Privacy policy

Effective October 20, 2026

tabula is a journal. What you write in it is yours, and it stays with you. This policy explains, in plain words, what the app does with your information and what leaves your device.

The short version

• tabula has no servers, no accounts of ours, no sign-in, no advertising and no tracking across other apps or websites.
• Your tabula is saved on your device and, if you turn on iCloud sync, in your own private iCloud, which only you can read. We never see it.
• A small amount of anonymous information about the app (its version, your device type, a few settings) is sent once a day so we can keep tabula working. You can choose to share more, but never less, and none of it is ever anything you write or log, or anything that identifies you.
• When you use a feature that looks something up (a book, the weather, a recipe page), only what that lookup needs is sent to the service that answers it.
• We never sell or share your information, and nothing is used for advertising.

What stays with you

Everything you write or log (daily logs, notes, pages, trackers, mood check-ins, health and medication entries, tarot and I Ching readings, books, recipes, projects, events, attachments, voice notes and settings) is stored on your device by the app.

• iCloud sync. If you turn it on, Apple keeps a copy in the private iCloud database of your Apple Account so it appears on your other devices, and your settings are kept in iCloud's key-value storage. This is covered by Apple's privacy policy, and neither we nor anyone else can read it.
• Backups. Once a week the app saves a backup of your tabula in your own iCloud Drive (in a tabula folder), or on your device if iCloud Drive isn't available. Only you can open it.
• Profiles. Each profile is a separate tabula, stored and synced the same way.
• Widgets, Shortcuts, Siri, the share sheet and the menu bar. These read from and add to your tabula on your device. Nothing they handle is sent to us.
• Passwords and keys. Keys you enter for Zotero or Steam are kept in your device's keychain. Your Google Calendar sign-in is kept in your iCloud Keychain so your other devices are connected too.

The oracles

The oracles that read your tarot, I Ching and patterns run entirely on your device, with Apple's on-device model (Apple Intelligence). Your questions, cards and writing are never sent to us or anyone else, never stored by us, and never used to train any model. Apple states that it doesn't use your interactions with its on-device models for training.

If something you write for an oracle mentions suicide or self-harm, it's checked on your device and the oracle isn't asked at all. Nothing about it is recorded, counted or sent anywhere. The app shows where to find help instead; opening that help link takes you to findahelpline.com in your browser.

Permissions the app asks for

You're always asked first, and you can change your answer in your device's Settings at any time.

• Calendars. The app reads your calendar events on your device to show them in your daily log and calendar. When you add, change or delete an event in one of your device's calendars from tabula, the change is saved to that calendar on your device, which syncs it through that calendar's own account as usual. We never receive it.
• The Health app (iPhone and iPad). The app reads your sleep, steps, weight and menstrual cycle from Apple Health to fill in your Health page. It only reads; it never writes to Health. What it reads is kept in your tabula like anything you log yourself. Health data is never sent to us or anyone else, never used for advertising or analytics, and never shared or sold. You can stop it in the Health app, under Sharing › Apps › tabula.
• Camera. Only while you're scanning a book's barcode. The camera reads the number on the barcode; no picture is taken or kept. The number is sent to Open Library to find the book.
• Microphone. Only while you're recording a voice note. The recording is stored with your tabula like anything else you write.
• Photos. The system photo picker gives the app only the photos you choose.
• Face ID, Touch ID or your passcode. If you turn on the lock, your device checks it's you. The app never sees or stores your face, fingerprint or passcode.
• Location. Used to look up the weather. A rough position (to about a kilometre) is sent to Apple Weather for the forecast, and to Apple Maps to name the place. It isn't stored by us or linked to you. If you turn on "Follow me", the app checks where you are at most every few hours, and only while it's open. The town's name is kept with each day's weather in your tabula, so you can see where you were.
• Notifications. Reminders (for events, trackers, medication, writing and your budget) are scheduled and shown on your device.
• Files. The app opens only the files and folders you choose (pictures for a tarot deck, a calendar or markdown file, a font, a community widget) and saves only where you choose.

Services the app contacts for you

Some features fetch information from other services when you use them. Each request contains only what that feature needs (for example, a book's title to find its cover), never your tabula. Like any website, these services see your device's internet address, and they have their own privacy policies.

