The short version
- Your list, notes, settings and local history are stored on your device.
- Personal sync is optional. Records are encrypted before upload.
- List sync and block-history sync are separate. History sync uses a file host as well as a relay.
- Earlier history sync included profile and timer settings inside encrypted block records. Read the version note before using it.
- The open-source edition can share chosen work with a KithMoot room. Its members and chosen agents can read that work.
- Den has no analytics, advertising or automatic crash reporting.
- You can export your data. A backup contains private settings too; you choose where it goes.
What Den stores, and where
Den keeps its local copy on the device you are using: your list, your threads, notes, dated things, the blocks you have run, your chosen background photo, and how you have the app set up. On a phone that is the app's own private storage. In a browser it is that browser's storage, on that computer.
Android's own backup is switched off, so the phone does not copy Den's files to anyone's cloud on your behalf. That is checked against the release file before each version is published, not against a setting somebody remembers changing.
On iPhone, Den marks its Documents and Library folders as excluded from Apple's device backup. Choosing iCloud Drive in the export sheet saves a copy there.
Den does not create an account in a Vitark application database. Optional network services hold the copies described below.
Den reads the clipboard when you tap Paste in Notes or Paste words in recovery. Copy writes the note or recovery words you chose. Den does not watch the clipboard or other apps. Recovery words are made on your device; they are not sent to the relay. Background photos are resized and encoded again as JPEG; the saved copy does not retain the original photo's location or camera metadata.
When Den connects or sends data
If you turn list sync on
List sync starts off. When you enable it, notes, tasks, threads and dated things travel between your devices through the relays you add in Settings. Den does not choose a relay for you and ships with none, from version 1.6.3. Records are encrypted before upload and can be read with your sync keys. A person who has those keys can read them too.
The relay receives encrypted records, a public key used for sync, timing and sizes. It can see the connecting IP address. Content and recovery words are not readable by the relay. List sync does not include your starting setup, timer preferences or background photo.
Each list item asks the relay to expire it thirty days after its last refresh. Each relay has its own logging, deletion and backup rules and may ignore expiry requests, so choose relays whose policies you are happy with.
If you sync block history
Where offered, block-history sync is a separate action in Settings. It needs a connected identity and runs when you tap Sync now. Encrypted files go to the storage host you choose there. Den does not choose one for you, and history sync waits until you have. An encrypted index is published through the relays you added for list sync; without one, history sync does not run. The file host and relay can see IP addresses, public keys used for these requests, transfer times and sizes. They cannot read the encrypted records without your keys.
History sync in releases up to 1.3.2
These releases can upload the complete local block record, encrypted. Alongside block times, durations and outcomes, that record includes your chosen profile, timer settings, proposed length, start and interruption details, break lengths, parked-thought count, and any rating or drift report you entered. Our earlier policy said settings were never synced. That was incorrect for this separate history path.
Version 1.4.0 sends only block identifiers, times, durations, outcomes and thread references, with the edit and deletion markers needed for sync. Until you have version 1.4.0 or later, leave block-history sync unused if you want the private capture to remain solely on your device. List sync can be used independently.
The list relay's thirty-day expiry does not cover history files. A history host controls its own retention and backups. Turning sync off, disconnecting your keys or installing a corrected release does not erase earlier uploads. Den has no control that guarantees removal of every history copy from a third-party host. Use a host you control if you need to control its retention.
If you share work with KithMoot
This is available in the open-source edition. Store editions exclude it. Connecting to a room contacts its service. Sharing sends the task and assignment details you choose to that room. Room members and any agents you assign can read those details. This is separate from private sync between your own devices. A room operator or agent provider controls its own records, logs and retention. Share only the work you intend those recipients to receive.
If you connect an external signer
Where offered, connecting a signer contacts the app or service you choose to authorise signing and encryption. That service may use its own relays and logs. Its provider's policy applies to that connection. Creating local recovery words does not upload those words anywhere.
