What Saaf keeps, and for how long
Effective 13 August 2026 · Saaf for iPhone
Every store Saaf writes is listed in Settings under "What Saaf stores", with its purpose, where it lives, how long it is kept and who else receives it. That list is not a document maintained by hand — it is the same list the export and the delete-all sweep walk, and a test fails the build if the app writes anything that is not on it.
THE SHORT VERSION
• Apple Health data: 90 completed days plus today's partial day, refreshed from Health and trimmed as it ages. • Vital Age snapshots: one per completed day, kept until you delete them, because freezing them is what makes Pace of Aging a trend instead of a recomputation. • Journal entries, workouts, goals, food logs, custom exercises: kept until you delete them. • Recorded runs, including the GPS route of each one: kept until you delete them. Saaf reads your location only while a run is recording, and it keeps reading in the background so a locked phone does not end the run. A route can show where you live, so it is treated as health data — it is in your export, "Delete all my data" removes it, and it is never transmitted anywhere. The Today screen's weather can also ask once for when-in-use access and take one coarse reading, which is sent to Apple and kept in memory only — nothing about it is stored here, so there is nothing on this list to keep. • Drafts and in-progress workouts: kept only until that session is saved or discarded. • Preferences and consent records: kept until you reset them. • Sync bookmarks: a position marker per health type. They contain no health values.
DELETION
"Delete all my data" removes every one of those, clears the caches, and resets consent so the app starts from onboarding. It is irreversible, and it is complete — there is no server copy, so there is nothing left anywhere else to delete.
BACKUPS
Saaf's storage is inside the app container, so it is included in your device backups (iCloud or encrypted local backup) under Apple's protections, and is protected at rest by iOS file-level encryption while your device is locked. Saaf itself creates no backups and sends none anywhere.