Privacy policy

Last updated: 19 October 2026

You Are Not Ready is made by Psyche Vibes Ltd, a company registered in England and Wales (company number 17229667) ("we", "us"). This policy explains how data is handled through the You Are Not Ready iPhone app and the youarenotready.app website, why, and what you can do about it. The short version: your workout measurements are processed on your phone and are not automatically uploaded to us. This release contains alarms and morning exercises only; it does not use your location. Normal device backups and anything you explicitly share remain your choice. Optional Apple sign-in uses a separate account service; Apple and RevenueCat handle subscription information. Subscription requests also send device and technical information, and RevenueCat can derive an approximate country from the connection, as explained below. This is separate from your workout data. We do not sell your data.

Who is responsible

Psyche Vibes Ltd is the data controller. Questions or requests: privacy@youarenotready.app.

What we do not receive

• Your workout history, fitness-test answers, rep counts, location coordinates or motion-sensor observations. These are processed locally, not uploaded to us.
• Your contacts, photo library or health records. The current launch app does not request access to them.
• Camera images or microphone recordings from normal exercise counting. Processing happens on your phone; these recordings are not saved or sent to us.

The website

• Waitlist. If you join the waitlist, we store your email address, the date you signed up, the signup source and a country code provided by Cloudflare when available. The country code is approximate, not GPS or a precise location. We use your email only to tell you when the app launches. We do not add you to any other list.
• Hosting. The site runs on Cloudflare, which processes standard technical information (such as IP address and browser type) to deliver and protect the site.
• Fonts. The website loads its fonts from Google Fonts. Your browser connects to Google to download them, which exposes normal connection information such as your IP address and browser details to Google.
• Cookies. The website does not use advertising or analytics cookies.

The app

• Local progress. Your alarm times, morning-order settings, fitness-test results, rep counts, streak, profile and settings are stored on your device. There is no app-operated cloud sync of this progress.
• Run 5K (coming soon). A guided Run 5K program is planned for a future update. This release does not include it and does not request location or motion permission. Before it launches, we will update this policy to explain exactly how it handles your data.
• Camera counting. With your permission, camera frames are analysed on-device to estimate exercise repetitions, not to identify you. Normal exercise sessions do not save video or images.
• Count out loud. If you choose this fallback and grant microphone and speech-recognition permissions, supported on-device recognition turns spoken numbers into rep counts. It does not fall back to server recognition if on-device recognition is unavailable. Audio and transcripts are not saved; the resulting rep count can be stored with your progress.
• Local usage diagnostics. App events, such as an alarm firing or orders being completed, are kept in a limited on-device diagnostics queue. They are not uploaded to us or an external workout-analytics provider.
• Device backups. Depending on your Apple and device settings, normal iCloud or computer backups may include local profile and progress data. These are your device backups, not an upload to us, and are controlled through Apple's backup settings.
• Developer tests. Development builds can include a separately enabled diagnostic-recording option. With explicit consent, it saves camera video and tracking logs locally for a test, without audio. Those diagnostic files are excluded from device backups. They leave the phone only if you explicitly choose to share or export them; this option is not included in the release app.
• Subscriptions. Payments are handled by Apple. We never see your card details. We use RevenueCat to check subscription access and display the paywall and subscription-management interface. RevenueCat receives an app user ID, purchase and renewal history, and related subscription, paywall and operational information, including billing-screen views and interactions. This supports access checks and subscription/paywall analytics, separately from our local workout-event queue. Before optional account linking, this is RevenueCat's generated customer ID; after verified Apple sign-in, we link billing to the opaque account ID described below. These identifiers are not a promise of anonymous billing. These services require network requests; the promise that workout data stays local does not mean the whole app is offline or sends no data. We do not send your workout history, fitness answers, location or motion data as RevenueCat customer attributes.
• Subscription device and connection information. RevenueCat's SDK transmits an iOS vendor identifier (IDFV, a device identifier scoped to the app vendor) when available, along with device model, operating-system and app versions, locale and App Store storefront information in its service requests. The SDK sends this identifier in request headers even though we disable its optional attribution-identifier collection. RevenueCat also records a country value: it uses the transaction's country when available, or otherwise derives a country from the connection's IP address. RevenueCat's documentation says it drops the raw IP address after deriving that country. This approximate country is associated with the subscription customer; it is not a precise location.
• Subscription-service diagnostics. We configure RevenueCat SDK diagnostics off locally, but a setting supplied by RevenueCat can enable them. If enabled, the SDK can send technical performance and error information, such as response times, cache outcomes and error codes, together with related product or transaction information, to help diagnose subscription-service problems. These requests can include billing or device identifiers; they are separate from our local exercise-event queue. They do not upload your workouts, camera or microphone recordings, or motion observations.

Optional Apple sign-in

• Your choice. After a successful trial or subscription checkout, you can choose Continue with Apple or skip app sign-in. Skipping does not create an account in our sign-in service. Apple sign-in is separate from authorising an App Store purchase and does not synchronise or back up workout progress.
• Verification. If you sign in, the app sends Apple's signed identity proof and a one-use authorisation code to our dedicated service at auth.youarenotready.app, hosted on Cloudflare Workers. The service verifies these with Apple. We do not receive your Apple password or device passcode, request your Apple name or email address, or store your name or email in this account database.
• Account records. We store a keyed hash of Apple's account identifier, a random opaque account ID, an encrypted Apple refresh token, hashes of expiring sign-in sessions, and timestamps needed for verification and cleanup. Short-lived challenges and limited deletion-proof records prevent replay and let interrupted deletion finish safely. These are account records, not anonymous data. The verified opaque account ID is also used to link RevenueCat subscription access. This service does not accept your fitness answers, training history, location, camera frames, speech recordings or local product-event queue.
• Storage and security. The account database uses Cloudflare D1's EU jurisdiction. The app keeps its sign-in credentials in this device's protected iOS Keychain, without Keychain synchronisation; its local progress file contains the opaque owner ID and recovery markers, not your Apple password. Our service does not log raw sign-in proofs, authorisation codes, session tokens or IP addresses. It uses a temporary keyed IP hash to limit abusive requests. Cloudflare still processes routine network and security metadata; an EU database does not mean every infrastructure request is processed only in the EU.

