Datum

Privacy Policy

Last updated July 26, 2026

Datum is built around a simple rule: your data is yours. There is no Datum account, no sign-up, and no server of ours that stores what you track. This page explains exactly what that means, including the narrow, deliberate exceptions.

The short version

• No accounts. No sign-up. Nothing to link to your identity.
• Everything you track lives on your device and syncs only through your own private iCloud account, using Apple's CloudKit. We never receive, see, or have access to it.
• The only server we operate stores no tracker data of any kind — see "The one server exception" below. Its code is public so you don't have to take our word for it.
• Optional backups are written to your own iCloud Drive or device — never to us — and data mirrored from Apple Health is left out of them entirely.
• In-app purchases are anonymous, identified only by a random, non-personal token.
• Datum is not directed at children and does not knowingly collect data from anyone under 13.

What Datum stores, and where

The trackers, entries, check-ins, notes, photos/video references, and settings you create in Datum are stored locally on your device. If you're signed into iCloud, they sync across your own devices via Apple's CloudKit private database — the same mechanism Apple's own apps use, governed by Apple's privacy policy. We do not have a copy of this data, cannot read it, and have no way to access it even if asked.

Optional attachment types (photos, videos, voice notes, calendar events, weather, music, workouts, location) are captured only when you explicitly enable them for a tracker, and are stored the same way — locally and in your own iCloud, or as on-device references (e.g. a photo stays in your Photos library; Datum stores a reference to it, not a copy).

If you enable location capture for a tracker, your coordinates are captured on-device and, to resolve a place name, may be sent to Apple's map services. This happens only for trackers you've opted in, and only at the moment of capture.

Backups

Datum can save your data to a backup file. There are two ways one gets created, and neither sends anything to us:

• Automatic daily backups are off by default. If you turn them on in Settings › Data, Datum writes one file a day into your own iCloud Drive, where you can see and delete them yourself in the Files app under Datum. The seven most recent are kept and older ones are removed automatically. If iCloud Drive isn't available, the file stays in Datum's own folder on the device instead.
• Manual backups are created only when you ask for one, and go wherever you choose to send them. Once you hand a backup to another app or service, that destination's terms govern it rather than ours.

A backup is a plain, unencrypted JSON file. It is protected by whatever protects the place it sits — your device passcode, your iCloud account — and not by a separate password of its own. Anyone who can read that location can read the backup, so treat one the way you would any other export of your own records.

A backup holds your trackers, entries, check-ins, notes, and settings, plus references to attachments rather than the attachments themselves. Photos and videos stay in your photo library and voice recordings stay in Datum's own storage; a backup points at them instead of copying them, so it is not a duplicate of your media.

Health data is deliberately excluded from every backup. When you connect a tracker to Apple Health, that data is mirrored into a separate on-device database that never syncs, and it is left out of backups entirely — because a backup can come to rest in iCloud Drive, and Apple does not permit Health data to leave your device that way. Health values are read fresh from Apple Health on each device instead. Other connected sources — Photos counts, Calendar, Reminders, and Datum's own storage usage — are included, since no such restriction applies to them.

Restoring a backup either replaces everything in the app or merges the file into what is already there, depending on which you pick, and cannot be undone from inside Datum.

The one server exception

Datum operates exactly one server-side component beyond Apple's own infrastructure: an anonymous push-relay that delivers scheduled notifications your device can't reliably trigger on its own (for example, a reminder that should silently log an entry without opening the app). That relay stores only:

• a job schedule (e.g. "daily at 8am"),
• a job kind (what type of action to take),
• an anonymous key, and
• an Apple push-notification device token.

It never receives or stores tracker data, values, names, or notes. Its source code is public and open for independent review, precisely so this claim doesn't have to be taken on faith.

Support tickets

If you contact support from the app's Support screen or the form on this site, your message is tied to your device's anonymous Support ID (a random token, not an account) — not your name or identity. If you instead email us directly, or use the site's support form, that email address is used only to reply to you; it is never stored alongside your tracker data or treated as tracking information.

Screenshots or screen recordings you choose to attach to a support ticket are stored to help us resolve the issue, and are automatically deleted a limited time after the ticket is closed.

In-app purchases

Purchases are processed by Apple and a purchase-management provider, RevenueCat, and are identified only by a randomly generated, non-personal Support ID — never your name, email, or Apple ID. See Settings in the app for your Support ID.

Third parties we rely on

Because Datum is local-first, the only parties that ever see any data are the infrastructure providers that make the app itself work:

• Apple — iCloud/CloudKit sync, Maps (place-name lookups), WeatherKit, HealthKit, Photos, Calendar, and Music integrations, all governed by Apple's own privacy terms and only active for features you enable.
• RevenueCat — anonymous purchase processing, as described above.
• Amazon Web Services — hosts the one disclosed, PII-free notification relay described above, and the support-ticket system described above.

We do not sell data, and there is no advertising or analytics SDK in Datum.

This website

datumapp.info uses Plausible, a privacy-focused analytics service, to see how many people visit. Plausible sets no cookies, collects no personal data, and cannot identify you individually or track you across other websites — it counts visits, not people. This is unrelated to the app itself, which has no analytics of any kind (see above).

Your choices

Because there's no account, there's nothing to delete on our end for ordinary use — deleting the app (or your data within it) removes it from your device and, if you choose, your iCloud. For a support ticket that included your email or an attachment, you can ask us to delete it by contacting support with your Support ID.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Material changes will be reflected here before they take effect.

Contact

Questions about this policy, or a request related to your data, can be sent through the app's Support screen or the form on datumapp.info.

Datum is made by EKPQA, LLC, a Delaware limited liability company.

← Back to datumapp.info