The On-Device Manifest

This page walks through what happens on your device. The full privacy policy for the app is at superidea.no/privacy.

What NaturalLanguage is — and why it matters for privacy

NaturalLanguage is Apple's framework for making sense of text, and it is built into iOS. Its models ship with the operating system and run on the iPhone you are holding. When Hymalayas asks it to read the sentiment of a sentence, the phone's own silicon answers. No server is contacted for that reading.

Contrast this with the more familiar cloud-ML pattern. In that pattern, the app you are using gathers your input — your text, your voice, your photo — packages it, and sends it across the internet to a data centre. A larger model runs there, returns an answer, and the company operating the data centre is, by construction, in possession of your input. Logs exist. Backups exist. Subpoenas reach servers. The privacy story of any cloud-ML feature is, ultimately, a story about who you are trusting to read the raw text of your private life.

Hymalayas reads your journal on the device because the interpretation of a private practice should not be outsourced. Reading the meaning of your words is done on your own device, not in someone else's data centre. That is not a policy promise, not a terms-of-service clause, not a pinky-swear in a settings screen; it is a property of where the computation physically happens. Your journal does sync to your own private account so your practice follows you, but the reading of its meaning is never handed to anyone else's server.

What on-device NLP means in plain language

NLP — natural language processing — is the family of techniques that let software make sense of written text. For a Sadhana app, the useful kinds are narrow and well-understood: scoring the sentiment of a sentence, and picking out the small set of themes a paragraph is circling. None of this requires a large language model. None of it requires the cloud.

On-device NLP means each of those small jobs is done by Apple's NaturalLanguage framework inside the Hymalayas app. It reads your text inside the app's sandbox and produces a sentiment score and a handful of themes, which are saved on your device. The original entry is saved too, so you can read it back later, and the entry syncs to your own private account. The scores do not; they stay on the device that made them.

This is a deliberately modest use of machine learning. We are not interpreting your words back to you, not generating advice, not summarising your inner life into a paragraph that pretends to know you. The Bodh (insight) of the practice is yours; the model's job is only to count gently, so that the monthly digest can show you the shape of what already happened.

What happens when you write a journal entry

Here is the precise sequence of what occurs when you write in the journal.

1. You type into the journal field, and the text is held in the app's working memory. If you speak instead, Apple's speech recognition turns your voice into text, and it may process the audio on Apple's servers. We never receive the audio.
2. When you save the entry, the NaturalLanguage framework scores its sentiment and picks out its themes on your device.
3. The scores and themes are saved in the app's local store on your device. They are not uploaded.
4. The text of the entry is saved with the rest of the day's ritual and syncs to your own private account, so the entry is waiting on your other devices.
5. Firebase Analytics records that an entry was saved and how many words it has, linked to your account ID. It never receives the text.

A few honest qualifications. Your entry syncs to your own private account on Google Firebase, encrypted in transit and at rest, with access restricted by security rules to your account; that is how the same entry appears on your iPad. If you have iCloud Backup turned on, Apple may include the app's local store in your device backup, a setting under your control in iOS. If you uninstall the app, iOS removes the local store; your synced copy remains in your account until you delete your account in the app.

The shape of the guarantee is precise: the meaning of your words is computed on the silicon in your hand. Typed, the words themselves travel only to your own private account; spoken, they also pass through Apple's speech recognition. They are never handed to an advertiser, and never to an outside AI.

What happens with mood data

The daily mood check-in is simpler than the journal. You choose a mood from a vocabulary that ships inside the app and, if you like, set its intensity. Nothing needs interpreting, so no model is involved. The mood and its intensity are saved with the day's ritual and sync to your own private account, so your mood history follows you.

Firebase Analytics also records the mood label and its intensity, linked to your account ID. That is how we learn which parts of the check-in are used. The moods are never sent to an advertiser and never used to build an advertising profile.

What happens with breathing session data

A breathing session — a Pranayama (breath discipline) practice — leaves a small trace. Your account records that you completed the breath part of the day's ritual and the Shanti points it earned. Firebase Analytics records which breathing practice you finished, linked to your account ID.

Apple Health is optional. If you allow it, Hymalayas reads sleep, heart rate, heart-rate variability, resting heart rate, blood oxygen, and respiratory rate to shape practice suggestions and your monthly wellbeing report, and it writes completed sessions back to Apple Health as Mindful Minutes. Those readings flow through Apple's HealthKit permission system into the app on your device. They do not transit any Hymalayas server and are not copied to our Firebase. We never aggregate them across users, because we never receive them.

