Privacy Policy
Effective date: 2026-08-25
Courier is a health-data relay: you choose what leaves your device, and where it goes. This policy covers the Courier iOS app and the optional Courier Cloud service (sign-in, hosted storage, AI editorial summaries, web archive).
The short version
- Without an account, we collect nothing. The app reads Apple Health data on your device and sends it only to endpoints you configure yourself. That data never touches our servers.
- With a Courier Cloud account, we store what the app publishes for you — health summaries, workout series, and your notes — solely to show it back to you and to write your AI summaries, unless you deliberately switch on the Public Archive from your account page (see the dedicated section below; off by default).
- We never use your health data for advertising or marketing, never sell it, and never share it with data brokers. This is also a binding commitment under Apple's App Store health-data rules.
Data we store (Courier Cloud only)
| Category | Contents | Purpose |
|---|---|---|
| Account | Sign-in identifier (Apple/Google/email), email address, plan | Authentication, service emails |
| Health summaries | Daily sleep summaries, workout summaries with downsampled heart-rate and route series, workout events | Your web archive and charts |
| Notes | Annotations you write or dictate in the app | Your archive; input to your AI summaries |
| Reports | AI-generated weekly/monthly/annual summaries | Shown in app and web |
Full-precision health data stays in Apple Health on your device; the cloud stores a reduced "print edition" only.
AI processing
To write your editorial summaries, your recent health summaries and the text of your notes are sent through Cloudflare AI Gateway to a third-party large-language-model provider. Payload logging at the gateway is disabled — request and response bodies are not stored there. This content is used only to generate your report, is never used to train models, and is not retained by us beyond the generated report. The providers currently in use, together with their regions and retention rules, are listed on the sub-processor list, which we keep up to date; we only use providers whose terms are consistent with the commitments in this policy.
Public Archive (optional, off by default)
Your archive is private by default and visible only to you when signed in. You may deliberately switch on the Public Archive from the web account page: once on, anyone with your dedicated address can browse your public pages without signing in. That includes:
- your pen name;
- daily sleep summaries (including sleep stages);
- workout summaries with downsampled heart-rate and other metric charts;
- workout routes — trimmed by 1 km at each end by default (routes shorter than 200 m after trimming are not drawn at all), with single-point venues hidden by default; both settings adjustable on the account page;
- notes you set public individually (private notes are never published).
Your email address, sign-in methods and other account information never appear on public pages. Switching the archive on is your deliberate disclosure of the content above to the public; while it is on, pages may be saved or reshared by any visitor, or indexed by search engines. Switching it off unlists immediately; CDN-cached copies expire within about 5 minutes.
Retention
- Your hosted data and reports are kept for as long as your account is active — free and paid plans alike.
- Inactive accounts: if an account records no activity (no sign-in and no data delivery) for 12 months, we email you a reminder; simply signing in keeps the account. Thirty days after the reminder, still-inactive accounts and all their data are permanently deleted.
- Deleting a note in the app also deletes its text on our servers. Closing your account permanently deletes all stored data.
Your rights
Export everything (full JSON) or delete your account at any time from the web account page — both are free-plan features too.
Sub-processors
Cloudflare (hosting, storage and AI gateway), third-party AI model providers (never used for model training; each provider's region and retention rules are governed by the sub-processor list; accessed only through Cloudflare's gateway), Resend (email delivery), Paddle (payments — Paddle is the merchant of record and processes payment data under its own policy). We do not run third-party analytics or ad SDKs. The authoritative, always-current list — naming each provider with regions and retention rules — is the sub-processor list.
Governing language
This document is written in Simplified Chinese and provided in English for convenience. In case of any discrepancy or conflict between language versions, the Simplified Chinese version prevails.
Contact
[email protected] · This policy may be updated; material changes will be announced in-product.