That is not a policy choice made to sound good; it is how the app is built. Until you connect something, there is nowhere for your data to go, because there is nothing of ours for it to go to. The exceptions are a routine you publish, a connection you make, and a picture from our site in a routine you open, all below.
What is stored, and where
Routines, runs, notes, values, records and settings are written to files inside the app's own container on your device, and shared with its widgets, its watch app, and its share sheet and Messages extensions on the same device. They are included in your device backup if you have one, which is between you, Apple and your backup — we never see it.
If you turn on iCloud in the app's settings, the same files are kept in sync between your own devices through your private iCloud database. That database is yours and Apple's: it sits in your iCloud account, under your Apple ID, and we have no way to open it. It is off until you turn it on.
If you publish a routine, that one routine is also kept in iCloud's public database for this app, where anyone with its code can read it and we can see it. More on that below.
If you make a connection — an address another system can send to — our relay keeps that address and what it needs to reach your phone, and nothing it can read of what is sent through it. More on that below too.
We collect nothing about how you use the app. There is no usage tracking, no crash reporting, no advertising and no profiling. What we can see is a routine you chose to publish and the addresses you made for connections. The app ships no third-party code, so there is nobody else in it to collect anything either.
The only ways anything leaves your phone
Every one of them is something you set up, ask for or open yourself. Three of them end up anywhere we can see: a routine you publish, a connection you make, and a picture from our site in a routine you open.
A webhook you configured
A step can send a request to a web address you typed in, or to a service you picked from the list in the app — Discord, Telegram, Pushover, Google Chat, Healthchecks.io, Zapier — at that service's own address. It goes there and nowhere else, carrying only what you put in it, and the key it needs stays in this phone's keychain. If you never add one, and nothing you open shows a picture by address or a link’s preview, the app itself makes no network requests of its own.
A picture with a web address
A note or a description can hold a picture. Normally that is a photo in your library or a file on this phone, and it is kept as the place of the picture rather than a copy, so nothing leaves. You can instead give a web address for one — which is the only kind that still shows for somebody you send the routine to — and then the picture is fetched from that address, by this phone, each time it is drawn. That server sees what any server sees from a request for an image: your network's address and the time. It goes to that address and nowhere else, and the app sends nothing about you with it.
A routine somebody sends you, a code you open in the app, or an assistant’s
suggestion can hold a picture by address too, at an address its author chose. From
version 1.3, until you add or start the routine such a picture is drawn as a button,
and nothing is fetched unless you press it; where there is room, the button names the
server it will ask. A picture on routinerun.com loads by itself, as in the
App Clip. Once you add or start the routine, its pictures load like your own. Version 1.2 and earlier fetch
them as soon as they are drawn, which can be on the screen where you decide whether to
add a routine, once you open its steps, so that server learns your network’s
address and the time even if you add nothing.
A note written through a connection you made is yours, and its pictures load like your own, from the address in it.
Opening a link value’s page, or sharing a link into the app, asks that page for its title and picture, from that page’s own address.
A shortcut or another app
A step can run a Shortcut, or hand something to another app you chose. What happens after that is that app's business and its own privacy policy.
An assistant you ask
The app can write a routine from a sentence with Apple Intelligence on your phone. That model runs on the device: what you type is not sent anywhere.
On iOS 27 it can instead ask Apple's cloud model, which runs on Apple's Private Cloud Compute. What you ask is used to answer and is not kept, and Apple says nobody there can see it. It holds what you typed and, when you ask about one, that one routine, step or run.
When you ask Siri about a routine or a run — Ask Siri on a row, or "this" on its page — the app hands Siri the text of that one routine or run: its name, its steps and where the run stands. What Siri does with it is covered by Apple's own privacy terms, including when you have chosen ChatGPT or another assistant in Siri.
When you send a request to ChatGPT, Claude or another assistant from the share sheet, or build a shortcut with Apple's Use Model action, the request goes to the service you picked, and what it writes back comes to the app. It holds what you put in it and, when you ask to change one, that one routine. The service's own privacy policy applies to it. Nothing is sent this way unless you send it.
A routine you share
A shared routine is carried inside the link itself rather than uploaded anywhere, which is what lets it work with no account and no server. Whoever you send it to can read it, the same as any message you send — so treat a routine link like the message it travels in.
A routine you publish
You can publish one routine under a short code, for a sign or a QR at a door. Only when you press Publish, and only that routine. It goes to iCloud's public database, under your iCloud account, and stays there until you press Unpublish.
