Website privacy

Privacy Policy

App: Monk

Provider: Stoic AS, organisation number 926 193 880

Contact: [email protected]

Effective date: 4 October 2026. The parts marked “From Monk 1.1.4” apply from that version.

In short

Monk works offline without an account. Your practice stays on your iPhone unless you explicitly choose cloud sync. Cloud sync is unticked by default and is not required to use the app. We do not sell personal data, show advertising in the app, track you across other companies' apps and websites, or collect developer diagnostics. From Monk 1.1.4, outside the EU, EEA, UK and Switzerland, Monk tells Meta that it was installed and opened, so we can see whether our Facebook and Instagram ads work. Nothing you record is sent, and you can turn it off (see Measuring our own ads (Meta)).

On-device use

Without cloud sync, Monk stores the following only on your device:

• Habits and private commitments, custom names, plans, timers, completions, held/slip corrections, elapsed history, and settings
• Morning intentions, evening reflections, mood, and notes
• Meditation sessions and minutes imported from Apple Health, with source identifiers and time intervals for new imports, if you enable Health access

The private practice record, including rescued unreadable copies, is encrypted using a key that stays on this device. These files and the widget snapshot are marked excluded from device backups. A device-only key does not migrate to another iPhone, so recover there using optional Monk cloud sync or an explicit Monk export. This update cannot remove copies in earlier device backups.

Exports contain your readable practice data. Their temporary working files are protected and removed after the share sheet closes; the destination you choose controls any further storage or sharing. A support recovery export may also contain damaged or encrypted files that require help to interpret. Monk preserves recovery copies when replacing an unreadable record rather than silently discarding them.

Deleting Monk removes its local files. Reset progress clears the active local practice from within the app; previously rescued recovery copies remain available for support until the app's local files are removed.

New Health imports retain sample identifiers so an explicit deletion returned by Health can correct Monk's copied totals. Earlier imports have no source identifiers and remain independently saved in Monk until you delete them here. The new format begins at the next calendar midnight after the accepted history is reconciled. Empty queries or denied read access never erase saved minutes. Health can stop retaining old deletion records, so Monk may miss a deletion after a long absence. These identifiers and intervals are protected like the rest of your practice record.

Optional cloud sync and explicit consent

Before any practice data is uploaded, Monk shows an unticked consent choice explaining what cloud sync stores and where. If you choose it, Monk records the consent time and policy version. Existing accounts must reconfirm when the consent policy changes before further uploads.

Cloud sync stores the following with Supabase in Stockholm, Sweden:

• Email address, Apple account identifier, and your chosen profile name
• Habits and commitments, including custom names and plans; timers, completion and elapsed history; reflections, mood, and notes
• Meditation entries derived from Mindful Minutes, including source identifiers, time intervals, explicit source-deletion markers and manually suppressed import intervals for new imports, if you enable Apple Health and cloud sync; Monk does not upload your raw Health database or unrelated Health data
• Private friend data (display name, friend code and relationships) and private challenge rules, readiness, and final outcome
• Blocked-account relationships and saved display names; reports of shared content, including the reporter and reported account identifiers, shared-item identifier, relevant shared text, selected reason, submission time, moderation decision and review time

These records are linked to your account and may reveal sensitive matters, including information about health, beliefs, addiction, sexuality, or other private commitments. Cloud sync is provided only after your explicit choice and is used solely to provide account authentication, backup, cross-device sync, private challenges, export, support, and deletion.

Sign in with Apple provides an Apple user identifier and an email address, which can be Apple's private relay address. We use them only for account functionality and support, never marketing. Monk also stores Apple's authorization tokens encrypted on the server to check whether your Apple authorization remains valid and revoke it when you delete your account. These tokens are not available through the app's database access and are removed with your cloud account.

Shared content and moderation

Monk checks shared display names, challenge titles and shared habit names against a text filter. Your private practice history, Health entries and private notes are not copied into reports or used for shared-text moderation. When you deliberately report a shared item, the server selects only its relevant shared text and sends it with your selected reason to a private moderation queue. Stoic AS uses these records to investigate abuse and decide whether to hide content or restrict social features. Ordinary users cannot read the queue or see who reported or blocked them.

Blocking stores the two account identifiers and the blocked person's display name so you can manage your list. Reports and moderation restrictions remain linked to the relevant accounts while those accounts exist. Deleting either account involved in a report or block removes that linked report or block from the live database. Contact support if you want to discuss or correct a report or moderation decision.

Feedback and ratings

If you choose Send feedback or rate Monk in Settings, or Tell me what's missing on the unlock screen, Monk sends what you write, the star rating, and the Monk and iOS version numbers to Stoic AS, with a random number made for that one message so a retry is never stored twice. Nothing else is attached: no account, name, email address, practice record or device identifier, so feedback is not linked to you and we cannot reply to it. It is stored in Monk's Supabase project in Stockholm, Sweden, and forwarded to our operator by email through Resend. We use it only to understand and improve Monk and keep it only as long as it is useful for that. Network addresses are not stored with it. Ratings stay private: Monk never sends them to the App Store and never asks you for an App Store review.

Measuring our own ads (Meta)

From Monk 1.1.4, the app includes Meta's SDK only to learn whether our own Facebook and Instagram ads lead to installs. It runs only when your App Store country is outside the EU, EEA, UK and Switzerland, and only while Settings → Account & data → Ad measurement is on. It is on unless you turn it off. Earlier versions do not include Meta's SDK and send nothing to Meta.

