepts an invitation to a Circle you own, ticks a "needs everyone to confirm" commitment that you haven't ticked yet today, or sends you a nudge about a commitment. Apple's CloudKit silently wakes the app on your device when a circle teammate's record syncs in; the app then posts a local notification on your device with the news. The developer doesn't operate any push server and has no role in composing or delivering the message.

You can turn off notifications at any time in iOS Settings or inside the Commitments app under Settings → Notifications.

Children

Commitments is not directed at children under 13. We do not knowingly collect data from children, and the app's Sign in with Apple requirement enforces that an Apple ID is needed to use it.

Your rights

Because we never have a copy of your data, requests to access, export, or delete it are handled on your own device and through Apple:

Delete your account and all data in the app: open Settings → "Delete Account and All Data." This removes you from any shared Circles, deletes the commitments, photos, Circles, activity, nudges, Sparks, and profile you own (the deletion then propagates to your iCloud), and signs you out. It does not cancel a Commitments+ subscription; that belongs to your Apple ID, so cancel it separately in iOS Settings → Subscriptions.
Export: iCloud → settings on any of your Apple devices
Delete (alternative): deleting the app removes the local copy; signing out of iCloud or removing the Commitments container from iCloud → Manage Storage removes the cloud copy
Stop using Sign in with Apple: Apple ID → Password & Security → Sign in with Apple → Commitments → Stop Using

We honor these as soon as Apple's services propagate the change.

Changes

If we ever change how Commitments handles data (adding analytics, syncing through a service we operate, etc.), we will update this page with a new effective date and surface the change inside the app before the new behavior takes effect.

Contact

For privacy questions, write to:

gueth.maximilian@googlemail.com