The On-Device Manifest

What Core ML is — and why it matters for privacy

Core ML is Apple's on-device machine-learning runtime. In ordinary terms, it is the part of iOS that takes a trained model — a file full of numbers describing how a network of small mathematical functions should respond to input — and runs that model directly on the iPhone you are holding. The model ships inside the app bundle. When the app asks it a question, the phone's own silicon answers. No server is contacted. No request leaves the device.

Contrast this with the more familiar cloud-ML pattern. In that pattern, the app you are using gathers your input — your text, your voice, your photo — packages it, and sends it across the internet to a data centre. A larger model runs there, returns an answer, and the company operating the data centre is, by construction, in possession of your input. Logs exist. Backups exist. Subpoenas reach servers. The privacy story of any cloud-ML feature is, ultimately, a story about who you are trusting to read the raw text of your private life.

Hymalayas is built around Core ML because the interpretation of a private practice should not be outsourced. Reading the meaning of your words is done on your own device, not in someone else's data centre. That is not a policy promise, not a terms-of-service clause, not a pinky-swear in a settings screen; it is a property of where the computation physically happens. Your words are read by your phone's own model, not by an outside AI. Your reflections do sync to your own private account so your practice follows you, but their meaning is never handed to anyone else's server.

What on-device NLP means in plain language

NLP — natural language processing — is the family of techniques that let software make sense of written text. For a Sadhana app, the useful kinds are narrow and well-understood: classifying the sentiment of a sentence, extracting the small set of themes a paragraph is circling, recognising whether a mood note reads as tender, restless, grateful, or grieving. None of this requires a large language model. None of it requires the cloud.

On-device NLP means each of those small jobs is performed by a compact Core ML model that lives inside the Hymalayas app. The model reads your text inside the app's sandbox. It produces an output — typically a small numeric vector, a handful of floating-point numbers describing how the model classified the input — and that vector is saved. The original sentence is saved too, so you can read it back later. The sentence is scored inside the sandbox and is never sent to an outside AI to be interpreted; it does sync to your own private account, with its score, so the digest can read it on any of your devices.

This is a deliberately modest use of machine learning. We are not interpreting your words back to you, not generating advice, not summarising your inner life into a paragraph that pretends to know you. The Bodh (insight) of the practice is yours; the model's job is only to count gently, so that the monthly digest can show you the shape of what already happened.

What happens when you write a journal entry

Here is the precise sequence, with no abbreviation, of what occurs when you tap into the journal field and write a sentence.

1. You write into the journal field. The keystrokes go into a text buffer that exists only in the app's working memory.
2. While you are writing, the text is held only in app memory. It is not auto-uploaded and not sent anywhere off-device.
3. When you finish the entry, a Core ML sentiment model scores the text on-device. The scoring runs on the Neural Engine, the GPU, or the CPU — Apple's runtime chooses based on the device generation and current load.
4. The score — a small set of numbers describing sentiment, theme weights, and a coarse mood classification — is saved into the device's encrypted local store, protected by the iOS Data Protection class tied to your device passcode.
5. The original text is saved in that same encrypted store so you can re-read it, and it syncs to your own private account so the entry is waiting on your other devices. Its interpretation is never sent to an outside AI; only the words themselves travel, and only to your own account.

A few honest qualifications. Your entry syncs to your own private account on Google Firebase, encrypted in transit and at rest, with access restricted by security rules to your account; that is how the same entry appears on your iPad. If you have iCloud backup enabled at the OS level, Apple may also include the app's local store in your encrypted device backup, a setting under your control in iOS. If you uninstall the app, the local store is removed by iOS; your synced copy remains in your account until you delete it. If you export your journal, the export is generated on-device and handed to the iOS share sheet — where it goes from there is your choice.

The shape of the guarantee is precise: the meaning of your words is computed only on the silicon in your hand, and the words themselves travel only to your own private account. They are never handed to an advertiser, and never to an outside AI.

