What actually leaves your phone — and when

Nothing leaves the device unless you bring your own key. Reflection Space has no account, no first-party servers, and no analytics in the app; your reflections live on your phone, and on iOS they sync only through your personal iCloud. If you add your own key for OpenAI, Claude, Gemini, or Grok, the content you ask it to analyse goes to that provider and comes back — and only then.

What stays on your phone

Everything you write and record: your templates and their questions, every answer, every metric value, photos, voice memos and their transcripts, milestones and streaks. On iPhone and iPad this is stored on the device and, if you turn it on, in your own iCloud — Apple’s account, Apple’s servers, your data, which we cannot read. On Android everything stays on the device; to move it or keep a copy, you export a full backup file that you own and restore it wherever you like. There is no Reflection Space server for any of it to go to, because there is no Reflection Space server.

What leaves only if you bring your own key

The optional insight features — a summary of your patterns, one thoughtful follow-up question while you write — can run on the phone: with on-device Apple Intelligence on supported iPhones, or with Gemini Nano on supported Android phones. If you would rather use a cloud model, you add your own API key for OpenAI, Claude, Gemini, or Grok. The key is stored in the iOS Keychain or the Android Keystore, and the text you ask the model to look at goes from your phone to that provider, under that provider’s terms, and the answer comes back. We are not in between; we never see the request or the reply. Remove the key and nothing goes anywhere again.

Voice memos, per platform

On iPhone, a voice memo is transcribed with Apple’s Speech framework — Apple’s own speech recognition — and neither the audio nor the text ever reaches us. Where Apple processes that audio, on the phone or on Apple’s servers, is something we are checking ourselves and will state here rather than guess. On Android, transcription happens only if you have added your own key for OpenAI or Gemini: when you save a reflection with a voice memo, the recording is sent to that provider and the text comes back to your phone. Without a key, the memo stays as audio on your device and is not sent anywhere.

What a shared link carries

A template link carries only the template — its title, description, category, icon, questions, metrics, and schedule. Your answers are never in it. The template is packed into the link itself and unpacked on the other person’s device, so it never passes through a server of ours; the preview page on this site decodes it in the browser and runs no analytics at all. The programs we publish use exactly the same link.

What a shared card carries

Sharing is always something you start. On iPhone, a shared reflection is plain text or an image card — the written answer and the metric values — that you see before you send, and it never contains audio files or your original photos. On Android, reflections share as text, and patterns and milestones as image cards. Either way it goes through your phone’s own share sheet to whoever you pick, and nowhere else.

This website, not the app

reflectionspace.io runs consent-gated Google Analytics, disclosed in the privacy policy; you can decline it. The share page runs none, so a link’s contents are never measured. The app has no analytics of any kind — the two are different surfaces, and we keep them that way.

Why “never trained on” is structural

We never train models on your entries. It is not a promise we have to keep; it is a thing we cannot do, because we hold no copy of your entries anywhere. When you use a cloud provider with your own key, your text is handled under that provider’s terms for its API — read them, they are yours to accept — and the on-device options never send it at all.

The policy

The full disclosure — what the app stores, the website’s analytics, your rights, and how to reach us — is the privacy policy. Questions about setting up a key or turning insights off are answered on the support page; if the trade-off you are weighing is against a simpler journal, the comparison with Apple Journal is honest about both.