Where your data lives

On your phone, except what an app sends to the sites it lists. What you put into an app is saved in your phone’s browser storage, under that app’s own address. We keep the app’s code, its versions and their notes, so we can deliver it and its updates, never what you put into it.

• Each app is walled off: every app runs at its own address, so no app can read another’s data or your CloudCrane account.
• Only the sites it lists: an app can reach at most five websites, each shown with why on its install screen and in Apps (“Talks to api.open-meteo.com: the forecast”), or “Never leaves your phone” when it lists none. An update that adds a site names it on the update bar and opens only when you tap Update. It can’t load anything from, or send anything to, any other site, and its forms can only send to itself. A link in an app can still open another site, if you tap it.
• Not even your assistant: assistants can read and change an app’s code, never what you saved in it.
• The code isn’t private: anyone with an app’s link can open it and read its code, though not your data on your phone.

What removes it

Removing the app’s data in your browser’s settings (the website data for the app’s address) deletes what it saved, and so does removing the app from an iPhone’s home screen. A new phone starts empty: what you saved doesn’t move with you yet.

What’s planned

Encrypted backup, sync across devices, sharing an app with others, and reminders are planned, not offered today.

What an app can’t do: block ads (that needs a native app), read Apple Health, send notifications, or reach a website it doesn’t list. An app keeps working offline, even one that fetches a forecast when it can.