Please Give Me Attention
Last updated 27 September 2026
This app has no servers. There is no account to create, no analytics, no advertising, and no third-party code that phones home. The developer cannot read your messages, cannot see how often you use the app, and has no way to identify you.
What follows is the long version, because the short version is the kind of claim anyone can make. Everything here is verifiable in the source code, which is public.
Two people pair their devices, either by scanning a QR code in person or by sending an invite link. Either can then press a button, and the other's device shows a notification. The other person can acknowledge it. That is the entire product, and it is the reason the data involved is so small.
In your own iCloud account, and your partner's. The app uses Apple's CloudKit. Each of you owns a private storage zone in your own iCloud account and shares it with the other person. When you press the button, a record is written into their zone; what arrives for you lands in the zone you own.
Nobody else has access. Not other users of the app, and not the developer, who operates no server and holds no credentials to your iCloud account. Apple hosts the storage, so Apple's own privacy policy applies to that layer.
Before anything is written to iCloud, the human-readable parts are encrypted on your device with ChaCha20-Poly1305, under a key derived (HKDF-SHA256) from a secret created when you paired. It travels once, either in the QR code you scan in person or in the invite link you send, and is never sent to a server of ours. An invite link is only as private as the app you send it with, so send it somewhere only your partner reads. (If you use iCloud Keychain, Apple syncs it between your own devices, end-to-end encrypted, so it stays unreadable to Apple as well.)
| What | Where | Readable by the storage provider? |
|---|---|---|
| Your display name | iCloud | No — encrypted |
| Message text on an alert | iCloud | No — encrypted |
| Acknowledgement emoji | iCloud | No — encrypted |
| Alert state (sent / seen / acknowledged) | iCloud | Yes |
| Timestamps | iCloud | Yes |
| A random per-install identifier | iCloud | Yes |
| Whether an alert was marked urgent | iCloud | Yes |
The unencrypted fields are structural: the app has to sort and filter on them, and encrypting them would break that. They contain no text you typed. The per-install identifier is a random value generated on your device — it is not your Apple ID, your phone number, your device serial, or an advertising identifier, and it is not linked to your identity anywhere.
The honest limit. Encryption protects your content from the storage provider. It does not protect you from the other person, who by design can read everything you send them; nor from someone who has unlocked access to either device, since the key is on both. In a two-person app that is the right place for the boundary, but it is a boundary, and you should know where it sits.
Notifications are delivered through Apple Push Notification service. To receive them your device registers a push token with Apple. The notification your device receives is decrypted on your device, not in transit — Apple delivers a signal, and the app fetches and unlocks the content locally.
The camera is used for exactly one thing: reading the pairing QR code. Frames are examined for a QR code and discarded. Nothing is recorded, saved, or transmitted. If you decline camera access the app still works — you can pair from a link instead.
Settings has an Export diagnostics button. It does not send anything on its own: it shows you the complete report on screen first, and you decide whether to share it and with whom.
The report is built so that it cannot carry your content. Names, message text and emoji are structurally absent from it. Identities appear as truncated one-way hashes, settings as on/off values. The one field that quotes outside text — a storage error message — is scrubbed before it is stored.
Settings → Erase all my data deletes the storage zone you own in iCloud, your local history, your settings, and the pairing key, and cancels any pending notifications. It cannot be undone.
It deliberately does not reach into your partner's storage, because those records are in their iCloud account and belong to them — deleting them is their action to take. But what you sent them is encrypted with the key this erases, so once you do, neither of you can read it.
Deleting the app also removes everything stored on the device.
Versions before 2.0 stored records in a shared CloudKit database that any signed-in iCloud client could read, with the pairing value stored in the clear alongside them. That design is gone. Upgrading re-pairs you under a new key and copies your old history to your device; the original records are deleted once both partners have upgraded. If you used the app before version 2.0, treat anything sent then as having been readable.
If this policy changes materially, the date at the top of this page changes with it, and every earlier version is public in the repository — each one is a commit.
Questions, or a privacy request: timfall+github@gmail.com. Security issues have their own process, described in SECURITY.md.