Apple Health permission is granular and revocable. You can allow some readings and not others, or revoke all of them, in iOS Settings → Privacy & Security → Health. The practice works without it; the Health readings are an enrichment, not a requirement.

How the monthly digest is generated on your device

At the close of each month, Hymalayas assembles a digest — a one-screen reflection of the practice that has accumulated. It is built on your phone from the journal entries and sentiment scores stored there: the dominant feeling of the month, its top themes, and how many entries you wrote.

The digest is computed on your phone; its assembly contacts no server. The finished digest is kept on your device. It is not stored on a server, not mirrored to a web dashboard, and not emailed.

We chose this design because the monthly digest is the most temptingly cloud-shaped feature in the app. It is the moment when a conventional product would say: upload everything, run the big model on a server, send the answer back. Doing the aggregation on the device means working with the models Apple ships in iOS rather than the largest ones available. We accept that cost. The Dharma (right way) of the feature is that it is assembled on the phone.

Why on-device is harder to build — and why Hymalayas chose it

Cloud-side ML is, plainly, faster to ship. A team can iterate on server-side models without releasing a new app version, observe what people write to find what is working, and roll out improvements continuously. On-device interpretation means working with the models Apple ships, improving only with an app or iOS release, and forgoing that kind of insight: we do not read what people write. We do see how the app is used. Firebase Analytics records screens and features, the mood and intention labels you pick, the meditations you finish, and how many words a journal entry has, linked to your account ID — never the text of your journal. We learn less about your words than a conventional app would, by design.

Hymalayas chose on-device interpretation anyway because the journal is a sacred space. A practitioner sits down with the app at the end of the day and offers it the kind of sentence they might not say to a friend. What that sentence means should not be conditional on a server's good behaviour or a vendor's model; reading it is done on your own device. That its meaning is yours alone is not a marketing line; it is an architecture commitment. It costs us engineering time, it constrains what we can build, and it is exactly the right cost to pay.

This is also the first principle of the brand. Karma (action) in this context is what the system actually does, not what its marketing claims. So we will say plainly what the system does: the meaning of your words is computed on your device and sent to no outside AI; your words themselves sync to your own private account, and are sold to no one and shared with no advertiser. The On-Device Manifest is a record of that, in plain language, so that any practitioner — engineer or not — can read it and know what happens to their words.

Questions

Where does my reflection go after I write it?

It is scored on your iPhone by Apple's NaturalLanguage framework, and the score stays in the app's local store on your device. The text is never read by a server or by an outside AI. The entry itself, with the rest of the day's ritual, then syncs to your own private account so you can continue on another device. Firebase Analytics records that an entry was saved and how many words it has, never its text.

Does Hymalayas use a model of its own?

No. Your journal is read by Apple's NaturalLanguage framework, whose models ship with iOS. Hymalayas does not bundle or train a model of its own, and it calls no AI service. The reading happens on the device in your hand.

What is the NaturalLanguage framework?

It is Apple's toolkit for working with text: telling languages apart, recognising parts of speech, and scoring sentiment. It is part of iOS, and it runs locally on the device's own silicon. Hymalayas uses it for sentiment scoring, theme extraction, and the monthly digest, so your words are never sent to a server or an outside AI to be read.

Why don't you use cloud ML — is on-device worse?

Cloud ML is faster to ship and easier to update. It is not much better at the narrow tasks Hymalayas performs; on-device sentiment scoring and short-text classification are good enough for a quiet record of a practice. The trade-off we accepted is engineering time and slower iteration in exchange for an architectural guarantee that your words are interpreted only on your device, never handed to an outside model. Your reflections still sync to your own private account so your practice follows you, but their meaning is computed nowhere but your phone.

Can the app function without Apple Health connected?

Yes. Apple Health is optional. If you connect it, Hymalayas reads sleep, heart rate, heart-rate variability, resting heart rate, blood oxygen, and respiratory rate on your device to shape practice suggestions and your monthly wellbeing report. If you do not, the practice still works and still counts.

What signals are stored about a breath session?

Your account records that you completed the breath part of the day's ritual and the Shanti points it earned, and Firebase Analytics records which breathing practice you finished, linked to your account ID. If you have connected Apple Health, the app writes the session to Apple Health as Mindful Minutes and reads your Health data on your device. Those Health readings are never uploaded to us or to our Firebase.