• Weather and places: Apple Weather and Apple Maps.
• Books, films, shows, games, music and papers: Open Library, Wikipedia, the iTunes Search API, TVmaze, Steam, Spotify (to show a song you link), Crossref and DOI.org.
• Zotero, if you connect your own Zotero library: your user ID and key are sent to Zotero to read your library, or the app talks to the Zotero app on your Mac.
• Steam, if you connect your Steam account: your Steam ID and key are sent to Steam to read your games.
• Google Calendar, if you sign in with Google: tabula reads your calendars' events straight from Google, with read-only access, to show them. It never changes them. Signing out removes the sign-in.
• Tarot decks you choose to download: from Wikimedia Commons or the artist's own website.
• Recipe and web pages you choose to import or embed: the website you paste in.
• Embeds and community widgets. An embed block shows a web page, video, map or HTML inside your page, so whoever runs that site sees that it was loaded, as in a browser. A community widget brought in from a file can contain embeds and links; the app shows where they go before it's added.

Anonymous usage information

So we can see which devices and versions tabula runs on and make it better, the app sends a little anonymous information to TelemetryDeck (telemetrydeck.com), a privacy-focused analytics service. In Settings › Account › Privacy you choose how much, and each level includes the ones before it:

• The basics (the least, and where App Store versions start). Once a day: the app and system versions, whether it's a Mac, iPhone or iPad, your theme and text size, and whether iCloud sync and aurum are on. It carries no lasting ID: each day's is sent under a new random one, so it can't be linked to you or to any other day.
• What gets used. The basics, plus which page you open (for example, the daily log or tarot) and that a feature was used (for example, that a check-in was saved), without anything about what was in it.
• Everything that helps (where beta versions start, which TestFlight testers agree to). All of that, plus once a day how your tabula is set up in rough numbers (for example "5–19 trackers" or "1–4 table blocks") and which settings are on, and roughly how long each visit lasts.

Above the basics, what's sent is grouped under a random ID made on your device, hashed before it's sent, and never linked to your Apple Account, your name or your tabula. Reset anonymous ID makes a new one at any time, so nothing sent before can be linked to anything sent after. Choosing a lower level stops the extra information straight away.

At no level is anything you write or log included, nor your moods, health, medication, readings, names, places, location, calendars, contacts or files. It's used only to improve the app, never for advertising, and never sold or shared.

When you contact us

• Report a problem (Settings › Account › About) makes a message for you to send yourself, by email or any other way you choose. It holds only what you write and, if you leave it on, the app and device details shown in full before you send it. Nothing from your tabula goes with it.
• Email and the tabula discord. If you email us or talk to us on the discord, we see what you send and your email address or discord name. We use them only to answer you, help with tabula and, if you have aurum lifetime, send the thank-yous described in the terms. The discord is run by Discord, under Discord's own privacy policy; joining it is up to you.
• TestFlight. If you test a beta, Apple shares with us the crash reports and feedback you choose to send through TestFlight, as described in Apple's TestFlight terms.

Purchases

aurum, obols and tarot decks are bought through the App Store, which Apple handles. We receive no payment details and don't learn who you are; the app only checks with the App Store what you've bought. In beta versions, purchases are pretend: nothing is charged and nothing reaches the App Store.

Children

tabula isn't directed at children under 13, and it collects no personal information from anyone. The anonymous information above contains nothing that identifies anyone.

Your choices and your data

• See and keep your data: everything is in the app, and you can export pages, notes and trackers, or make a backup, at any time.
• Share less: choose the basics in Settings › Account › Privacy, and turn off any permission in your device's Settings.
• Delete it: delete anything in the app (it waits in the trash for 30 days, or a year with aurum, then is gone for good), or delete the app to remove your tabula from that device. To delete the iCloud copy, open Settings (System Settings on a Mac) › Apple Account › iCloud › Manage storage, choose tabula, and delete its data. Backups are in the tabula folder in your iCloud Drive.

Because we don't hold any of your tabula, there's nothing for us to hand over or delete on our side. If you've emailed us and want those messages deleted, ask and we will.

Changes

If this policy changes, the new version comes with the app, with a new effective date. If a change would mean more leaves your device, the app will tell you before it happens.

Contact

Questions about privacy? Use Report a problem in Settings › Account › About, the support link on tabula's App Store page, or ask on the tabula discord.