The Privacy Covenant

This covenant describes the app. For how this website handles the email you share with us, see our Privacy Policy.

Two promises, kept separate

Honesty means not blurring two different promises into one. Hymalayas keeps two, and they are not the same.

The first is about intelligence. The reading of your moods, the sentiment in your words, the shape of a month of practice — all of it is computed on your own device, by Apple's on-device models. Your writing is never sent to OpenAI, Anthropic, Google's AI, or any outside model to be interpreted. The understanding is produced on the silicon in your hand and handed to no one.

The second is about continuity. So your practice can follow you from iPhone to iPad, your account and your written practice are kept in a private account built on Google Firebase. Your daily reflections, your sankalpa, your mood check-ins, your Prana, and your Wisdom Card history sync there. The connection is encrypted in transit and at rest, and Firestore's security rules restrict access to your authenticated account.

What we refuse is the part that would betray a practice. We run no advertising, we keep no data brokers, we sell or share nothing, and we never give your words to an outside AI to read. So the precise truth is this: your reflections sync so you never lose them, they are interpreted nowhere but your own device, and they are sold or shared nowhere at all.

What lives where

It is worth being exact about which parts of a practice travel and which never do.

Two things are computed on your device and are never sent to us at all. The first is the sentiment analysis your writing produces. The second is any Apple Health signal — heart rate and heart-rate variability from a paired Apple Watch — which stays inside Apple Health and reaches neither a Hymalayas server nor our Firebase.

What does sync, into your own private account, is the practice itself:

• Your account: the name and email from your Apple or Google sign-in, and the user ID that ties the practice to you.
• Your written reflections and your sankalpa, the intention you set.
• Your mood check-ins.
• Your Prana, Shanti, and Dharma tallies.
• Your Wisdom Card history: which cards you have drawn, and when.

All of it rests in your own area of our Firebase, so the practice you build on one device is waiting on the next. None of it is assembled into an advertising profile, and none of it is sold.

How on-device processing works

Modern iPhones contain a dedicated piece of silicon called the Apple Neural Engine — a chip designed to run machine-learning models quickly and efficiently without ever sending the input data off the device. It is the same hardware that recognises a face in a photo, transcribes a voice memo, or unlocks the screen by matching your features. Hymalayas uses that chip to do the interpretive work that ordinary cloud-based wellbeing apps send to a remote server.

The bridge between the chip and the app is Core ML, Apple's framework for running machine-learning models locally. When you finish a reflection, Hymalayas hands the text to a small natural-language model that lives inside the app bundle. The model interprets the writing — recognising tone, valence, emotional texture — and returns a structured signal: a mood reading, a set of themes, a contribution to your Prana score. That interpretation is produced on the chip and sent to no outside model. Your reflection is then saved to your own synced account, but its meaning is never handed to anyone else.

On-device NLP — natural language processing performed locally — used to be a compromise. Models were small, results were rough, and serious work was sent to the cloud where bigger machines waited. That is no longer true. The neural cores in recent iPhones run models large enough to recognise sentiment in a paragraph of English, classify the dominant emotion in a Hindi mood note, or summarise the arc of a week of entries, all in milliseconds and all without a network request.

The practical consequence for you is invisible by design. The app feels responsive because the interpretation happens locally. The intelligence inside it appears to know your patterns because it does, and that knowing is computed on the device in your hand.

What we do not have, and what we do use

A useful way to describe an app's posture is by the tools it refuses and the tools it accepts. Hymalayas ships without ad networks, without any relationship with data brokers, and without ever sending your words to a third-party AI to be interpreted. Each of those absences is deliberate.

We embed no advertising SDKs, because the economic logic of mobile advertising is incompatible with a Sadhana. An ad network pays for the right to observe what you do, how often, and in what mood, and to use that observation to decide what to show you next. There is no version of that arrangement that respects the inwardness of a meditation practice, so we have signed none.

We keep no relationships with data brokers. No transfer agreements, no resale clauses, no embedded SDK that pipes audience data to a third party. The category of intermediary that buys and sells human attention appears nowhere in our supply chain.

We send your writing to no outside AI. The interpretation of a reflection happens on your own device, not in someone else's data centre, so the raw text of your inner life is never the input to another company's model.

Two ordinary tools do run inside the app, and honesty means naming them plainly. Firebase Analytics counts which features and screens are used, as anonymous category labels and totals, and never the text of your reflections, your mood notes, or your sankalpa. Firebase Crashlytics reports crashes so we can fix them. Neither ever receives the content of your practice; one sees that a screen was opened, the other that something broke.

Apple Intelligence

When Hymalayas reads the emotional weather of an entry, it is using Apple Intelligence — the umbrella name for the on-device and privately-hosted machine-learning capabilities that Apple exposes to developers. The sentiment work itself runs on the Neural Engine inside your iPhone, against models that ship with the operating system or with the app. The text of your entry is the input; a structured emotional reading is the output; both stay on the device.

