<!-- https://ios.app.promptugal.news/admin/briefs/2026-11-08__summit-app-store/store/app-privacy.html · PrompTugal for iOS 0.4.106 -->

# App Privacy answers (the nutrition label)

> **Answer for the App Store build from rc8 on ( Dinis's decision at 21:40 UTC): "No, we do not collect data from this app" (Data Not Collected).** Ask is only in DEBUG builds, so the Release build sends nothing off the device except plain reads of public files from promptugal.news. `PrivacyInfo.xcprivacy` has an empty `NSPrivacyCollectedDataTypes` (rc8 4f58965). The rest of this page is the earlier analysis, kept for the record and for a future version that brings Ask back.

## What Dinis enters in App Store Connect → App Privacy

1. "Do you or your third-party partners collect data from this app?" → **No, we do not collect data from this app.**
2. Publish. The label then reads **Data Not Collected**.
3. Privacy policy URL (already set): https://ios.app.promptugal.news/privacy.html

Why that is true for the rc8 build:

| Feature | In Release? | Leaves the device |
| --- | --- | --- |
| Agenda, news, explore data | yes | plain GETs for public files from promptugal.news; nothing about the user |
| Session and site pages | yes | promptugal.news pages; other sites open in Safari; the site sets no cookies |
| Picks, program, reminders, calendar, widget, Siri | yes | nothing: on the device only |
| Ask (OpenRouter) and dictation | **no** (DEBUG only, `Destinations.askScreens`, `NowView`, `PublicSettingsView`) | none in Release |
| Vault | **no** (DEBUG only) | none in Release |
| Analytics, crash reporting, ads, third-party SDKs | none | none |

---

## Earlier analysis (build 204, with Ask)

> The answers Dinis enters by hand in App Store Connect → App Privacy. They are derived from the code the public app links (PTCore, PTWeb, PTAgenda, PTNews, PTAsk, PTVaultUI, SGitVault; no PTLanes). They must agree with `Apps/PrompTugal/Resources/PrivacyInfo.xcprivacy` and with the privacy page. **Ruling at 11:30 UTC:** Ask ships (B1 option a) and Vault is hidden (B2). The answers below are the ones to enter.

## Where data goes, from the code

| Feature | What leaves the device | To whom | Code |
| --- | --- | --- | --- |
| Agenda and news | Nothing about the user: plain GET requests for public files | promptugal.news | `PTCore/Feed/Content.swift` (`FeedClient`) |
| Websites | Pages load as in a browser; one separate data store per site | promptugal.news (more if R1 is not fixed) | `PTWeb/Web/WebPage.swift`, `SiteDataStores.swift` |
| Picks, planner, reminders | Nothing: stored on the device; reminders are local notifications | none | `PTAgenda/Schedule`, `ReminderScheduler.swift` |
| Calendar | One event written on request; write-only access, no read | the user's own calendar (on device) | `CalendarExport.swift` |
| Ask | The question, the conversation and the context the user switches on (the public agenda by default; picks and the current page optional). Sent with the user's own key, only after consent | openrouter.ai and the model maker | `PTAsk/OpenRouter.swift`, `PublicAskProvider.swift` |
| Dictation in Ask | Audio, only while the button is held. On device when the language allows it, otherwise to Apple's speech service; not kept | Apple | `PTAsk/SpeechDictation.swift` |
| Vault (hidden in this build, B2) | Files encrypted on the device; the server stores ciphertext and opaque names | dev.send.sgraph.ai | `SGitVault`, `PTVaultUI` |
| Analytics, crash reporting, ads | None. No third-party SDK | none | the privacy manifest: `NSPrivacyTracking` false, no tracking domains |

## Answers

**Do you or your third-party partners collect data from this app?** Yes. Ask sends the user's questions to a third party that processes them.

| Data type | Collected | Used for | Linked to the user | Used for tracking |
| --- | --- | --- | --- | --- |
| User Content → Other User Content (Ask questions and the context the user chooses) | Yes | App Functionality | No | No |

Every other data type is **not collected**. That covers contact info, health and fitness, financial info, location, sensitive info, contacts, emails or text messages, photos or videos, audio data, gameplay content, customer support, browsing history, search history, identifiers, purchases, usage data, diagnostics and other data. Notes on the ones a reviewer may ask about:

- **Audio Data: not collected.** Dictation audio goes only to Apple's speech service, as part of the OS. The app does not send or keep it. Apple does not count processing by Apple's own frameworks as the developer's collection.
- **Search History: not collected.** Agenda and graph searches run on the device.
- **Identifiers: not collected.** No device ID, no advertising ID and no account. The OpenRouter key is the user's own credential, sent only to OpenRouter.
- **Vault files: not declared.** They are end-to-end encrypted. The server holds ciphertext it cannot read, under opaque names, and nobody can link them to a person. If Dinis prefers the stricter reading, add **Other User Content** again under the same answers (App Functionality, not linked, no tracking). The label does not change.
- **Ask: "not linked".** No account, no name and no device identifier is sent. The key is the user's, with their own OpenRouter account. OpenRouter's own terms apply to that account, and the privacy page says so.

**Tracking:** No. The app does not track users across apps or websites, and has no tracking domains.

## If Ask is ever hidden

In a build without Ask (and without Vault), nothing leaves the device except reads of public files. Then the answer is **"No, we do not collect data from this app"** (Data Not Collected). That is not the case for this submission.

## Consistency checks before submitting

- [ ] The privacy page lists the same features and hosts as the table above. Editor's `split/editor` privacy page; R3.
- [ ] `PrivacyInfo.xcprivacy`: `NSPrivacyCollectedDataTypes` is empty on dev, and Ask ships. **Apps adds** `NSPrivacyCollectedDataTypeOtherUserContent` (not linked, not tracking, purpose `NSPrivacyCollectedDataTypePurposeAppFunctionality`), so the manifest and the label agree.
- [ ] The widget and intents manifests (`split/apps` bc65b90) are merged.

## The exact keys for apps: `Apps/PrompTugal/Resources/PrivacyInfo.xcprivacy`

Replace the empty `NSPrivacyCollectedDataTypes` array with this one. It is the only change: tracking stays false, there are no tracking domains, and the two API reasons stay as they are. The widget and intents manifests need no collected types, because they send nothing.

```xml
<key>NSPrivacyCollectedDataTypes</key>
<array>
	<dict>
		<key>NSPrivacyCollectedDataType</key>
		<string>NSPrivacyCollectedDataTypeOtherUserContent</string>
		<key>NSPrivacyCollectedDataTypeLinked</key>
		<false/>
		<key>NSPrivacyCollectedDataTypeTracking</key>
		<false/>
		<key>NSPrivacyCollectedDataTypePurposes</key>
		<array>
			<string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
		</array>
	</dict>
</array>
```

Also update the comment at the top of the file: "Ask sends the user's questions and chosen context to OpenRouter (Other User Content, not linked, not tracking)." Check with `plutil -lint` after editing.