Privacy Policy

Last updated: 28 October 2026

This policy explains what happens to what you write in OneFlip. The short version: it stays with you — on your devices and, if you keep sync on, in your own private iCloud. We never see it.

Your flips, the words you write about them, tags and label presets are stored on your device, along with your settings, the coin skin you picked and your stats counts. A photo or video you add to a note is saved as a smaller copy inside the app’s own storage: if you picked it from your library, the original stays there untouched, and if you took or recorded it with the camera, that copy is the only one — OneFlip does not add it to your library. A voice note you record for a note is saved in the same storage, and OneFlip makes no other copy of it apart from your own iCloud sync, described below. Your Apple Watch keeps flips, notes and side names too, but no tags. OneFlip has no servers of its own, so there is no place of ours for your journal to be sent and no copy for us to hold. It is included in whatever backup you already use for your device, on Apple’s terms.

If iCloud sync is on — it is by default, and you can turn it off in Settings → My data — your notes, their photos, videos and voice notes, tags, label presets and your streak — which days you flipped — are also kept in the private iCloud database of your Apple Account, so they appear on your other iPhone, iPad and Mac signed in to the same account. That storage belongs to you and is run by Apple; we cannot see or read it, and it counts toward your iCloud storage. Your settings, the coin skin you have selected and stats counts stay on each device. Alongside them the app keeps a random identifier for each of your devices and when it was last used, so a reminder rings on one device instead of all of them, and the time you last used Delete all data, so your other devices erase too; Delete all data leaves these in place. Your Apple Watch does not use iCloud: it mirrors the iPhone it is paired with.

We do not track you. No analytics, no advertising, no attribution, no crash reporting, no third-party trackers. The one third-party component in the app is an animation renderer, and it has no access to the network. At most once a day, when you open it, the app asks the App Store which version of OneFlip is the latest, so the app can offer an update; the request contains only the app’s public App Store ID and nothing from your journal, settings or purchases.

Every flip is one bit from your device’s cryptographic random number generator — produced on the spot, and recorded nowhere but your own journal.

Permissions are requested only when you use the feature behind them. Microphone and speech recognition — to dictate a note or a message to us, and the microphone also records a voice note or the sound of a video you choose to record for a note; recognition runs on your device, and no dictation audio leaves it. “What your notes say” in Stats is written by Apple Intelligence on your device: your notes are not sent anywhere to do it, and the result stays on this device until you delete all data. Camera — to take a photo or record a video for a note, and only after you choose to. Photos — add-only, to save a share card you made; picking a photo or video for a note goes through the system picker, which hands over only the item you choose. OneFlip never reads your library. Face ID, Touch ID or your device passcode — to unlock your journal; your device performs the check and returns only a yes or a no. Notifications — to send you the reminders you turn on.

Reminders are scheduled and delivered by your device. Some of them quote what you wrote in your note and the words you gave the two sides, so the reminder makes sense — which means that text can appear on your Lock Screen. Every kind of reminder can be turned off in Settings → Notifications, except the two that warn you before Pro ends; those carry no text of yours.

Widgets and watch complications are separate programs, so what they display is placed in a private container that only OneFlip and its own widgets can read. Your Apple Watch holds a copy of your most recent notes — including ones you wrote on your iPhone — so it can show them on your wrist, and it keeps the ones you write on the watch itself, both before and after they reach your iPhone. You can edit the text of any of them there and answer the questions about them — whether you followed the coin and how it turned out, along with anything you wrote about how it went, and, for a note you have just written there, how the result felt — and the change travels back to your iPhone the next time the two are near each other. Photos, videos and voice notes are not part of that copy: the watch never receives them. Like everything else on the device, the watch copy is included in whatever backup you already use, and it sits in the watch’s own private storage.

Share cards, CSV files and PDF exports are created only when you ask for them. A PDF export includes the photos from the notes it covers, and a still frame for a note that has only a video; a CSV file and a share card never do. OneFlip hands the file to the destination you pick, and from that point that app’s privacy policy applies, not ours.

Writing to support or sending feedback from inside the app pre-fills your app version, device model, iOS version and plan — plus, if you wrote from an error screen, the code of that error. Never anything from your journal, and you can edit the message before sending. It goes from your own mail account, so we see the address you send it from.

OneFlip Pro is sold by Apple. Payment, renewal and refunds are handled by the App Store, and we never see your payment details. The app, its widgets and the watch app ask Apple only whether this Apple ID owns Pro and until when; the answer stays on your device.

To erase everything, use Settings → My data → Delete all data: it erases your journal, the photos, videos and voice notes in it, your tags, label presets and your streak from this device and, if this device has ever synced, from your iCloud and every device that syncs with it, plus the stats and flip counts on this device. Deleting the app removes the app, its settings and the watch app, but not what is already in your iCloud — so delete your data first if you want that gone too. App settings stay — except the journal lock, which switches off, since there is nothing left to lock. The copy on your Apple Watch — both its own notes and the ones it mirrors from your iPhone — clears the next time the two sync. We hold no copy, so there is nothing to request from us. OneFlip is not directed at children under 13. Changes to this policy ship with app updates, and the date above changes with them. Questions: oneflip.app@gmail.com.