Anyone with the code can read it. Apple keeps it, and we can see it in iCloud's developer console, because that is how a public database works. With it, iCloud stores an identifier for your iCloud account. It is a random string, the same for every routine you publish, and it is what lets only you change or take it down. It does not tell us your name or your Apple ID. Anyone who opens one of your codes can see that identifier too, so they could tell that two codes came from the same account. The app uses it for that alone, to let them block you on their phone.
Only the steps are published: the routine's name and description, and each step's name, description, duration, mark and the time of day it is set to, with the buttons a visitor can press: a web page to open (https only), a number to call or text, an email address to write to, and words to copy. Anyone with the code can see where each one goes and what it copies. They wait for a press and run nothing on their own. No other actions, values, notes, places, tags or triggers go, no address with a value in it, no calendar date, and no step you turned off. So publish a routine you would put on a sign.
Unpublish deletes it for everybody. The code is remembered only on the phone you published from, so if you delete the app or lose that phone, write to support@routinerun.com with the code and we will take it down. Opening a code writes nothing.
Anyone who opens a code can report it. Report writes an email to support@routinerun.com from their own Mail, with the code in it, and we take down a routine that breaks the rules. The app sends nothing itself. In the app they can also block whoever published it: every code from that iCloud identifier then stops opening on their phone. The list of blocked identifiers stays on that phone and goes nowhere. Before anything is published, and again when a code is opened, the phone checks its words against a short list of slurs and strong profanity, and will not publish or show a routine that carries one.
A connection through our relay
In Settings › Connections you can make an address another system can send to — a pager, a queue, a script of your own — so it can start or move a routine on your phone. Nothing goes through our relay until you make one.
Making the first one registers your phone with the relay, once, proving with Apple's App Attest that it is this app on a real iPhone. The relay keeps that address, the name you gave it, when it was last used, a token Apple gives us for sending to your phone, and a fingerprint of the secret that goes with the address, not the secret itself. No routine, no run and nothing a run collected is sent to it.
What the other system sends is passed to your phone and not kept: we hold it only until Apple has accepted it for delivery, and Apple holds it until your phone is reachable, for a day at most. Something too long for one notification — a routine an assistant wrote, a run of thirty steps — waits on the relay instead, locked with a key made for it alone. The key goes to your phone inside the notification and is never stored by us, so what waits is something we cannot read. Your phone fetches it once and it is deleted; if it never does, it is deleted when the request expires, an hour later for a run and a day for anything else. It shows on your phone as a notification. When your phone has done what was asked, it tells the relay in one word — done, refused, too old — so the sender can check, and that word is deleted after about an hour. Remove an address in the app and we delete it; remove the last one, or use Turn all off, and we forget your phone too. If you delete the app instead, we forget your phone the next time something is sent to one of its addresses.
An assistant you connect. Claude, ChatGPT or another assistant that speaks MCP can be connected the same way: it shows a code, you type it on your phone, and there is no account. When it asks something — your routines' names, one routine's steps, where a run stands — your phone answers that question and nothing more, and our relay passes the answer on and deletes it. It can start and move runs and write notes and values, like any connection. A change it suggests to a routine waits on your phone until you look at it and save it. What the assistant does with what it read is covered by its own privacy policy. Remove it in Settings › Connections and it is signed out at once. Signing in with Try with a demo library connects it to a made-up library on the relay instead, and nothing of yours. It does not see a run's notes or values unless you turn on Read notes and values on its page in Settings › Connections; with it on, they go with a run's answer when the assistant asks about that run, are passed on by the relay without being kept, and stop the moment you turn it off.
An assistant writing you a routine. An assistant can also use a part of the relay that needs no connection at all: it sends a routine it wrote and gets back a link that opens it in the app. The routine is turned into that link and forgotten — it is not stored and not logged — and the link carries it in the address itself. Nothing is saved on your phone until you look at it and save it.
The relay runs on Cloudflare, and Apple delivers what it sends to your phone. Cloudflare sees your phone's internet address when it asks the relay something, as any web host does; the relay does not store it, and its logs say which kind of request came and how it was answered, never what was in it. Neither of them, nor we, can use it to tell who you are: there is no account to tie it to. Apple's privacy label calls the token a device identifier linked to you, because it is one; it is tied to no name, no email and no account.
A code you scan
The App Clip is the small part of Routine Run that opens from a code at a counter or a door, with nothing to install. It keeps nothing: the walk lives in memory and is gone when you close it.