What happens with mood data

The daily mood check-in follows the same shape as the journal, with smaller inputs. When you tap a mood — a single word, sometimes with an optional one-line note — the selection is captured into app memory. If you have written a note, a Core ML classifier scores it on-device into the same small numeric space the journal uses, so that mood text and journal text can be aggregated coherently in the digest. The mood label and the score are written to the encrypted local store, and they sync to your own private account so your mood history follows you. What is never uploaded is any interpretation to an outside model; the scoring is done on your device.

Over weeks, the mood log becomes the spine of what the digest can show: a quiet record of which days were tender, which were restless, which carried Shanti (peace). The digest reads from the local store; it does not call out to a server to interpret your moods. If you turn off mobile data and disable Wi-Fi, the scoring continues to work exactly as it did with the network on, because the interpretation was never a network round-trip in the first place.

One detail worth naming: the mood vocabulary itself ships inside the app, so choosing a mood needs no network. Your selection does sync to your own private account so your history is consistent across your devices, but it is never sent to an advertiser or used to build a profile of you.

What happens with breathing session data

A breathing session — a Pranayama (breath discipline) practice — is recorded as three things: the chosen pattern (for example, four-in, seven-hold, eight-out), the session length, and a timestamp. Those three are captured locally, written to the encrypted store, and synced to your own private account so your history follows you. They are sufficient on their own for the digest to count your practice and for the in-app history to render.

If you have connected Apple Health and granted Hymalayas permission to read heart-rate and heart-rate-variability samples, the session will additionally annotate itself with the relevant samples drawn from Health for the window of the session. That data flows through Apple's HealthKit permission system directly into the app sandbox. It does not transit any Hymalayas server, and it is not copied to our Firebase. We never aggregate it across users, because we never see it — not across users, and not for one user.

Apple Health permission is granular and revocable. You can grant read access for heart rate but not for HRV, or revoke both at any time from the iOS Health app. If permission is absent or revoked, the breath session simply records pattern, length, and timestamp, and the digest reflects what is available. No feature is gated behind Health access; the deeper signals are an enrichment, not a requirement.

How the monthly digest is generated on-device

At the close of each month, Hymalayas assembles a digest — a one-screen reflection of the practice that has accumulated. The assembly is performed by a small Core ML pipeline running on the phone. It reads the local store: the sentiment vectors from journal entries, the mood log, the breath session records, the Wisdom Cards earned along the way. It aggregates these into a handful of summary statistics and short qualitative notes — for example, the dominant theme of the month, the count of practice days, the rough arc of mood across the four weeks.

The digest is computed on your phone; its assembly contacts no server. The finished digest is not stored on a server, not mirrored to a web dashboard, and not emailed. The entries it reads from do sync to your own private account, so the digest can be rebuilt on any of your devices, but the digest itself stays on the device that made it unless you choose to share it. If you want to keep a copy, the iOS share sheet can hand the rendered digest to wherever you choose.

We chose this design because the monthly digest is the most temptingly cloud-shaped feature in the app. It is the moment when a conventional product would say: upload everything, run the big model on a server, send the answer back. Doing the aggregation on-device costs us engineering time and constrains the size of the models we can use. We accept those costs. The Dharma (right way) of the feature is that it is assembled on the phone.

What Apple's Neural Engine is

The Neural Engine is a piece of custom silicon Apple has shipped on every iPhone since the A11 chip in 2017. It is a coprocessor designed specifically for the kinds of arithmetic that machine- learning inference performs — large numbers of small multiplications and additions, executed in parallel, at low power. It sits next to the CPU and GPU on the same die, and Core ML can dispatch work to whichever of the three is most appropriate for a given model.

Why this matters for an app like Hymalayas: before purpose-built on-device ML silicon existed, it was genuinely difficult to run even modest models on a phone without draining the battery or stalling the interface. The honest engineering excuse for cloud ML, that the phone could not do the work, was often true. Since 2017 that excuse has steadily eroded. For the model sizes Hymalayas uses, the Neural Engine answers in milliseconds and costs a negligible fraction of battery. The argument for shipping your text to a server to be read has become, for our use cases, a choice rather than a necessity.

