What Beatrice knows, and what it does with it

Beatrice is built by one person, Brian Long. It holds notes about the people in your life and the running of your home, which is unusually personal material for an app to carry. This page is written to be read rather than agreed to.

What is collected

Only what you enter, plus what is needed to run the app.

What	Why
Account Email address, or an Apple Sign In identifier	To sign you in and keep your data attached to you
People Names, photos, birthdays, contact details, notes, and the answers you give to questions about them	This is the app. It is what lets Beatrice tell you something specific rather than generic
Household Tasks, lists, pets, vehicles, appliances, shared reference notes	Shared with the other members of your household, and nobody else
Journal Entries you write, and daily prompt answers	Yours to read back. Entries you mark private are shown only to you. They still count toward your streak and the recap, and nothing else reads them
Health Cycle, pregnancy, infant and medication tracking entries, if you use those tools. The health data page has the detail	To show you your own history and to make predictions from it
Apple Health Step count, sleep, and resting heart rate, if you connect it. Not available in the app yet	To notice a pattern worth mentioning, such as disrupted sleep. Read only: Beatrice does not write to Apple Health
Photos See below. The images themselves never leave your phone	To resurface a moment with someone you have not spoken to lately
Calendar and reminders Event titles, times and attendees, if you connect Google Calendar or allow Apple Calendar. A place-based reminder you set is written to Apple Reminders	To notice when you are about to see someone. The Google connection is read-only
Diagnostics Crash and error records, and counts of which features get used	To find and fix things that break
Beta list Your email address, if you sign up on the website	To tell you when Beatrice is ready. Write to the address below to come off it

Photos never leave your phone

If you grant photo access, Beatrice scans your library on the device. What gets stored on the server is an opaque local identifier that means nothing anywhere else, a date, a numeric score, which friend the photo matched, and the place name if there is one. The image is never uploaded, never sent to any third party, and cannot be reconstructed from what is stored.

If a photo carries location data, Beatrice may look up the place name to write a caption like "in Brighton". The place name is kept and can appear in a line Beatrice writes about that friend. The coordinates are not kept.

What the AI sees

Some of what Beatrice writes is generated by Anthropic's Claude model. When that happens, the relevant text is sent to Anthropic's API over an encrypted connection and the response comes back. Anthropic does not train its models on data submitted through its API.

What is deliberately kept out of those requests:

• Journal entries you have marked private
• Photographs, photo identifiers, and GPS coordinates. The place name from a recent photo with a friend can be sent
• Raw health entries, including symptom and cycle notes. If you allow it, a few figures worked out from your cycle can be sent; the health data page lists them
• Apple Health data of any kind
• The contents of shared household reference notes
• Whether you have marked a relationship as difficult

These exclusions are enforced by automated checks that fail the build if something crosses the line, rather than being left to memory.

Usage events carry no content

Usage events record counts, yes-or-no flags and short fixed labels. They do not carry names, identifiers for specific people, free text, journal content, or health readings. A record of the shape a task was completed is kept. Which task, and for whom, is not.

Error records are different. To trace a fault, one can include the name of the friend or the task involved.

Links you send to friends

Beatrice can create a link you send to someone, so they can answer a question, pick a time, or sign a group card without installing anything.

• The link carries only what that specific link is for. It is not a view into your account.
• Links expire, and most work once.
• The recipient is not asked to create an account and nothing about them is stored beyond what they type in.
• Anyone holding the link can open it, so treat one like a door key.

Where it lives

Data is stored with Supabase, which hosts the database, encrypted in transit and at rest. Access rules are enforced at the database itself, scoped to your account, so one person's rows are not reachable from another's session. Household data is readable by the members of that household.

On your phone, your sign-in session is encrypted with a key held in the iOS keychain.

Who else gets it

The companies that handle what you enter in the app, and what each one gets:

• Supabase, for hosting and storage
• Anthropic, the text described above, only if you allow it
• Apple, for sign-in, push notification delivery, and Apple Calendar and Reminders if you allow them
• Expo, which relays push notifications to Apple: a device token and the notification's title and text, which can include a message a friend sent you
• Google, your calendar, only if you connect it
• Open Food Facts, a barcode you scan on a list, to name the product
• The US National Highway Traffic Safety Administration, a vehicle's make, model and year, to look up recalls
• Nager.Date, your country, to list its public holidays

The website is hosted by Vercel, and the beta list is sent through Resend.

Nothing is sold. There are no advertising networks and no data resellers. Home and appliance details are specifically never used to generate sales leads for anybody, which is how much of that category is funded.

The website

beatriceapp.com uses Google Analytics to count visits and see which pages people read. It is separate from the app and from everything in the table above. It sees the pages you look at, a rough location worked out from your IP address, and what browser and device you are on. None of what you enter in Beatrice is on the website, so none of it reaches Google.

Google is a processor for that, and for nothing else. The single-use links you send to friends are excluded on purpose and carry no measurement at all. Tracking protection and content blockers both stop it, and every page works the same either way.

Getting it back, and getting rid of it

• Export. Home records export in full, including every field, from the screen they live on. For anything else, ask and it will be sent to you.
• Delete a thing. Anything you enter can be deleted in the app, including a mistyped health entry.
• Delete everything. In Settings, Delete Account removes the account and all its data. You can also write to the address below. No retention period, no waiting list.
• Photo data. Revoking photo access in iOS Settings stops the scan. In Settings, Erase Photo Memories erases everything derived from your library.

Children

Beatrice is not for children. You need to be 16 or older to use it, and it is not directed at anyone younger. Infant tracking records information about a baby entered by a caregiver, which is the caregiver's own data.

Changes

If this page changes in a way that affects what is collected or who sees it, the change will be announced in the app rather than quietly published here.

Contact

hello@beatriceapp.com. It reaches one person and gets an answer.