Privacy Policy

Nothing. Herald does not collect, transmit, sell, rent or share personal data. There is no Herald account, no Herald server and no Herald analytics.

The developer of Herald cannot see your proclamations, cannot see your calendar, does not know that you installed the app, and has no way of contacting you unless you write first.

Everything below explains where your own data lives on your own device, and the handful of places the operating system carries it on your instruction.

A proclamation holds a title, a description, a place, the instant it comes to pass, a colour, and whether it returns. Alongside the ledger, Herald keeps your settings — the ceremony level, the colour rule, which surfaces you have turned on, and which proclamation is held at the front.

All of it is written to app-private storage on the device: the app container on iOS, app-private preferences on Android. Other apps cannot read it. It is not encrypted by Herald beyond the encryption the operating system already applies to app-private storage on a locked device.

Deleting a proclamation in the app removes it from that store. Uninstalling Herald removes the store entirely.

Herald's ledger is included in the backup your device already makes — iCloud on iOS, Android Backup on Google Drive. That copy is made and held by Apple or Google under their own terms, using the account you are already signed in to at the system level. Herald never receives, sees or stores those account details; it only tells Android that its data has changed so the system scheduler can run.

On Android 12 and later, Herald marks its data as requiring client-side encryption, so no cloud copy is made if the device cannot encrypt it. Device-to-device transfer remains available.

To stop the backup, turn Herald off in your iCloud or Google Backup settings. Copies already taken are governed by Apple's or Google's privacy policy and their own retention.

If you ask Herald to claim an event, it reads the device calendar once, while that surface is open, to put candidates forward. It is a pull, never a sync.

• Herald requests calendar access only at the moment of a claim, never at launch.
• Access is read-only. Herald never declares write permission, and never adds, changes or deletes a calendar event.
• Only the single event you claim is kept, and only as an ordinary proclamation you can then edit or delete.
• The claimed proclamation stores the calendar event's own opaque identifier, so the same event is not put forward twice. That identifier is the device's handle and never leaves it.
• Events you look at and do not claim are kept nowhere. Close the surface and they are gone.
• Nothing read from the calendar is transmitted anywhere.

You can withdraw calendar access at any time in system settings. Herald continues to work; only the claim surface stops.

If you ask Herald to read a photographed notice, you choose whether to take a picture or select one from your photo library. Text recognition runs on the device. Herald sends neither the image nor the recognized text anywhere.

• Camera and photo-library access are requested only when you choose the corresponding source.
• The operating system gives Herald a disposable copy of the selected image. Herald deletes that copy immediately after text recognition finishes, whether recognition succeeds or fails.
• Recognized text and rejected interpretations are kept only while the notice surface is open.
• Only a draft you accept moves into Create, where you can inspect and edit it before saving.

You can withdraw camera or photo-library access at any time in system settings. Herald continues to work; only that image source stops.

Herald Aloud is a local notification, scheduled on the device by the operating system for the morning of your proclamation. It carries the title and a short line about when the hour falls.

There is no push service, no notification server and no device token. Nothing is registered with Apple Push Notification service or Firebase Cloud Messaging. Turning the rule off cancels every pending notification.

Home screen widgets, iOS lock screen accessories and the Live Activity are drawn by the operating system, so Herald hands them what they need through a shared container on the same device — an App Group on iOS, app-private preferences on Android.

What is shared: the title, the place, the absolute date, the countdown numeral, the ceremony word, the two colours, and the next few upcoming proclamations so the widget can advance on its own without the app being opened. Your description is never included in any of them.

This data leaves nothing but the device — but it does appear on your home screen and, if you turn that rule on, your lock screen, where anyone who can see the screen can read it. Turn off Take the lock screen and Live activity in The Decree if you would rather it did not.

Sharing a proclamation renders a PNG into your device's temporary directory and hands it to the system share sheet. Where it goes next is entirely your choice, and what happens to it there is governed by whichever app or service you chose.

The poster carries the title, the place, the date and the countdown. The description is deliberately left out. Herald has no involvement in the send and receives no record of it.

On Android, the optional Flood the wallpaper rule paints your home screen in the held proclamation's colour. Herald writes a generated image; it never reads your existing wallpaper and never keeps a copy of it. The rule is off unless you turn it on, and iOS publishes no such capability at any entitlement.

Herald gives your first proclamation; the Warrant, bought as a yearly subscription or once for life, keeps everything after it. It is sold only through the App Store or Google Play, in the store's own purchase sheet, and the payment, your account and your purchase history are handled by Apple or Google under their own terms.

Herald asks the store one question — whether this account holds the Warrant — and keeps only the answer, on this device, so it does not have to ask again every time it opens. It never sees your payment details or your Apple ID or Google account, and it uses no billing service, receipt server or analytics of its own or anyone else's. Nothing about your proclamations is part of any purchase.

If the Warrant lapses or is refunded, nothing you have already made is removed: every proclamation stays and keeps counting.

• Live proclamations — kept until you delete them.
• Come To Pass — a proclamation whose hour has passed is preserved for 30 days, then forgotten automatically. Returning proclamations keep only their most recent occurrence.
• Poster files — written to the temporary directory and cleared by the operating system.
• Notice images and recognized text — the disposable image copy is deleted immediately after text recognition; recognized text is discarded when the notice surface closes.
• Everything — uninstalling Herald deletes all of it from the device. Copies inside your iCloud or Google backup persist until that backup rolls over or you delete it in system settings.

Because nothing is ever sent to Herald, there is no server-side copy to request, correct, export or erase. Deletion on your device is complete deletion.

Herald is not directed at children under 13, and it collects no personal information from anyone, of any age. Because there is no account, no transmission and no profile, there is nothing gathered from a child to disclose, delete or refuse.

If Herald ever changes what it does with your data, this page changes first, with a new date at the head. Any change that would send data off the device would be announced in the app and would ask before doing so — never quietly, and never on by default.

Every permission Herald declares, why it exists, and whether anything crosses the edge of the device.

For the App Store nutrition label and Google Play's Data safety form, Herald declares no data collected and no data shared.