Some codes carry the steps inside them, like a shared routine, and nothing is fetched for them, apart from a picture, below. A published code is read from iCloud's public database, anonymously, and the clip says it was published with Routine Run, since nothing has checked who published it. A code from an organisation can point at its own website instead. Then the clip asks that site for one file, the routine, and shows the site's name on it, so you can check it against the sign in front of you.
A step can show a picture. The clip draws one only when it is on
routinerun.com, our own site, and fetches it from there as the step comes
up. Our host on Cloudflare then sees what any web server sees: your network’s
address, the time, and which picture it was, so which routine. It carries no cookie and
nothing about you; like any app’s request, it says it was Routine Run asking, on
which iOS, in which languages. We keep no log of these requests, and the site’s
Web Analytics runs only on its web pages, never on a picture. Cloudflare counts the
traffic in totals for its own dashboard, as it does for every site it hosts, and lists
a request on its own only if one of its security rules stops it. In the clip, a picture
from anywhere else is shown as its words, so no other server hears about your visit.
Opened in Routine Run instead of the clip, a code is a routine like any other, and its
pictures are handled as under “A picture with a web address”.
A button on a step opens what the publisher put there (a page, a call, a message, an email) only when you press it. That site sees what it would see from any browser, and may keep its own cookies in the App Clip until iOS removes it. Copy puts the words on your clipboard.
Opened in a browser instead, a published code’s page asks iCloud for the same public record from our host and writes the steps out, so a phone without the App Clip can read them too. Apple sees our host on Cloudflare asking, not you. The page keeps nothing from it; the visit is counted like any other page view, below.
A request to an organisation goes to the organisation, never to us, apart from a picture
on routinerun.com, above. It carries no cookie and nothing
about you. Their server sees what it would see from any app or browser asking for a
page: your network's address, the time, and that it was Routine Run asking. What they
do with that is covered by their own privacy policy. A code only opens the clip for an
address we have registered, so a code for a site we do not know does nothing.
The one organisation we run ourselves is the demo, org-demo.pages.dev: a
made-up office that stands in for a real one's website so the clip can be tried. It
has no analytics and no script on it.
Opening routinerun.com in a browser is an ordinary web request to our
host, like any web page. The app itself calls this site only for a picture a routine
shows from it, as above. The site counts its
own page views through Cloudflare's cookieless Web Analytics — no cookies, nothing
that follows you elsewhere, nothing that identifies you. That is the website measuring
itself, not the app, and not analytics on you.
What each permission is for
iOS asks before granting any of these, and it asks when a step first needs one rather than at launch. Everything below happens on your device. Declining any of them leaves the rest of the app working.
- Health — reads workouts only, so a routine can be offered when one ends. A step can write what you just did: a glass of water, minutes sat still, what the scales said. Only what the step says, only when the run reaches it.
- Home — reads the names of your scenes so you can pick one, and runs only the scene a step names.
- Location — starts or offers a routine when you arrive at or leave a place. Where you have been is read on this phone and never leaves it.
- Calendars — writes scheduling events. Routines write with write-only access; full access is asked only so you can choose which calendar, which means reading the list of their names and nothing else.
- Reminders — used to schedule routines and trigger them by place, and, where you ask for it, to put a step's deadline in your list. The app then reads whether you ticked the reminders it wrote, and nothing else in your lists.
- Photos — a note keeps the place of a photo rather than a copy, so it needs to find it again. Nothing is read until you pick one, and nothing is copied out of Photos.
- Camera — scans a serial number, a barcode or a meter reading straight into a value. It runs only while that screen is open, and nothing is photographed or kept.
- Focus — reads whether any Focus is on, and nothing about which one, so the app can show fewer routines while one is running.
- NFC — writes a routine's link onto a tag you chose to write.
- Notifications and alarms — how a routine reaches you, including through Focus and the silent switch for steps you asked not to miss.
Events sent to the app
Routine Run can accept events from other systems you connect to it — a monitor, an automation, another app. Those arrive because you set that up, are stored on your device like everything else, and are not forwarded anywhere. One that comes by a connection passes through our relay on the way, as described above, and is not kept there in a form we can read.
Children
Routine Run is not directed at children and collects no personal information from anyone, of any age.
Changes
If this ever changes, the date at the top changes with it. Anything that would mean collecting data we do not collect today would be said here first, plainly, and in the app.
Asking us
Write to support@routinerun.com.
Apart from a routine you published and the connections you made, nothing is collected, so there is no account to close and no export to request. We will delete a published routine if you send us its code. Removing a connection deletes what the relay kept for it, and removing the last one forgets your phone. Deleting the app removes what it stored on your device, and the relay forgets your phone the next time something is sent to it — but not a routine you published: unpublish it first.