Wear OS and your paired Android phone
The Wear OS app keeps its work timer, its countdowns and pending thoughts on the watch. Sending completed blocks and captured thoughts to Den on your paired Android phone is a separate choice, initially off. When enabled, the transfer includes the text you entered, timer history and identifiers used to avoid duplicates. Google Play services carries it over Bluetooth or, when needed, an end-to-end encrypted cloud connection. This is separate from Den's optional personal sync. Turning the choice off stops new sends and requests removal of queued transfers; a copy already received can remain on the phone.
Opening the browser app, help or an update check
The browser app downloads its files from our website. Opening the privacy or support page also contacts the website. Where Settings offers a manual version check, it contacts the site only when you tap it. These requests expose ordinary connection information to the web host, including IP address, time, requested page and browser information. They do not send your tasks, notes or timer settings. The iPhone app gets updates through the App Store.
Den has no analytics, advertising identifier or automatic crash-report upload. Its error journal keeps recent errors locally. If you choose to copy one into a support message, read it first: an error may include text from something you were doing. Support receives your email address and whatever you send. Never send recovery words or a full archive.
What sync includes and excludes
List sync excludes your setup and background photo. The older block-history behaviour is described above. A background photo is not part of a block record and is not uploaded by either personal sync path.
Back up everything includes the local settings, background photo and records available on that device so you can restore them. The export is an ordinary readable file, not an encrypted cloud backup. You choose its destination and who receives it. If you save it to a cloud drive or send it to someone, that service or recipient receives the file, including its private details.
Den has four optional setup choices and no assessment. They change how the app behaves; nothing is scored, and no result is produced about you. Den is a work timer. It does not ask for a diagnosis or make one.
What the app asks your phone for
On Android: vibration, notifications, keeping the screen awake, a foreground service, an exact alarm, network access for the optional connections above, and the fingerprint prompt. A stronger cue can request a full-screen notification; Android and your permission settings decide how it appears.
On iPhone: notifications, network access for the connections above, Face ID for locked sync keys, and the Files sheet when you choose to export or import. Choosing a background opens Apple's photo picker. Den receives only the photo you select. Den never sees your face and does not receive access to the rest of your Files or photo library.
On Wear OS: notifications, vibration, exact alarms and restoring saved timers after a restart. Optional phone handoff uses Google Play services. System voice input receives speech through your selected input provider; Den receives the resulting text and does not request microphone access.
Den does not request access to: which other apps you run, the list of installed apps, location, microphone, camera, your logs, your contacts, unrestricted external storage, and drawing over other apps. Keyboard dictation is provided by your operating system or keyboard, under its own settings and privacy policy. Den receives the resulting text; it does not record the microphone.
Getting your things out, and deleting them
Settings has Back up everything. It writes ordinary JSON with documented field names, a table you can open in a spreadsheet, and a list of checksums so you can tell nothing has been altered. If Den disappeared tomorrow, what you exported would still open in a text editor.
To delete the device copy, uninstall the app, or clear the site's storage in your browser. If you turned sync on, stop using list sync and each item asks your relays to expire it thirty days after its last refresh. Each relay keeps to its own retention and backup rules, so add a relay you run yourself if you would rather control that policy directly. Block-history files and copies shared with rooms, agents, support or a cloud drive follow their own retention rules. Uninstalling Den does not delete those copies.
Children
Den is made for adults and is not directed at children. It never asks for an age. Optional sync handles the same encrypted records and timing described above, whatever the age of the person holding the phone. It does not create a child account or collect anything specifically about a child.
Changes to this page
If what Den does with your data changes, this page changes with it and the date at the top moves. Every published version of the app is listed in what changed in each version, so you can see when.
Who publishes this
Den is a ForgeSworn open-source project. This page describes the open-source edition and this website. The Den apps in the app stores have their own privacy notice and support page, which name their publisher: store app privacy and store app support.
For questions about this page, open an issue at github.com/forgesworn/den. Do not post recovery words, sync keys or an exported archive there, and keep personal details out of a public issue. We cannot read your encrypted sync records or recover your keys. The support page explains what to include when asking for help.