Privacy

Last updated 5 November 2026

Fearward is made by STUDIO668, a business registered in the Republic of Korea. This page says exactly what leaves your device, what does not, and who else touches it. It is short on purpose.

There is no account. You never give us a name, an email address, or a sign-in. Our server knows your copy of the app only by a random key your device generates for it, which changes if you delete and reinstall the app.

What you write stays on your device. Your entries, your threads, and the short summary the app keeps for itself live on your device — and in your iCloud backup, if you use one. We do not store them.

Speaking instead of typing. On iOS and iPadOS 26 and later, the app's own microphone turns your voice into text on your device. The sound never leaves your device, and we never receive it; the text it writes is treated like anything you type. The microphone key on your device's keyboard is different: it is Apple's Dictation, part of iOS or iPadOS rather than Fearward, and depending on your device and language Apple may process it on its servers under Apple's own privacy policy. Settings → General → Keyboard shows which.

Reflection is the exception, and only while it runs. When you start a Reflection, the writing it is reading travels over an encrypted connection through our own server to Anthropic, the company whose model answers you. We keep no copy. Our server records that a reflection happened, how large it was, which language it was in, and whether it succeeded — never any of the words — and after 90 days that record no longer says which copy of the app it came from. Anthropic is given no name with it, only a scrambled code for this copy of the app, so that misuse can be traced to one install rather than to everyone. With it goes the name and number of the helpline for the country your device is set to, when the app has one for it, so the AI can give them to you if you need them. Anthropic processes the conversation to produce the reply and does not use it to train their models. Anthropic is a company in the United States. It stores what it keeps there, and the AI itself may run on its servers in other countries. Under Anthropic's own policy, it deletes what it receives within 30 days, with exceptions: when its safety systems flag a conversation as breaking its usage policy, it may keep that conversation for up to 2 years and the systems' scores for up to 7 years, and it may keep information longer when the law requires it. That is Anthropic's policy, not ours, and it can change; the current version is on Anthropic's Privacy Center (privacy.claude.com). Never type passwords, bank or card numbers, ID numbers or anything like them into what you write — the AI does not need them to help you.

Your agreement to Reflection. Before a Reflection first sends anything, the app asks you to agree, and names Anthropic. When you agree, or withdraw, our server keeps a receipt: the date, which wording you were shown and a fingerprint of it, the random key of your copy of the app, and the app's signature on it — no name. Receipts are kept for as long as your agreement stands and for six years after it ends, and then deleted together. It ends when you withdraw in Settings or erase all data, or, if you simply delete the app, the last time it reached our server. The wordings themselves are kept for good.

Feedback. If you write to us through the feedback form, what you type is delivered to us as a message through Telegram, a messaging service, and is not kept on our server. The message also carries the app's version, the iOS or iPadOS version, your device's model and which screen you sent it from, so we can find what you mean. If you choose to add your email address so we can reply, it travels with that message and nowhere else. A Reflection reply you report is sent the same way, with only the text you leave on the report page.

Email you send us. If you email us — including a thread you choose to send with "Suggest this thread to the developer", which opens your own mail app with only the thread's name and questions in it, never your answers — we receive what you send and your email address. We use them only to reply to you and to improve the app.

Which threads you open. If you leave "Share which ones you open" turned on in Settings, the app tells our server the name of a thread when you open it — on its own, with nothing that identifies your device, and never a word of what you wrote. The server adds one to that thread's count for the day and keeps nothing else. The address your connection comes from is used for a moment to stop anyone flooding these counts, and is not kept. We use the counts only as totals and do not try to connect them to anyone. You can turn this off in Settings at any time, and it stops immediately.

When the app's memory of your writing does not work. When a Reflection opens, the app may ask the AI for a short memory of your older writing so the conversation can remember it. The memory is made only of sentences you wrote, and can include ones about hard times, such as not wanting to live. If that memory comes back unusable, or is not ready in time, the app tells our server that it happened and why, in one word — never the memory itself, and never a word of what you wrote. It is kept with the random key of your copy of the app for six months, and then replaced by a weekly count with nothing in it that points to your device. It is how we find out that this part of the app is broken, so like crash reports it cannot be switched off.

Crash reports. Distributed versions of the app send diagnostics when something breaks — the device model, the iOS or iPadOS version, the app version, and where in the code the failure happened — and a short note each time the app is opened, so we can tell how often it runs without a problem. Both carry a random code Sentry makes for this copy of the app, never your name. This is handled by Sentry. It never includes what you write; the app is built so that it cannot.

Proving the app is the app. Every request to our server is signed using Apple's App Attest, so that only a genuine copy of Fearward can reach it — except the name of a thread you open, which is sent unsigned so that nothing identifying your device goes with it. Apple's DeviceCheck is used once, and only to make sure the one free Reflection cannot be claimed twice by reinstalling. Neither tells us who you are.

Where our server runs. Our server runs on Cloudflare. Like any web host, it sees the network address your device connects from while a request is being answered; we do not store it.

Subscriptions. Payment is handled by Apple. RevenueCat records whether your copy of the app has an active subscription, filed under the same random key above. So that reinstalling the app does not start a subscription's monthly Reflections over, our server also keeps a code made from Apple's number for that purchase. The code cannot be turned back into the number, and it does not name you. We never see your payment details.