• What is sent: that Monk was installed, each time it is opened, and how long the previous visit lasted; a random install ID the SDK creates and keeps in Monk's storage; the device model, iOS and Monk versions, language, time zone, carrier and screen size; and the IP address of the connection.
• What is never sent: the Advertising Identifier (IDFA), your account, name or email address, your habits, private commitments, timers, reflections, Health data, purchases or trial status, or anything else you record in Monk.
• No tracking prompt: Monk never shows Apple's App Tracking Transparency prompt, so iOS tells Meta that tracking is not authorised. Meta states that it then uses such events only in aggregated, privacy-preserving form (Aggregated Event Measurement). Apple's SKAdNetwork reports installs from ads without identifying you.
• Meta's role: Meta Platforms, Inc. receives these events under its Business Tools Terms and its own privacy policy (https://www.facebook.com/privacy/policy), and may keep them for up to two years.
• Your choice: turn off Ad measurement in Settings → Account & data to stop all further events, or delete Monk.

App Privacy inventory

For App Store privacy disclosure, Monk's complete developer-collected data inventory is:

• Email Address
• Name
• User ID
• Health
• Other User Content
• Sensitive Info
• Customer Support
• Device ID (from Monk 1.1.4)
• Product Interaction (from Monk 1.1.4)
• Other Data Types (from Monk 1.1.4)
• Coarse Location (from Monk 1.1.4)

No category is ever used for tracking. The first seven are used only for App Functionality. Customer Support (the feedback and ratings you choose to send) is not linked to you; the other six of those are linked to the account. From Monk 1.1.4, Device ID (the SDK's random install ID), Product Interaction (install, opens and visit length), Other Data Types (device model, versions, language, time zone, carrier) and Coarse Location (the approximate area Meta can derive from the connection's IP address) are used only for Developer's Advertising or Marketing and Analytics, to measure our own ads as described in Measuring our own ads (Meta). All four are treated as linked to you. Monk does not developer-collect Purchase History, Precise Location, the Advertising Identifier (IDFA), or Diagnostics. Apple processes the App Store purchase; Stoic AS does not receive your payment details or purchase history. Whether you have started the trial or unlocked Monk is checked by Apple's StoreKit on your device and stored only on your device. It is never sent to Stoic AS. MetricKit diagnostics remain on the device unless you deliberately export and send information to support.

Device permissions

• Apple Health: optional read and write access to Mindful Minutes only. The disclosure appears before the system permission request. Access can be changed in iOS Settings.
• Screen Time / Family Controls: optional on-device selection and shielding for ordinary or strict phone fasts. App and website selections stay in Apple's Screen Time system and are not uploaded. Monk uploads no attempted-app or website history.
• Location: optional on-device calculation of local sunset for reminders. Precise coordinates are rounded to whole degrees before the coarse region is cached on your device for future sunset calculations. Monk does not retain precise coordinates or upload location.
• Notifications: optional reminders and live progress you request.
• Photos (add only): when you choose Save Image for a share card, iOS asks whether Monk may add that image to your Photos. Monk cannot read or browse your photo library.

Processors and international handling

Stoic AS is the data controller for optional cloud data. Resend delivers moderation alerts to our operator, containing only a report identifier, category and submission time, with a link to the private queue. Shared text, names, private practice records and Health records are not included in these alerts. Resend also delivers the feedback and ratings you choose to send, as described above. Supabase provides authentication, database, Edge Functions, and hosting as our processor in Stockholm, Sweden. Apple separately processes Sign in with Apple, App Store purchases, HealthKit, Screen Time, and notifications under Apple's terms. From Monk 1.1.4, outside the EU, EEA, UK and Switzerland, Meta Platforms, Inc. receives the ad-measurement events described in Measuring our own ads (Meta).

Apart from Meta's SDK, used only to measure our own ads as described above, we do not use advertising networks, third-party analytics, or tracking SDKs, and we do not sell data or build marketing profiles.

Retention and account deletion

Active cloud data is kept while your account exists. In Settings → Account & data → Delete account and cloud data, Monk requires a fresh Sign in with Apple confirmation, requests revocation of Monk's Apple authorization, hard-deletes the Supabase Auth user, and removes all linked live database rows. The app reports account deletion only after both Auth deletion and database cascades are verified. If Apple authorization cannot be revoked automatically, Monk still deletes the account and provides Apple's instructions for manually removing the authorization. An unconfirmed deletion preserves your local record and shows a retry or support route; a partial server deletion may already have ended the cloud session.

Deleted data can remain temporarily in encrypted disaster-recovery backups until the processor's configured backup rotation expires. Those backups are isolated from ordinary processing and are used only for service recovery; deleted records are removed again if restoration is required. We may keep only records required by law.

Your rights and choices

You may keep all data on-device, export your local Monk record, sign out, withdraw consent by deleting the cloud account, reset local progress, or, from Monk 1.1.4, turn off Ad measurement in Settings → Account & data. Depending on applicable law, you may request access, correction, deletion, restriction, objection, or portability. Contact us to exercise these rights. You may complain to Datatilsynet or your local supervisory authority.

Children

Monk is not directed at children under 13 and does not knowingly collect their information.

Changes

The current policy is posted at https://monkhabits.app/privacy. Material changes to cloud processing or consent will be shown in the app before further uploads.

Contact

Stoic AS

Eirik Raudes vei 56, H0201, 0196 Oslo, Norway

Organisation number 926 193 880

[email protected]