Sanctuary Privacy Policy
Updated: 21 October 2026 Who we are: Sansrealm LLC ("we", "us"), the maker of the Sanctuary app for iPhone.
Sanctuary is built so that what you keep stays with you. This policy says exactly what leaves your phone, why, and what happens to it. It is written to match what the app does; if the app changes, this page changes with it.
The short version
- Everything you keep in Sanctuary — your things, ideas, notes, photos, reminders — is stored on your phone. There is no account and no server of ours that stores your content.
- To understand what you say or type, Sanctuary sends that text once to an AI service and shows you the result. We do not keep it. Your voice itself never leaves the phone.
- We do not collect analytics, do not track you, and do not sell or share personal data for advertising.
- Deleting the app deletes everything on your phone.
What is stored on your phone
Sanctuary keeps a private database on your device containing what you capture (as text), the things and ideas made from it, notes and photos you attach, reminder schedules, and a small record of how you use the app (for example, which reminders you acted on). This data never leaves the phone except as described in the next section. Photos you attach are copied into the app's own folder on the device. iOS device backups may include the app's data under your own Apple settings.
What leaves your phone, and why
1. The words of a capture, to understand it. When you capture a thought, the text (what you said, transcribed on your phone, or what you typed) is sent over an encrypted connection through our relay to Anthropic, the provider of the AI model that turns your words into a thing, an idea, a date or a reminder. To make the result accurate, the request also includes a small amount of context from your phone: the current date and time, the city you gave at onboarding (if any), the titles of a few of your open things, the names of people or topics you have mentioned before, and your previous one or two captures from the same session. The response comes back to your phone and is stored there.
Our relay is a small service that forwards the request and holds the service keys so they are never inside the app. It does not store the content of any request or response. It keeps only an anonymous per-install identifier and a daily call count, used to limit abuse, which expire automatically after two days.
Anthropic processes the request under its commercial API terms, which do not allow inputs to be used to train its models, and we do not keep the words ourselves. Anthropic may retain API inputs for a limited period for safety and abuse monitoring under its own policy; see https://www.anthropic.com/legal/privacy.
2. Your voice never leaves your phone. Voice captures are transcribed on your phone by Apple's speech recognition. If the phone cannot make out a recording, Sanctuary asks you to say it again or type it; the recording is not sent anywhere.
3. Email reminders, if you switch them on. You can choose, in Settings, to receive email reminders for things that are some way off. If you do, we hold the email address you verify for as long as the feature is on, and the title and due date of each such thing until its reminder is sent — on Cloudflare, in the United States. The emails are delivered by Resend (https://resend.com/legal/privacy-policy). Nothing else is sent. Switching email reminders off deletes all of it. If you delete the app without switching them off, reply to any reminder or write to hello@yoursanctuary.app and we will remove you.
4. Nothing else. Sanctuary makes no other network requests. There are no analytics, no crash reporting services, no advertising identifiers, no third-party tracking, and no location services. Reminders are scheduled on your phone by iOS and are not sent through any server, apart from the optional email reminders above.
Onboarding details
Sanctuary asks for your city when you start. It is optional, is stored on your phone, and is included in the context sent with each capture so dates and places resolve correctly. You can skip it, and change it in Settings.
Notifications
Sanctuary asks permission to send notifications so it can remind you of things on their day. Notifications are created locally by the app. Some are marked time-sensitive so they can reach you through Focus modes; you control this in iOS Settings.
Microphone and speech recognition
Sanctuary asks for the microphone only when you tap to capture, and for speech recognition so your words can be turned into text on the device. Recordings are kept on the phone only as long as needed to transcribe them.
Children
Sanctuary is not directed at children under 13, and we do not knowingly collect information from them.
Your choices and rights
- See or delete your data: it is on your phone. Delete individual items in the app, or delete the app to remove everything.
- Data held by us: none, beyond the expiring anonymous counters described above and, if you have switched on email reminders, what section 3 describes — which switching them off deletes. There is nothing else for us to export or erase on request, but you can write to hello@yoursanctuary.app with any question and we will answer.
- Data held by AI providers: governed by their policies linked above.
- Permissions: microphone, speech recognition, notifications, photos and camera can each be withdrawn in iOS Settings; the related feature stops, the rest of the app keeps working.
Where Sanctuary is offered. Sanctuary is made and offered in the United States. It is not marketed to, or intended for, people in the European Union or the United Kingdom. We do not sell, share or transfer anyone's personal data, wherever they are. If you use Sanctuary from somewhere it is not offered, you do so on your own initiative, and the practices described on this page apply as written. California residents: we do not sell or share personal information, and the controls on your phone satisfy any access or deletion request.
We would disclose the little we hold only if legally required to, and if Sanctuary ever changed hands this policy would go with it and you would be told.
Security
Requests leave your phone over HTTPS. The app contains no service keys. Our relay enforces size and rate limits and forwards requests without storing them.
Our website
This policy is published at yoursanctuary.app, and that website is a separate thing from the app. The website uses Google Analytics to count visits, which sets cookies and sends your browser's usage data to Google under Google's privacy policy. If you join the waitlist there, the email address you enter is stored with us (on Cloudflare, in the United States) and used only to invite you to test Sanctuary and to tell you when it launches; write to hello@yoursanctuary.app to have it removed. The app itself sets no cookies and uses no analytics.
Changes
If we change what the app sends or stores, we will update this page and the date above, and material changes will be noted in the app's release notes.
Contact
Sansrealm LLC · hello@yoursanctuary.app