Privacy Policy
Effective 15 October 2026 · Saaf for iPhone
Saaf is designed so that there is very little to say here — and this document says exactly what the app does, not what we would like it to do.
WHAT SAAF COLLECTS
Saaf has no account, no sign-in, and no developer-operated health-data server. It does not automatically send your health records to us. Everything it works with reaches it in one of four ways, all with your permission: read from Apple Health, typed in by you, captured by a sensor while you are using the feature that needs it (your location during a run, the camera when you scan a meal, the microphone when you speak a set or a journal note), or derived on this iPhone from those.
WHERE YOUR DATA LIVES
On this iPhone. Health summaries, Vital Age snapshots, sleep estimates, journal entries, goals, workouts, recorded runs and their GPS routes, food logs and your preferences are stored in this app's own private storage. One small file — the three numbers your Home Screen widget shows — is written to this app's shared container so the widget can render without reading Apple Health itself. The complete list, with the purpose and retention period of each item, is in Settings under "What Saaf stores", and is included at the top of any export you make. If you install the Saaf Apple Watch app, one compact, pre-rendered summary is transferred to your paired Watch using Apple's Watch Connectivity framework. The Watch does not read Apple Health or calculate scores itself.
A meal photo you scan is read into memory, measured on this iPhone, and never uploaded — the scanner has no network path of any kind. Speech you dictate is transcribed to text; Saaf keeps the text, never a recording.
APPLE HEALTH
Saaf requests READ access only. It never writes to Apple Health, and its authorization request asks for no write permissions at all. You choose which data types to share, and you can change or revoke that at any time in the Health app under Sharing → Apps. Revoking access does not delete what Saaf already cached; use "Delete all my data" in Settings for that.
NETWORK ACTIVITY
Saaf has no developer-operated health-data service. It contains no analytics, no crash-reporting service, no advertising identifier, and no third-party SDK that phones home. The app does not upload health data to us. The following use Apple's frameworks and are subject to Apple's privacy policy:
• THE APP STORE distributes Saaf. Saaf+ is included free during this preview; this build does not initiate a Saaf+ purchase or subscription. Saaf never sees payment details and sends Apple no health information for billing.
• APPLE'S SPEECH SERVICE, but only if you turn on "Improve accuracy" in the voice set-logging sheet. That switch is off by default and returns to off every time the sheet opens; while it is off, your speech is recognised on this iPhone and the audio does not leave it. While it is on, the audio you speak is sent to Apple to be transcribed, and the sheet says so on screen both at the switch and while it is listening. Voice journal notes and Coach dictation are always recognised on device and offer no such switch.
• APPLE'S WEATHER SERVICE, after Saaf asks once for when-in-use location so Today can show the conditions around you. You can refuse; weather then simply does not appear and nothing is sent. When it is granted, Saaf sends Apple an approximate position — accurate to about three kilometres, not your address — and receives the current conditions back. Apple's geocoding service also receives that approximate location to resolve the place name displayed with the weather. No health data and no identifier of you goes with it, and the reply is held in memory only: it is not written to this iPhone, so it is not in an export and there is nothing for "Delete all my data" to remove. Weather recorded by your Apple Watch during an outdoor workout is read from Health instead and involves no network at all.
• YOUR PAIRED APPLE WATCH receives a compact summary containing the readiness, sleep, strain and body-signal wording already calculated on this iPhone. It travels only through Apple's Watch Connectivity framework to your paired Watch. It is not sent to Saaf, a Saaf server or any analytics service.
NOTIFICATIONS
Notifications are off until you turn them on in Settings. Saaf can notify you after its morning read, a saved workout, a completed exercise recorded in Apple Health, at your wind-down window, or when an elevated body signal is already present in your read. Their content is derived on this iPhone and can appear on a locked iPhone or paired Apple Watch. You can turn Saaf notifications off or hide their previews in system Settings at any time.
ARTIFICIAL INTELLIGENCE
The Coach runs on Apple's on-device foundation models where the device supports them, and falls back to deterministic, locally computed text where it does not. Your questions and your health data are not sent to any server for processing, ours or anyone else's.
YOUR LOCATION
Saaf reads your location for two visible, optional purposes.
• RECORDING A RUN, so it can map and measure it, and it keeps reading in the background so a locked phone does not end the run. The route is stored on this iPhone with the rest of your data and is never transmitted. A route can show where you live, so it is listed as health data in "What Saaf stores", it is included in an export, and "Delete all my data" removes it.
• SHOWING THE WEATHER on your Today screen. Saaf may ask once for when-in-use access, then takes one coarse reading, accurate to about three kilometres rather than to your address, and sends it to Apple's weather service to get the current conditions. It is not stored, not written to disk, and not included in an export, because there is nothing kept to include. A refusal leaves the time-of-day visual intact and omits live conditions.
You can refuse or revoke location access in iOS Settings; every other part of Saaf works without it, and weather is simply absent rather than guessed.
WHAT WE DO WITH IT
Saaf uses your data to compute the scores and explanations it shows you, on your device, at the moment it shows them. It is not used for advertising, profiling, sale, or sharing, and Apple's App Review Guidelines prohibit using HealthKit data for advertising in any case.
HOW LONG IT IS KEPT
Until you delete it, except for the 90 completed days plus today's partial Apple Health cache, which is refreshed from Health and trimmed as it ages. Deleting the app removes everything Saaf stored.
YOUR CONTROLS
• Export everything Saaf holds, as a readable JSON file (Settings → Your data). • Delete everything Saaf holds, in one action, irreversibly (Settings → Your data). • Withdraw consent — for the Coach, the training screener, and cycle-aware mode — without deleting your history (Settings → Your data → Reset consent). • Revoke Apple Health access at any time in the Health app. Because Saaf holds no account and no copy of your data, these controls are complete: there is no second copy elsewhere for us to delete on request.
CHILDREN
Saaf is not directed at children and is intended for users aged 13 and over. It is a general wellness product, not suitable as a health tool for children.
CHANGES
If this policy changes, the effective date above changes with it, and the new wording ships with the app update that implements it.
CONTACT
Contact support@saafapp.co for support or privacy enquiries. Saaf does not automatically attach health records, photos or logs to support messages. Only send information you choose to share; avoid sending health exports or other sensitive information by email. If you email us, your email address and message leave your device through your email provider and are received by the support mailbox so we can respond. This is separate from Saaf's on-device health processing. Deleting data in Saaf does not delete emails you have sent; contact the same address about support correspondence.