Privacy
Numbered is a journal, and a journal is private. This page says what the app and this site do with what is yours.
Your journal
Your journal lives on your Mac and in the private database of your iCloud account, where Apple stores it and keeps it in step between your devices. We run one server, for the library described below, and it never holds your journal. We keep no copy of your journal, and we never see it.
Everything you write or add is kept in encrypted fields: your words and numbers, and your pictures and files with them. CloudKit encrypts those fields with key material held in your iCloud Keychain. Apple describes this in its iCloud data security overview.
File › Export… writes your whole journal as plain Markdown, your records as readable text and your attachments beside them, in a folder you choose, whenever you want it. To remove your journal from iCloud, open System Settings, choose your name, then iCloud, and delete Numbered’s data there.
What Numbered asks your Mac for
Location. If you allow it, Numbered notes where you are when you write, so a day can say where it happened. To name the place it asks Apple Maps, and to note the weather it asks Apple Weather. Each is sent the location and nothing you wrote, and what comes back is kept in your journal. You can change this in System Settings › Privacy & Security › Location Services.
Contacts. If you allow it, Numbered shows a person’s card beside their tag. Your journal keeps the card’s name and identifier. The photo and the numbers are read from Contacts each time a page is drawn.
Photos. If you allow it, Numbered links the videos you choose from Photos to your journal and plays them from Photos. It keeps a still of each and, when you ask, a copy. Nothing else in your library is read.
Pictures and files. A picture or file you add to an entry is copied into your journal, with the time and place it carries.
The library
The library is where people share styles and templates, and where you find them. It is the one place Numbered talks to a server of ours, at numbered.app/library, and only when you ask: when you open the library or run one of its commands. Numbered does not look at it when it opens, in the background, or to check for updates.
Browsing and installing. Numbered downloads the library’s list and the files you choose. Each request is made without a cookie, an account, a query string or an identifier of any kind, and your searches run on your Mac over the list it downloaded, so a search term never leaves it. The library does not record who installed what.
Publishing. Publishing sends one file, the file you were shown, and a name if you chose one. On your first publication Numbered makes a signing key and keeps it in your iCloud Keychain, so your Macs are one author. Each file is signed with it. The library keeps the key’s public half and the name you chose, and nothing else about you: not an Apple Account, an email address, a journal or a device. A file waits in a queue only we can open until a person here has read it, and once published it is public. If you lose the key, the files you published stay and new ones come from a new author.
Reporting. A report sends the file’s number, the reason you chose from a short list, and any words you add, with no key. If a report is right we take the file down; copies already installed stay yours. To have a file you published taken down, write to us.
What the library keeps is the files people send, with the date, each author’s public key and chosen name, and reports with their reason, words and date. It does not write down IP addresses, search terms, or who installed what. Every night the published files are copied, as plain files, into a public repository, numbered-library, so the library outlives us; it holds the same files and nothing more. Cloudflare, which serves numbered.app, handles each request’s address as any web host does, under its privacy policy.
What we receive
Usage counts. While Settings › Usage › Send anonymous usage is on, Numbered tells TelemetryDeck, the service we use for this, which features you use and how often: opening the app or a day, saving an entry or a record, adding an attachment, running a search, an export or an import, and counts such as how many results a search found. The switch is on until you turn it off. Each count goes under a random number made on your Mac and hashed before it leaves, and that number says nothing about who you are. Turning the switch off forgets the number. TelemetryDeck’s tool also adds the versions of macOS and Numbered, your Mac’s model, and your system’s language and region. The counts hold no word you wrote, no day, and no tag’s or template’s name. Turn the switch off and nothing more is sent. TelemetryDeck keeps the counts for us under its privacy policy, which states no retention period.
The support log, when you send it. It holds two days of what Numbered did, how long it took and the codes of anything that failed, and never a word you wrote. You see every line first, and it leaves only as a Mail message you send. We keep your messages while they help us answer you, and delete them when you ask.
Crash reports. If you share analytics with app developers (System Settings › Privacy & Security › Analytics & Improvements), Apple passes us Numbered’s crash reports and performance figures, without your name.
Purchases. Numbered is sold through the App Store. Apple handles the purchase and tells us totals, not who you are.
This site
numbered.app is a few pages served by Cloudflare, and the library’s service answers under /library/. No page you can open sets a cookie or sends your browser a script, and the site keeps no analytics. The one page that needs a sign-in, where we read what people have sent, opens only for us, behind Cloudflare’s sign-in. Cloudflare handles each request as any web host does, under its privacy policy.
Who we are
Numbered is made by Jonathan Malek. Write to support@numbered.app with any question about this page. When it changes, the date at the top changes with it.