How the app is used. Each time one of a few steps happens — opening the app, finishing the first screens, saving a Line, starting or finishing a Thread, starting a Reflection (and whether it was the free one), seeing the subscription page, buying a plan — the app sends a short note of it to TelemetryDeck, which stores it in the European Union. With each note go the app's version, the device's model, system version and time zone, its language, region and accessibility settings, and a code made by scrambling an identifier for your copy of the app twice, once on your device and once by TelemetryDeck, so the notes can be counted by copy without saying which device it is. Nothing you write, no Thread's name, and none of the keys described on this page go with them. We use them only to see where the app is hard to use. Because the code cannot be traced back to your device, notes already sent cannot be picked out to delete; deleting the app stops them.

If you came from an App Store ad. When the app opens, it asks Apple whether an ad on the App Store led to it, and RevenueCat records the answer — which of our ad campaigns it was, if any — with your subscription status, under the random key above. This shows us which ads bring people who stay. Apple's answer names the ad, not you or your device; the app uses no advertising identifier and does not ask to track you.

This website. fearward.studio668.com counts visits with Cloudflare Web Analytics: how often each page is seen, which site a visitor came from, and the country and kind of device. It also counts taps on its App Store buttons. Both are totals, counted without cookies, and they do not say who you are.

We never sell your information, and there are no ads in the app. Nothing in it follows you across other companies' apps or websites. The companies named on this page handle your information only to run the app, to count how it is used, and to tell us which of our ads worked.

Deleting. "Erase all data" in Settings clears everything you wrote, and the app's own settings, from your device and, when it can reach our server, withdraws your agreement to Reflection. A few small things stay, none of them your words: whether App Lock is on; the random key of your copy of the app, with the subscription status RevenueCat files under it; a label for a Reflection that was about to start, and which Thread it began from; and the crash reporter's own random code for this copy of the app. Deleting the app removes those too. A yes-or-no mark that the one free Reflection was used stays in your device's keychain, which normally keeps it even after the app is deleted. There is no copy of your writing on our side, so there is nothing there to delete. Apart from feedback and email you choose to send us, what stays with us contains none of your words, and each part goes on its own: the record of each request — for a Reflection, its size — which stops pointing to your copy of the app after 90 days; a note of any request we turned away, deleted after 90 days; a note that a request is in progress, normally removed when it ends; a note when the app's memory of your writing did not work, kept with that key for six months as described above; your agreement receipts, kept as described above; the registration of your copy of the app, whether it used its one free Reflection, and its subscription status, all deleted six years after it last reached our server; and the anonymous counts described above. Once a week, the registrations, subscription statuses, free-Reflection marks and agreement receipts are copied into a private backup, and each copy is deleted after 35 days.

Where your information goes. We are in the Republic of Korea, and much of what leaves your device is handled outside the country you live in. Our server runs on Cloudflare, usually in a data centre near you, and the records it keeps are stored in Cloudflare's Asia-Pacific region. What a Reflection sends goes through it to Anthropic, a company in the United States, which stores what it keeps there and may run the AI in other countries. RevenueCat, which records your subscription status and which ad, if any, led you to the app, is in the United States, and so is Apple, which answers the App Attest and DeviceCheck checks. Crash reports go to Sentry and are stored in Germany, and the notes of how the app is used go to TelemetryDeck and are stored in the European Union. Feedback you send goes through Telegram, which stores messages in several countries. In each of these countries, courts and government bodies may be able to require access to it under that country's law.

Your rights. You can ask us what we hold about your copy of the app, ask us to correct it, or ask us to delete it, and you can withdraw your agreement to Reflection at any time in Settings. Because there is no account, we can find your records only by the receipt code shown in Settings → AI consent, so send that code with your request to the address under Questions. If you have no code, because you never agreed or you withdrew, say so; without it we may not be able to tell which records are yours. We answer within four weeks. We delete what the law does not require us to keep, and tell you what we kept and why. Asking never changes how the app treats you.

If you live in the United States. Some states give you the rights above by law; you have them wherever you live. If we turn down a request, you can ask us to look at it again, and if we still turn it down, you can contact your state's attorney general. Some of what you write may be health information under laws such as Washington's My Health My Data Act; how we handle it is set out in our Consumer Health Data Privacy Policy.

If you live in Canada. At STUDIO668 the person in charge of protecting personal information is the head of the business, and you can reach them at the address under Questions. If our reply does not settle a concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, in Quebec, to the Commission d'accès à l'information at cai.gouv.qc.ca.

If you live in Australia. If you think we have handled your information in a way the Australian Privacy Principles do not allow, email us at the address under Questions. If our reply does not settle it, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If you live in New Zealand. The companies named above are outside New Zealand, and the laws they work under may not protect your information in the same way as New Zealand's Privacy Act. If our reply to a concern does not settle it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

If you live in Singapore. Our data protection officer can be reached at the address under Questions. The companies named above are outside Singapore, and we use them only to run the app. If our reply to a concern does not settle it, you can complain to the Personal Data Protection Commission at pdpc.gov.sg.

Children. Fearward is for adults. It is not directed at anyone under 18, and we do not knowingly collect anything from them.

Questions. fearward_feedback@studio668.com