ScriptumPrivacy Policy
Scriptum
Last updated: 14 September 2026
Who is responsible
Scriptum is made by ANNR Studio, based in the Netherlands. ANNR Studio is the data controller for the small amount of personal data described below. For anything in this policy, write to admin@annrstudio.com.
The short version
Your journal is stored on your phone. On an iPhone with iCloud Drive switched on, a copy is also kept in your own iCloud Drive, which belongs to your Apple account and not to us. There is no account, no sign-in, and no copy of your writing on any server of ours. One optional paid feature sends an entry away to be tidied up, and only when you ask it to. That is the only time anything you have written passes through anything we run.
What stays on your phone
Your entries, any photos you attach, your first name if you gave one, your settings, and whether you have seen the introduction — all of it is written to Scriptum's own storage on your device.
The Home Screen widget reads from a small shared space on the same phone. It holds the day's question, how dates are written in your language, the date you last wrote, your streak and your colour. It never holds a word you wrote, and nothing in it leaves the phone.
Your passcode is kept in the device keychain, marked as available only on the phone that created it, and deliberately excluded from every backup, including the iCloud copy. A restored phone will not bring it with you; you will be asked to set a new one.
We cannot read, recover, or reset any of this.
The copy in your iCloud (iPhone only)
So that deleting the app or changing phones does not take your journal with it, Scriptum keeps one file in your iCloud Drive, in a folder called Scriptum.
What is in it. Your entries and their photos, and your setup: your first name, your colour, the intention and the reason you chose in the introduction, your reminder time, and your language. Not your passcode.
When it is written. When you leave the app and something has changed since the last copy, at most once every fifteen minutes. The file is replaced each time; there is one copy, not a history.
Where it goes. To Apple, under your Apple account, the same way any file you save to iCloud Drive does. It never passes through anything we run, and we cannot see, open, restore or delete it. Apple encrypts iCloud Drive in transit and on its servers. Under Apple's standard data protection Apple holds the keys; if you switch on Advanced Data Protection, iCloud Drive is end-to-end encrypted and only your devices hold them.
Turning it off. The copy is only kept while iCloud Drive is on. Switching off iCloud Drive for Scriptum in your iPhone's iCloud settings stops it.
Deleting it. Deleting entries in Scriptum, or deleting the app, does not delete the iCloud copy. That is the point of it, but it also means removing it is up to you: in the Files app, open iCloud Drive, then the Scriptum folder, and delete the file; or remove Scriptum's data from your iCloud storage in your iPhone's settings.
Android keeps no such copy.
What Scriptum does not do
No account. No analytics. No adverts inside Scriptum, and no advertising identifiers — it never reads your device's advertising ID. No tracking, and no permission prompt asking for it. No push notifications from us — the daily nudge is scheduled locally by your own phone, and Scriptum never registers a push token. We do not sell or share personal data in any sense, including the specific senses used by the CCPA.
Other times anything leaves your device
Clean Up. This is a paid feature that tidies an entry, and it runs only when you tap it. Scriptum sends the text of that one entry, plus an anonymous purchase identifier, to a small server we run on Cloudflare. That server checks with RevenueCat that the identifier belongs to an active subscription, then forwards the text to Anthropic, whose model produces the tidied version. Our server stores nothing of what you wrote — the entry exists for the length of the request. The only thing kept is an hourly request counter, which stops a leaked identifier running up a bill and expires by itself. Anthropic's handling of the text is governed by their own privacy policy. If you never use Clean Up, nothing you have written ever passes through a server of ours.
Dictation. Scriptum asks your phone to transcribe speech on the device, without sending audio anywhere. That request is honoured on iOS 17 and later and Android 13 and later. On older versions the operating system quietly ignores it and uses its own network service instead — so on an older phone, your spoken words go to Apple or Google to be turned into text. We cannot control or reliably detect this, so we would rather say so than promise something your phone may not honour. Scriptum never receives or stores the audio either way.
Purchases. Payment is handled entirely by Apple or Google. We never see your card, billing address, or store account. We use RevenueCat to know whether a purchase is active; it receives an anonymous identifier generated on your device and the store's receipt. That identifier is not derived from your name or any account — it identifies a purchase, not a person.
Where an install came from (iPhone only). If you found Scriptum through an advert on the App Store, iOS hands the app a token naming the campaign that brought you — a campaign, not a person. It is collected once, on first launch, and passed to RevenueCat, so we can see which adverts led to purchases rather than only to downloads. It carries no identifier for you, is never combined with anything else, is not used to build a profile of you, and is not shared onward. This is why Scriptum asks for no tracking permission: Apple does not class this as tracking, and there is nothing to send at all if you did not arrive through an advert. Android does nothing of the kind.
App updates. When Scriptum checks for an update it contacts Expo's update service, which receives your IP address, app version and platform, and nothing about your journal.
Export. If you export your journal, the file is made on your device and handed to your phone's share sheet. Where it goes next is your choice. We receive no copy.
Email. If you write to admin@annrstudio.com we have your email and whatever is in it. Please do not paste your journal into a support email.
Your device's own backup
Separately from the iCloud copy above, your journal is included in your phone's own backup — iCloud or Google — if you have that switched on. That backup belongs to Apple or Google, not to us; we cannot see, restore or delete it. Your passcode is not included, for the reason above, and Android caps how much each app may back up, so a journal with many photos can exceed it.
Why we are allowed to do the above
Clean Up and the subscription check are necessary to provide something you asked for and paid for (GDPR Art. 6(1)(b)). The rate limit on our own server and answering your emails rest on our legitimate interest in preventing abuse and in supporting you (Art. 6(1)(f)). Everything else — your journal on your phone, the iCloud copy, and your phone's own backup — is held by you, or by Apple or Google under your own account, and is not our processing at all.
The third parties involved
Anthropic (produces the Clean Up result), Cloudflare (hosts the server it talks to), RevenueCat (tells the app whether a purchase is active), Apple (payments, speech recognition on older iPhones, and storing the iCloud copy under your account), Google (payments, and speech recognition on older Android phones), and Expo (delivers app updates). Each has its own privacy policy. Anthropic, RevenueCat and Cloudflare are established in or operate from the United States; transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism.
There are no others. No analytics provider, no crash reporter, no advertising network, no data broker.
How long anything is kept
On your phone, until you delete it. The iCloud copy, until you delete it from iCloud Drive — deleting the app does not remove it. The text sent to Clean Up is not kept at all. The rate-limit counter expires within hours. Purchase records sit with RevenueCat for as long as the purchase is relevant. Support emails are kept as long as needed to help, and a reasonable period after.
Your rights
You have the right to access your personal data, correct it, erase it, restrict or object to its processing, and receive it in a portable form. Because there is no account and nothing about you on a server of ours, most of these you exercise directly: Settings exports your whole journal as a file, and Settings deletes every entry. Deleting the app removes what is on the phone, including your passcode. The iCloud copy is removed from iCloud Drive, as described above.
For the little we do hold — a support email, or the hourly counter tied to a purchase identifier — write to admin@annrstudio.com.
You may also complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens, and you may also go to the authority in the country where you live.
Children
Scriptum is not intended for anyone under 16, and we do not knowingly collect personal data from children.
Changes
If this policy changes, the date at the top changes with it. If a change materially affects what happens to your writing, we will say so in the app rather than rely on you to re-read this page.