What this means in practice is that the interpretation of your words happens without a server in the loop. Apple does not receive the text to run the inference, and no outside AI receives it either. The emotional reading is produced on your device and stays a private computation. Your reflection is later saved to your own synced account so the practice carries across devices, but its meaning is never outsourced to anyone's model.

For tasks that exceed the local model's capacity, should we ever introduce them, Apple offers Private Cloud Compute, an architecture in which the request is processed on hardened servers whose memory is wiped after the request and whose software is publicly verifiable. We have not yet needed it, and we will tell you plainly if we ever do. Until then, every line of interpretation in the app runs where your fingerprints already do.

The open privacy manifest

A privacy promise that cannot be inspected is just marketing. Hymalayas publishes, in full, the technical declaration of what the app does and does not do — the frameworks it links against, the entitlements it requests from iOS, how each category of data is handled, and the explanation in plain English of why each line is present.

The full breakdown lives at /on-device-manifest. It is written so that a careful reader without an engineering background can follow the claims, and so that a security researcher can check them. The two audiences read the same page. We think that is the right test for honesty in privacy writing: the document a layperson reads should be the document an auditor checks.

We will update the manifest whenever the app changes in a way that touches data handling, and we will note the change in plain language at the top of the page. Privacy is a practice, not a posture. Like any Tapas, it is sustained by daily attention rather than a single declaration.

Questions

Does Hymalayas store my written reflections in the cloud?

Yes, in your own private account. Your daily reflections and your sankalpa sync to a private account built on Google Firebase, so your practice continues if you move to a new device. The connection is encrypted in transit and at rest, and access is restricted by security rules to your authenticated account. What never happens is interpretation by anyone else: your words are read only by the on-device model, never sent to an outside AI, and never sold or shared.

Does Hymalayas use analytics?

Yes, in a narrow way. Firebase Analytics counts which features and screens are used, as anonymous category labels and totals. It never receives the text of your reflections, your mood notes, or your sankalpa — only that a feature was opened, not what you wrote inside it. There is no advertising SDK and no data-broker relationship.

How does Hymalayas analyse my moods?

All sentiment analysis runs on the Apple Neural Engine inside your phone. When you write a reflection, a small Core ML model interprets the words locally and returns a mood signal. That interpretation is never sent to an outside AI or handed to a Hymalayas server to be read. Your reflection text and your mood check-in do sync to your own private account so the practice carries across devices, but their meaning is computed only on your device.

Can Hymalayas employees read my reflections?

The honest answer is measured. Your reflections sync to your own area of our Firebase, where security rules restrict access to your authenticated account. Because it is our Firebase project, an administrator has technical access to the database, as with any hosted service — so we do not claim it is physically impossible for us to read. What we promise is what we do: we never sell or share your words, we never hand them to an outside AI, and we access your account only when you ask us to for support or when the law requires it.

Does Hymalayas sell data to advertisers?

No. We do not sell, share, license, rent, barter, or otherwise transfer your data to any advertiser, data broker, marketing platform, or aggregator. The business model is the price of the app. There is no second revenue stream built on your attention or your patterns, and there never will be — selling Sadhana data would dishonour the practice the app is meant to support.

What data does Hymalayas collect?

To run the app across your devices, Hymalayas collects an account and your written practice. Signing in with Apple or Google creates an account with your name, email address, and a user ID. Your daily reflections, sankalpa, mood check-ins, Prana tallies, and Wisdom Card history sync to your private account. Firebase Analytics adds anonymous feature counts, and Crashlytics adds crash diagnostics. What it does not do: your words are never sent to an outside AI, and your Apple Health data never leaves Apple Health for our servers.

Is my breathing session data stored in the cloud?

Your heart-rate and heart-rate-variability readings come from Apple Health and stay there — they are never copied to a Hymalayas server or to our Firebase. The record that you completed a breath session, along with the pattern and length, syncs to your own private account with the rest of your practice, so your history follows you. The health readings themselves remain inside Apple Health, under your control.

What happens to my data if I delete the app?

Deleting the app removes the local copy from your device. Your synced practice stays in your private account so you can restore it on a new device. When you delete your account, that synced copy is removed, and you can ask us to erase it at any time. Your Apple Health data is unaffected either way, because it lived in Apple Health, not with us.

Does Hymalayas comply with GDPR?

Yes. We collect the account and the written practice the app needs to work across your devices, keep it to that, and honour the rights GDPR grants: access, portability, and erasure of your account data. Your words are interpreted only on your device, never sold, and never shared with an advertiser or an outside AI. Where we hold data — your account on Firebase — you can ask to see it or delete it.

Is the privacy manifest publicly available?

Yes. The full technical breakdown — every framework the app links against, every entitlement it requests, and how each category of data is handled — lives at /on-device-manifest. It is written in plain language alongside the raw declarations, so a curious reader and a security auditor can both verify the same claims from the same page.