YourCelf · Sovereignty
Last updated 10 October 2026 · Home
YourCelf is built on one principle: your memories are yours. There is no account. The app reads your photo library on your phone, and anything you share with a Circle is sealed on your phone so that only the people you chose can open it. We never hold a key that opens it. The one time we receive a readable photo, post, or comment is when it is reported to us, and that is set out below.
YourCelf has no analytics, no advertising, and no third-party tracking, and we never sell or share personal information. Your photos, captions, and everything you share through Circles are sealed on your phone, and we never receive a readable copy of them unless something you shared is reported. These things do reach us:
Your key fingerprint. To deliver sealed content between phones, your phone’s public-key fingerprint travels to our relay, so the relay knows which sealed block belongs to which phone. A fingerprint is a pseudonym, not your name, but it identifies your phone to us, so we treat it as personal data. It is the “User ID” on our App Store privacy label. We use it to deliver sealed content, to check that what reaches our relay comes from YourCelf (below), and to act on reports, never to track you. If a report shows someone has broken our rules and we stop our relay accepting anything more from them, the relay keeps their key fingerprint, and the date we did it, on its list of refused keys until we lift the refusal.
A check that the app is YourCelf. On a phone that supports it, YourCelf uses Apple’s App Attest so our relay can check that what it receives comes from a genuine copy of YourCelf on a real Apple device. Your phone makes a separate key for this, held in its Secure Enclave, and asks Apple to vouch for it. Apple handles that request under Apple’s own privacy policy. Our relay checks Apple’s answer, and then keeps a record filed under your key fingerprint: that key’s public half and its ID, whether the app is a release build (from the App Store or TestFlight) or a development build, a count the relay uses to spot replayed requests, the day the key was checked, and the day your phone last used it. It does not keep Apple’s answer itself, and the record holds no name and nothing about your device beyond that key. The relay deletes the record once 30 days have passed since the day your phone last used it, and your phone sets it up again when it next needs it.
A report, only if one is filed. If you report a post, a comment, or a reply, you send it to us unsealed so a person on our team can act on it: the reason you pick and anything you write, what the person wrote, the photograph if there is one and the signature their phone added to it (if it has one), their name and key fingerprint, the circle’s name and ID, the post’s ID, your name and key fingerprint, whether your phone’s sensitive-content check flagged the photo, and your email address if you add one. We check the signature and keep what we found with the report. If someone reports a post, comment, or reply of yours, their report contains your photograph (if there is one), your words, your name, your key fingerprint, which circle and post it was in, and the signature your phone added to the photograph, if it has one (it carries your public key and the time your phone signed it). We keep a report for 90 days and then destroy it. If the law requires us to pass a report to the authorities, we must keep it for one year from the day we do.
Invite links, when they reach our website. An invite link carries the circle’s name and ID, the inviter’s name, public key and key fingerprint, a one-time code, when it expires, and the address of the relay the inviter uses. With YourCelf installed, tapping the link opens the app directly. If the link is opened on a phone without YourCelf, or a messaging app fetches it to show a preview, our website receives the whole link, including those details, and our website host may record it in its request logs. Replies that travel as links, when a phone can’t reach our relay, work the same way: they are sealed, but show the key fingerprint of the phone they are for.
Connection details and email. Like any server, our website, relay, and report server see the IP address each connection comes from, and when. Our website is hosted by Vercel, and our relay and report server run on a server we rent from Hostinger. We use these details only to run the service. Some pages of our website load fonts from Google, and one loads a script from cdnjs (Cloudflare), so those companies receive your IP address when you open those pages. If you email us, we receive what you send, use it only to reply, and never add you to a list.
Photos. The app reads your photo library on your phone to find the days, trips, places, and people that recur, and gathers them into Story. Face grouping and Story’s text are produced on your phone. If your iPhone has Apple Intelligence turned on, Story can also suggest a caption when you share a day: Apple’s on-device model writes it on your phone, and the caption goes anywhere only if you use it and share the post. No readable copy of your photos is uploaded to us, except a photograph that is reported (above).
Place names. Story names a place first from a list of towns kept on your phone, adapted from GeoNames (geonames.org, CC BY 4.0). To name it more closely, your phone sends Apple Maps an approximate location, the centre of an area about 500 metres across, never a photo. It asks about up to 20 places at a time, sometimes while the app is in the background. Apple handles that request under Apple’s own privacy policy, and we never receive it.
