privacy
Local-First Privacy in Vagaloom: A Concrete Data Map
What Vagaloom keeps on iPhone, what Apple services may process, and what is not sent to Vagaloom servers.
The data map
| Data or service | Why it exists | Where it goes |
|---|---|---|
| Feeling check-in | Sets the starting context and records your reflection | Stored in the app on your iPhone |
| Manual BPM | Optional starting context | Stored with the local session record |
| Apple Health sample | Optional starting or later context | Read from HealthKit after permission; not uploaded to Vagaloom servers |
| Session timing and length | Runs and records the ritual | Stored in the app on your iPhone |
| Pro Lifetime purchase | Unlocks longer sessions and expanded history | Processed by Apple StoreKit |
What the product proves: you can complete a session without creating an account and without granting HealthKit access. Apple Health is one input, not a requirement.
HealthKit remains permission-based
Apple describes HealthKit as a central repository that apps access with the user’s permission. Vagaloom asks for heart-rate read access only when you choose the Apple Health path. Read Apple’s HealthKit overview.
What “local-first” does not promise
Local-first does not mean “no platform services exist.” Apple distributes the app, StoreKit handles purchases, and HealthKit may supply an optional sample. It means Vagaloom’s primary session history does not depend on a Borealbit account or a Borealbit data server.
It also does not make a lost or erased device recoverable. Review your device backup choices separately and do not assume an app-specific cloud sync feature that the product does not claim.
For the current operational details, read the Privacy Policy. If product behavior and this article ever disagree, the shipped app and current policy are the sources of truth.