Privacy Policy
Last updated · April 2026
This explains what we collect, why, and what you can do about it. We don't sell your data. We don't run ads. We don't have an account system. There is nothing to log in to. The app sends a daily affirmation; everything else here is housekeeping.
Information We Collect
The list below is the complete set. If something isn't on it, we don't have it.
- Anonymized analytics events (PostHog). We log app interactions — examples include opening the app, viewing a daily card, favoriting an affirmation, sharing a card image, browsing or purchasing a pack from the tip jar, restoring purchases, changing scenes, and adjusting preferences. The events are tied to an anonymous device ID and not your name, your email, or anything else we could use to find you. We use the events to figure out which features people actually use. PostHog stores them. They expire after 1 year.
- Crash reports (Sentry). When the app crashes, Sentry receives a stack trace, the app version, the iOS version, and a short trail of which screens you saw before the crash. The PII scrubber is on. We don't attach the affirmation text, your favorites, or anything you typed.
- Anonymous device identifier. A UUID generated on first launch and stored in the iOS Keychain via Apple's Keychain Services. It survives reinstall. It is the PostHog distinct ID and the Sentry user ID, which is how we deduplicate sessions per device. It is not linked to any account because there is no account.
- In-app purchases (StoreKit). The tip jar (consumables) and content packs (non-consumables) are processed entirely by Apple. We never see your card number, billing address, or Apple ID. When a purchase succeeds, we record an analytics event with the product identifier and price tier and nothing else.
- Favorites and preferences (CloudKit). When you favorite an affirmation or change a setting, the row is saved to your own iCloud private database. Apple holds it. We do not. We could not pull your favorites if we wanted to, and we don't want to. Apple processes this data under your iCloud agreement; we are not the controller of the iCloud copy.
- Local notifications. If you turn on the daily reminder, iOS schedules it locally via UNUserNotificationCenter. There is no push token. There is no server. Nothing leaves your device for that feature. You can disable the daily reminder anytime in the app's Settings tab or via iOS Settings → Notifications → Meh.
What We Do NOT Collect
No name. No email. No phone number. No location. No contacts. No photos, microphone, camera, or health data. No ad ID (no IDFA, no IDFV). No cross-app tracking — Meh never shows the App Tracking Transparency prompt because it has nothing to ask for. If a list of things-not-collected feels longer than the list of things-collected, that's accurate.
How We Use Your Information
- Improve the app by looking at which features get used and which get ignored.
- Fix crashes when they show up in Sentry.
- Confirm a tip-jar purchase or content-pack unlock.
- Schedule the daily reminder you turned on, locally on your device.
That is the entire list. We do not build profiles. We do not retarget you. We do not sell aggregate data. There is no audience to sell.
Data Sharing and Third Parties
The third parties below are the only ones that touch any signal from the app.
- PostHog handles analytics. Their privacy policy is at posthog.com/privacy. Retention: 1 year.
- Sentry handles crash reporting. Their privacy policy is at sentry.io/privacy. Retention: 30 days on our current Sentry plan (the Developer-tier default).
- Apple StoreKit processes purchases. Apple CloudKit stores your favorites and preferences in your own iCloud database. Both are governed by Apple's privacy policy at apple.com/legal/privacy.
We do not share data with advertising networks, data brokers, or any other third parties.
Data Retention
PostHog events are kept for 1 year and then deleted. Sentry crash reports are retained for 30 days on our current plan. Your Keychain device ID lives on your phone until you delete the app and reset the Keychain. Your iCloud favorites and preferences live in your iCloud account for as long as you keep them; we cannot reach them.
Your Rights
You can ask us to delete the analytics and crash data tied to your device. You can stop us collecting any more of it.
- Access or deletion. Email [email protected]. Because the only thing identifying you is the anonymous device ID, include that ID with your request. You can find it in the app: Settings → About → "Device ID" (tap to copy). Without the ID we have no way to find your data; that is the trade-off for not collecting your name.
- Stop analytics. Open the app, go to Settings, and turn "Analytics" off. After that we capture nothing on this device. The setting is sticky per device — once off, it stays off until you turn it back on.
- Delete iCloud favorites. iOS Settings → your name → iCloud → Manage Account Storage → Meh → Delete Data from iCloud. That clears the favorites Apple holds for you.
Children's Privacy
Meh is rated 13+ on the App Store and is not directed to children under 13. We do not knowingly collect data from children under 13. We have no age gate because we collect no personally identifiable information — there is nothing to attach to a child even if one used the app. Parents who want to prevent installation can use Apple's Screen Time and Family Sharing controls. If a child has used the app and you want their device-ID data deleted, email [email protected] with the device ID and we will remove the analytics and crash entries tied to it.
California (CCPA / CPRA) Notice
If you are a California resident, the CCPA / CPRA gives you the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights.
Mapped to the CCPA's enumerated categories, what we collect is: Identifiers (the anonymous device ID), Commercial information (purchase records via StoreKit, captured as product ID + price tier), and Internet or other electronic network activity information (the in-app interaction events listed above). We do not collect any other category — no geolocation, no sensory data, no professional or biometric information, no inferences drawn from any of it.
We do not sell or share personal information as those terms are defined under the CCPA / CPRA, and we have not done so in the preceding twelve months. Because there is no sale or sharing, no opt-out mechanism is required, but you can still disable analytics entirely using the in-app toggle described above. To exercise any CCPA right, email [email protected] with the device ID.
EU / UK (GDPR) Notice
If you are in the EU or UK, the GDPR gives you rights of access, rectification, deletion, restriction, portability, and objection regarding personal data we process about you.
Lawful basis (per processing activity): we rely on your consent for analytics events (which you can withdraw at any time via the in-app toggle); on our legitimate interest in keeping the app stable for crash reports; on performance of a contract for in-app purchases; and on Apple's separate iCloud agreement with you for CloudKit favorites and preferences (we are not the controller of that data).
International transfers: PostHog and Sentry are US-based processors. Transfers from the EU and UK rely on the Standard Contractual Clauses incorporated into their Data Processing Agreements. Apple's role for StoreKit and CloudKit is governed by Apple's own iCloud and App Store terms.
To exercise any GDPR right, email [email protected] with the device ID. We respond to data-rights requests within 30 days (GDPR) or 45 days (CCPA), whichever applies and whichever is shorter.
Changes to This Policy
If we change this, we update the date at the top and note material changes in the app's release notes. We won't quietly add a new third party and pretend we always did.
Contact
Email [email protected]. There is no phone number. There is no chat widget. It is one inbox a person reads.
That's all of it. Thanks for reading the boring page.