Photos kept in iCloud. If a photo is stored only in iCloud, your phone fetches it from iCloud Photos, through Apple, not through us: when the app shows it to you, when you share it, and, if you allow iCloud photo analysis, so it can be read on your phone.
Camera. Used only to scan a circle’s invite code. It is on only while that screen is open, and nothing it sees is captured or saved.
Contacts. If you name a person by picking a contact, iOS shows its own contact picker, and the app uses only the name of the contact you pick. The app does not read your address book.
Your keys and backups. Your phone makes its own keys. If you turn on recovery or make a backup, the keys that open them are kept in your iCloud Keychain, which Apple end-to-end encrypts, and we never receive them. Backups YourCelf makes stay on your phone. Like any app’s data, YourCelf’s is also included in your phone’s own iCloud or computer backup if you have one turned on.
What the app does not ask for. YourCelf does not ask for your location, your calendar, or your Health data, and has no access to them.
Sharing happens only when you choose to share. When you share with a Circle, the content is sealed (end-to-end encrypted) on your phone so that only the people you include can open it. We never hold the keys, so we cannot read it.
Delivery through our relay. Sealed content travels over TLS through our relay, which holds the sealed blocks, unable to open them, for up to 30 days until the other phone collects them. For each block it stores the sender’s and the recipient’s key fingerprints, the block’s size, and when it arrived. That is a record of which phone keys sent sealed blocks to which, and when. It is not nothing, so we say so here. The relay never receives a readable photograph. Phones also send each other small sealed requests this way: for example, a phone that is missing a photograph from a post asks the phone that sent the post to send the photograph again. The relay sees the same things about these as about any other block.
Checks for requests to join. If you turn on the heads-up for requests to join, your phone also asks the relay now and then, while YourCelf is closed, whether someone has asked to join. The relay sees those checks the way it sees any other: your phone’s key fingerprint, the time, and the network address. While an invite you made is on screen, and for ten minutes after you make it, the open app also asks every few seconds.
Nearby. Some sharing screens can also hand a sealed copy directly to a phone in the same room over your local network, or send it through AirDrop or Messages. It is sealed the same way, and it does not pass through us.
Sharing outside YourCelf. Some older Story screens offer Share…, which first lists what will leave your phone, then hands it to the app you pick through the iOS share sheet, such as Mail or Messages. That copy is not sealed. What happens to it next is up to the app you chose, and it does not pass through us.
Copies. Once someone you shared with receives content, they hold their own copy on their own phone, like a photo you text to a friend. Share with people you trust.
Most of what YourCelf knows lives only on your phone, so you control it directly. Settings can save what YourCelf has recorded to a file you keep (your photos themselves stay in your Photos library), and Delete everything erases YourCelf’s data from your phone, including every backup YourCelf made. No request to us is needed for what it can’t reach on our relay: sealed blocks go when they are collected or after 30 days, and your phone’s App Attest record (above) once 30 days have passed since the day it was last used. A key on the relay’s list of refused keys stays there until we lift the refusal.
What we hold ourselves is only what is described above: sealed blocks and key fingerprints on the relay for up to 30 days, an App Attest record for each phone until 30 days after the day it was last used, the relay’s list of refused keys, reports for as long as set out above, a log of what we did with each report, routine connection logs (including our website host’s request logs, which can contain an invite link), and emails you send us. Our relay and report service run on one server, and our host, Hostinger, backs it up once a week and keeps the two most recent backups, so a copy of anything on it, reports included, may outlast the times given here by up to about two weeks. Sealed blocks stay sealed in a backup. Privacy laws such as the California Consumer Privacy Act give you rights to know about, access, and delete personal data a company holds about you. To use them, write to hello@beyourcelf.com. We will tell you what we hold and delete what the law allows us to. A report we have passed to the authorities must be kept for the year the law requires. We do not and will not sell or share personal information.
YourCelf is for adults, 18 and over. The app checks your age before you can use it and does not let in anyone who says, or whose phone says, they are under 18. It is not directed at children, and we do not knowingly collect information about them, apart from what a report sent to us contains.
If this policy changes, we will update this page and revise the date above. If we ever change what reaches us, this page will say so before the app does it.
YourCelf is developed by Lil Dog Productions, LLC, Los Angeles, California, United States. Questions about this policy or your privacy? Email hello@beyourcelf.com.
The Service is controlled and operated from the United States and is intended exclusively for users located within the United States. We do not intentionally offer services to or solicit data from individuals in the European Union, European Economic Area, or United Kingdom.