Why we use it (legal basis)

• Waitlist emails: your consent, which you can withdraw at any time.
• Subscriptions: to provide the service you paid for (performance of a contract).
• Optional app account: to provide the Apple sign-in and subscription-linking service you request (performance of a contract). Account verification, abuse prevention and safe deletion also serve our legitimate interest in protecting accounts and the service.
• Subscription and paywall analytics, and subscription-service reliability: our legitimate interest in understanding whether billing and subscription-management screens work and resolving technical failures, without uploading your workout data or using advertising tracking.
• Local app processing: to provide the alarm and exercise-counting features you choose and retain local progress. Camera, microphone and speech access are subject to the permissions you grant in iOS. This release does not use location or motion access.
• Website delivery and security: our legitimate interest in delivering and protecting the website.

Who we share it with

The services used are Apple (optional Sign in with Apple verification, App Store payments and any device backups you enable), RevenueCat (subscription access, paywall, subscription management and related technical processing), Cloudflare (website hosting, waitlist storage and the separate account service/database), and Google Fonts (website font delivery). The data involved is limited to the purposes described above; workout measurements are not automatically uploaded to our servers. These providers may process information outside the UK under their applicable privacy and data-protection terms. RevenueCat describes its provider processing in its privacy notice. We do not sell your data or share it with advertisers.

How long we keep it

• Waitlist emails: until shortly after launch, or until you ask us to delete them, whichever comes first.
• App account: while the account exists, until deletion completes. Sign-in sessions expire after 30 days and challenges after five minutes. Limited deletion receipts expire after 30 days; a hash-only replay-prevention record expires after 24 hours. Expired or revoked records are removed by the next successful scheduled cleanup, rather than at an exact instant.
• Account database recovery: Cloudflare keeps separate, rolling disaster-recovery history. Its D1 Time Travel retention is currently seven days on a free plan or 30 days on a paid plan. Deleting the live account does not immediately erase every recovery copy. This is account-service recovery history, not a cloud backup of your workouts.
• Subscription records: as long as needed for accounting and legal obligations.
• Provider-held subscription and technical information: processing and retention also depend on our service arrangements, applicable legal requirements and the provider's policies. Apple and RevenueCat have their own retention and deletion procedures for records they hold; deleting a You Are Not Ready account does not immediately remove all provider-held billing or technical records.
• Data on your phone: until you clear the relevant local data or delete the app. The diagnostics queue is limited and older events are replaced. Copies in device backups are subject to your backup settings and Apple's retention rules.

Signing out and deleting your account

To delete an app account, open Settings in You Are Not Ready and choose Desert (Delete Account), then confirm Delete account. If access has expired, the restricted account-management screen still offers deletion of an existing account. The app first disables its alarms and completes account cleanup, including revoking the Apple sign-in authorisation, before removing local progress. If verification, connectivity or cleanup fails, it keeps the state needed to retry and tells you that deletion is not complete. Reconnect and follow the retry instructions; you may need to verify the original Apple account. You can also contact privacy@youarenotready.app for help.

Signing out keeps local progress; it is not account deletion. Deleting an account or uninstalling the app does not cancel an Apple subscription, erase Apple or RevenueCat billing records, or remove copies from your own historical backups and exports. Manage or cancel recurring billing in iPhone Settings → your name → Subscriptions. If you skipped Apple sign-in, no online app account was created; the app's deletion action removes its local recruit file.

Your rights

Under UK and EU data protection law you can ask to see, correct or delete your data, object to or restrict how we use it, and withdraw consent. Email privacy@youarenotready.app and we will respond within one month. If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office at ico.org.uk.

How we protect it

Your workout, alarm and progress data stays on your phone and is protected by iOS, subject to your device backup and sharing choices. The website and our account-service connections use encrypted HTTPS. Account records are access-controlled, Apple refresh tokens are encrypted, and our server stores session-token hashes rather than the session tokens themselves. Waitlist and account data are stored with Cloudflare for the purposes above. We review access to our accounts regularly and use two-factor authentication where available.

US privacy rights

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, to access and delete it, to correct it, and not to be discriminated against for exercising these rights.

• We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising.
• In the last 12 months, the categories we may have collected are identifiers (your waitlist email address, app customer/account IDs, the device identifier transmitted to RevenueCat and the protected Apple sign-in records described above), commercial information (subscription and purchase history via Apple and RevenueCat), approximate country information, and technical/network activity needed to operate and protect the website, account and subscription services. Subscription technical diagnostics may also be sent if the provider setting enables them, as described above.
• We do not use sensitive personal information to infer characteristics about you.

To make a request, email privacy@youarenotready.app. We will verify your request using information you have given us, and you can use an authorised agent. We will respond within 45 days.

Children

You Are Not Ready is not intended for anyone under 16, and we do not knowingly collect data from children.

Changes

If we change this policy, we will update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email at least 30 days before it takes effect.