Privacy Policy

Who this policy covers

This policy covers Serial & Story, an iOS app published by Anchorwright. It applies to the app itself and to Apple’s own services the app relies on (iCloud/CloudKit, StoreKit). It does not cover any other app, website, or service.

Contact

Questions about this policy or how the app handles your information: hello@anchorwright.com.

What the app stores, and where

Everything you enter into Serial & Story — item descriptions, room/location, make and model, serial numbers, purchase price and current value, retailer, warranty date, photos (item, serial closeup, receipt, and for vehicles, an additional document photo), and the optional “Story” fields (how you got it, the memory behind it, who you’d want to have it) — is stored as a Item record on your device.

Every one of those fields is encrypted on your device, using AES-256-GCM, before the app writes the field to disk or syncs the field anywhere. The encryption key is generated on your device. “How the encryption key is protected,” below, sets out where copies of the key go. Encryption happens automatically, with nothing to turn on.

What is not encrypted. A small amount of metadata is stored without encryption, on your device and in iCloud, so the app is able to sort and filter your items: each record’s ID, the date and time the record was created, each item’s bundle (Household, Equipment, Vehicles, Collectibles & Jewelry or Firearms), the item’s type label within the Firearms bundle (Firearm, Accessory or Ammunition), and, for each item included in an attorney handoff export, the date of the last such export. Apple’s servers hold those details in a form Apple is able to read. Someone reading them would learn, for example, how many records your account holds, when each was created, and whether any sits in the Firearms bundle. No description, serial number, value, story or photo is stored unencrypted.

iCloud sync is part of Serial & Story+, the app’s subscription. With an active subscription, your encrypted item data is also stored in your own private iCloud account, through Apple’s CloudKit service, so your other devices signed in to the same Apple ID receive the same inventory. For the content of your items (descriptions, photos, values), Apple’s servers receive and store ciphertext, together with the unencrypted metadata listed above. Without a subscription, or when iCloud is unavailable (not signed in, sync disabled, or restricted by your device’s settings), your item data stays on the one device. One thing still reaches iCloud without a subscription. On any device signed in to iCloud, the app keeps a protected copy of your encryption key in your own account. “How the encryption key is protected” describes the copy.

Your own contact information (optional)

If you fill in the optional owner profile (Settings) — your name, email, phone, and address, used to stamp the insurance/police and attorney exports with who the inventory belongs to — the app stores and protects those details the same way as your item data: encrypted on your device before the app writes any of them, and synced to your own private iCloud account only with an active subscription. Anchorwright never receives them. They appear in the documents the app generates for you, which is their purpose. The app sends them nowhere else.

Anchorwright has no access to your item data or your key. We run no server for this app, and neither one ever reaches us. The app encrypts the content of your items before handing the data to CloudKit. What Apple is able to open depends on how your key is protected in your iCloud account, set out next.

How the encryption key is protected

The key is created on your device and stored in your device’s Keychain. Two copies leave the device. Both stay inside your own Apple account.

iCloud Keychain. With iCloud Keychain on, the key syncs across your own devices through iCloud Keychain, the same end-to-end encrypted mechanism Apple uses for your saved passwords and Wi-Fi credentials. Apple states it holds no keys to end-to-end encrypted data.

A key record in your private iCloud database. On any device signed in to iCloud, with or without a subscription, the app also keeps one copy of the key in your account’s private CloudKit database. The record makes sure two of your devices never end up with two different keys. The copy sits in a CloudKit encrypted field. Inside the field the app adds a second layer of its own, built from a value compiled into the app. Treat the second layer as a guard against a damaged record and not as a secret kept from Apple.

How private the key record is depends on your iCloud settings. Apple says CloudKit encrypted fields belonging to third-party apps are end-to-end encrypted once you turn on Advanced Data Protection for iCloud. With Advanced Data Protection on, Apple holds no key to the record. With iCloud’s standard data protection, which is the default, Apple keeps the encryption keys for most iCloud data in its own data centers, and the key record is not end-to-end encrypted. On the default setting, assume Apple has the technical means to open the key record and, with the key, the content of your items. Apple’s own policies govern when Apple accesses iCloud data. For the strongest protection, turn on Advanced Data Protection in your iPhone’s iCloud settings. Apple’s support article “iCloud data security overview” explains both settings.

You are also able to view and export your own recovery key from within the app (Settings), for cases where you need to restore access independent of iCloud Keychain. Storing the export safely is your responsibility. Anyone who has the key is able to decrypt your item data.

Subscriptions and purchases

Serial & Story+ is offered as an auto-renewable subscription through Apple’s App Store, via StoreKit. Apple handles the transaction — Serial & Story never receives or stores your payment details. The app only checks with Apple whether you currently hold an active subscription, in order to unlock the features that come with it. Refunds, billing, and subscription management are handled entirely through your Apple ID account settings, not by us.

Camera, photo library, and voice dictation

• Camera and Photos: if you choose to add a photo to an item (item photo, serial closeup, receipt, or document), the app asks for camera access (to take a photo directly) or uses Apple’s system photo picker (to choose an existing one, which needs no separate permission). Either way, the resulting photo is encrypted the same way as every other field before it’s stored.
• Voice dictation: if you use the microphone button on a Story field, speech-to-text happens entirely on your device, using Apple’s on-device speech recognition. Your voice is never sent to Apple’s or anyone else’s servers for this feature.
• Receipt and serial scanning: the on-device camera-text-recognition feature that helps fill in a serial number or receipt detail from a photo also runs entirely on-device. No image or extracted text is sent anywhere for this purpose.