We will not overclaim. The Neural Engine cannot run arbitrarily large models, and the gap between on-device and large server-side models is real for tasks like long-form generation. For the narrow, well-defined work Hymalayas asks of ML — sentiment, theme, aggregation — the gap is small or nil, and the interpretation stays on your device.

Why on-device is harder to build — and why Hymalayas chose it

Cloud-side ML is, plainly, faster to ship. A team can iterate on server-side models without releasing a new app version, observe aggregate behaviour to find what is working, and roll out improvements continuously. On-device ML demands that every model improvement ride along with an App Store release, that the model fit within the bundle size and the device's memory budget, and that the team forgo the richest kind of usage telemetry. We do not read what people write; the interpretation of your words is never sent to us. We do see which features are used, through Firebase Analytics that counts screens and taps as anonymous totals, never the content inside them. We learn less about your words than a conventional app would, by design.

Hymalayas chose on-device interpretation anyway because the journal is a sacred space. A practitioner sits down with the app at the end of the day and offers it the kind of sentence they might not say to a friend. What that sentence means should not be conditional on a server's good behaviour or a vendor's model; reading it is done on your own device. That its meaning is yours alone is not a marketing line; it is an architecture commitment. It costs us engineering time, it constrains what we can build, and it is exactly the right cost to pay.

This is also the first principle of the brand. Karma (action) in this context is what the system actually does, not what its marketing claims. So we will say plainly what the system does: the meaning of your words is computed on your device and sent to no outside AI; your words themselves sync only to your own private account, and are sold or shared with no one. The On-Device Manifest is a record of that, in plain language, so that any practitioner — engineer or not — can read it and know what happens to their words.

Questions

Where does my reflection go after I write it?

It is held briefly in the app's working memory, scored by a Core ML sentiment model running on your iPhone, and the resulting numbers are saved to the device's encrypted local store. The scoring never leaves the phone: your text is read only by the on-device model, never by a server and never by an outside AI. Your reflection and its score then sync to your own private account so you can continue on another device.

Does Hymalayas use Apple's Neural Engine?

Yes, where the hardware supports it. On any iPhone with an A11 chip or newer (2017 onward) the Core ML runtime can dispatch inference to the Neural Engine, the GPU, or the CPU depending on the model and the device's current state. We do not control that scheduling — Apple's runtime decides. On older devices the same models still run, just on the CPU or GPU, with slightly higher battery cost.

What is Core ML?

Core ML is Apple's on-device machine-learning runtime. It loads a model file that ships inside the app and runs predictions locally using the device's silicon. The phone does the interpretation; no server is contacted for it. For Hymalayas, Core ML is the reason we can do sentiment scoring, theme extraction, and the monthly digest aggregation without ever sending your words to a server or an outside AI to be read.

Why don't you use cloud ML — is on-device worse?

Cloud ML is faster to ship and easier to update. It is not worse for accuracy on most tasks Hymalayas performs; modern on-device models for sentiment and short-text classification are competitive. The trade-off we accepted is engineering time and slower iteration in exchange for an architectural guarantee that your words are interpreted only on your device, never handed to an outside model. Your reflections still sync to your own private account so your practice follows you, but their meaning is computed nowhere but your phone.

Can the app function without Apple Health connected?

Yes, fully. Apple Health is optional. If you connect it and grant permission, breath sessions can read heart rate and heart-rate variability so the digest reflects more of what your body did. If you do not connect it, breath sessions still record session length and the practice still counts. Nothing is gated behind Health access.

What signals are stored about a breath session?

Session length, the chosen Pranayama pattern, and — only if you have connected Apple Health and granted permission — heart rate and heart-rate variability sampled during the session. The heart-rate and HRV readings come from Apple Health and stay there; they never reach a Hymalayas server or our Firebase. The session record itself — pattern, length, completion — syncs to your own private account so your history follows you.