Notifications

If an item has a warranty expiration date, the app can remind you shortly before it expires, using Apple’s local notification system. This is scheduled entirely on your device — no server, and no third party, is involved in delivering it.

Separately, the app can display short announcements from us (for example, a note about a new version) inside the app. These are fetched from a public, read-only Apple CloudKit database that contains only the announcement text itself — never anything about you or your data — and the app may use Apple’s silent push mechanism as a “check for new announcements” signal. No visible push notifications are sent, no alert/badge/sound permission is requested for this, and nothing about you travels in either direction beyond the standard Apple infrastructure involved in any iCloud-using app.

Exports (PDF and CSV)

The app can generate PDF and CSV documents from your data — an insurance/police report, a story to share, a bulk export, or an attorney handoff document. These are generated entirely on your device. When you export one, iOS’s standard share sheet opens so you can choose where it goes (Mail, Files, AirDrop, Messages, or anywhere else you pick) — the app itself does not transmit the export anywhere. Temporary copies used to generate the export are deleted from the app’s storage once the share sheet is dismissed.

What we don’t do

• No accounts, no sign-in, no password of any kind — including Sign in with Apple, which the app doesn’t offer because there’s no account system for it to sign into.
• No analytics, telemetry, crash-reporting, or advertising SDKs of any kind. Nothing about your use of the app is tracked or sent anywhere for those purposes. If the app crashes or hangs, Apple’s MetricKit framework may deliver a diagnostic report — a technical stack trace and device state, never your items or their content — which the app records on your device only; it is never transmitted by the app, and no third-party service is involved.
• No third-party SDKs at all. The only outside code the app depends on is Anchorwright’s own first-party library.
• We do not sell, rent, or share your data with advertisers or data brokers. There is nothing to sell — Anchorwright cannot read the encrypted data in the first place.
• No barcode, VIN, or product-catalog lookups against any external database. Every field is either something you typed or something read from a photo you took, entirely on your device.

Apple’s App Privacy disclosure

Apple’s own “App Privacy” nutrition label for this app, shown on its App Store product page, declares six categories as collected, for App Functionality only, and never used to track you: Photos or Videos, Other User Content, and — grouped under Apple’s Contact Info heading — Name, Email Address, Phone Number and Physical Address. The four Contact Info categories are the optional owner details described above, which the app prints on the reports and handoff documents you generate. Every one of the six is marked linked to your identity under Apple’s specific definition of that term (which turns on whether data has been de-identified/anonymized, not on whether the developer can technically read it) — your data is encrypted, but it is still your own data, tied to your own Apple ID and devices, not anonymized in Apple’s sense. This policy is consistent with that label, not a substitute for it.

Children’s privacy

Serial & Story is a general-purpose personal-property documentation tool, not directed at children, and does not knowingly collect information from children under 13. If you believe a child has provided information through this app, contact us at the address above.

Your choices and controls

Because there’s no account for us to hold, most of the usual “your rights” mechanics work differently here — you already have direct control:

• Access and export your data: CSV export, the single-item insurance report and the story share are available to you at any time, in every bundle. Each produces a copy of the underlying data in a portable format. The attorney handoff export and the Report Multiple Items export are part of Serial & Story+.
• Delete data: deleting an item removes the item from the app. Deleting the app removes everything stored on the device. To remove what the app keeps in iCloud, including the key record, use your device’s iCloud storage settings, the same way as for any other app with iCloud data.
• Turn off sync: if iCloud sync isn’t available or is turned off at the device/account level, the app simply stores data locally on that device instead.

If you’re in a jurisdiction that grants specific statutory rights (for example, GDPR or California’s CCPA/CPRA), the mechanisms above are how those rights are exercised in practice for this app, since there’s no separate account or backend record to request access to or deletion from beyond what’s described here. If you have a request this document doesn’t clearly answer, contact us at the address above.

Data retention

Item data persists for as long as you keep it in the app. There is no separate retention period we impose — you control how long anything is kept, and deletion (of an item, or of the app) is immediate and local, propagating to your other synced devices the same way any other change does.

One deliberate exception: if you have used the attorney handoff export, the app keeps a small encrypted snapshot of each exported item’s legal-essential fields (description, intended recipient, value, and valuation date/basis) even after that item is deleted — that’s what lets your next attorney handoff honestly report “removed since your last export,” which someone handling an estate needs to know. These snapshots are encrypted and synced exactly like item data, and deleting the app removes them along with everything else.

International users

Serial & Story is distributed through the App Store in a limited set of countries, and the list can change. The App Store page for the app is the current word on where it is available. If you use the app outside the United States, your encrypted data may be processed on Apple’s infrastructure in the United States or other countries where Apple operates iCloud/CloudKit, as part of the sync described above — the same infrastructure any iCloud-syncing app uses. The content of your items reaches Apple’s infrastructure already encrypted on your device. The metadata listed under “What is not encrypted” and the key record described above are stored there under iCloud’s own protection.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we’ll update the “Last updated” date above and, for a material change, note it within the app.