Efferent — Privacy Policy
This document describes how the Efferent iOS app (dev.korchasa.efferent) and its archive service handle your data. The app and the service are published by Stanislav Korchagin.
- Your Health data is encrypted on your phone before it leaves. The archive service stores ciphertext only and has no key to open it.
- There are no accounts, no sign-in, no advertising, no analytics and no third-party SDKs in the app.
- The service learns three things about your archive: which days exist, how large each sealed day is, and when it was written.
- You decide who reads the archive by handing over the reading key yourself. Nobody else — the developer included — can read it.
- An agent you connect can also ask the phone to log an entry in Health. It can only ever touch the entries this app wrote for it, and you can take any of them back.
- So that an agent's entry reaches Health while the app is closed, the service can wake your phone. The wake is silent, carries nothing, and shows nothing.
What the app reads on your device
With your permission, Efferent reads from Apple Health the categories you allow in the Health permission sheet: activity totals (steps, walking and running distance, active and basal energy, flights climbed, exercise and stand minutes) and records (sleep, workouts, heart rate, heart rate variability, resting heart rate, respiratory rate, blood oxygen). Apple never tells an app which categories you allowed; the app simply receives nothing for a category you declined. You can change the permission at any time in Health → your picture → Apps and Services → Efferent.
Health data is used for one purpose only: to build the day objects described below and send them to your archive. It is never used for advertising, marketing, or research, never sold, and never shared with data brokers, in line with Apple's HealthKit requirements.
What the app writes into Health
An AI agent you have connected can ask the phone to log an entry, and the phone writes it into Apple Health on your behalf. Seven kinds of entry can be written and nothing else: sleep, dietary energy, protein, carbohydrates, fat, water and body mass. Nothing the app reads is ever written back on its own. Write permission is asked for in the same Health sheet as reading, and you can withdraw it at any time in Health → your picture → Apps and Services → Efferent.
An agent can only ever reach the entries this app itself wrote at its request: each one carries the app's own HealthKit sync identifier, the app looks for no others, and HealthKit does not let one app change or delete another app's samples. Nothing the Apple Watch, the Health app or any other app recorded can be touched. Before the phone replaces or removes one of its own entries, it reads the record it is about to displace and keeps a copy on the device, because that is the last moment anything can read it. The Agent edits screen lists everything an agent has asked for and what became of each item, and every item can be taken back: an entry that was added is removed again, and one that was replaced or removed has the record that stood there written back into Health.
The archive service is told how many items were written and a code for each one that was not. It is never told the metric, the value or the time, so it cannot know what an agent asked for or what you decided.
What is stored on your device
The app does not keep a copy of Health; Health itself remains the source. It stores bookkeeping only: for each day whether it still has to be sent and a fingerprint of what was sent last time, which day each Health record belongs to, and where each reader stopped. It also keeps the details of every entry an agent asked it to write — the metric, the value and the time — and, whenever one of those entries replaced or removed an earlier one, a copy of the record that was displaced; the service is never told any of it, and this is the only place it survives. That is what the Agent edits screen shows and what putting a record back uses. And it keeps three keys in the iOS Keychain: the reading key that seals your days, the signing key that proves uploads come from your phone, and the editor key that an agent signs its requests with, handed to that agent in the same connection prompt. Deleting the app deletes all of this. Deleting the app also deletes the reading key, so keep the connection prompt you shared with an agent if you want to read the archive afterwards.
What leaves your device
Each day of Health is encrypted on the phone (HPKE with X25519, HKDF-SHA256 and ChaCha20-Poly1305) and uploaded to the archive service at api.efferentapp.com, a Cloudflare Worker storing objects in Cloudflare R2. What the service receives:
- Sealed days — ciphertext, one object per calendar date, each replacing the previous version of that date.
- The archive identifier — a hash of your reading public key. It is an address, not a secret, and cannot be turned back into the key.
- Your phone's public signing key, recorded when the archive is created, so that only your phone can write to it afterwards.
- Your read public key — derived from your reading key and registered by your phone, so that only a holder of the reading key can fetch the sealed days. It cannot be turned back into the reading key.
- Your agent's public editor key — registered by your phone, so that the service accepts edits only from the agent you connected.
- An App Attest attestation, once, when the archive is created — a certificate from Apple stating that the request comes from a genuine copy of Efferent on a real iPhone. It identifies the app, not you or your device.
- The outcome of an agent's edit — how many items the phone wrote and a code for each one it did not, such as a type you have switched off in Health or a record it is not allowed to touch. Never the metric, the value or the time.
- A way to wake your phone — a device token issued by Apple for this installation of this app, registered by the phone so that the service can tell it an agent's entry is waiting. It is deleted when you disconnect, and it identifies an app installation rather than you. If the phone never registers it, an agent's entry simply waits until you next open the app.
- Ordinary request metadata that any web request carries — an IP address and a timestamp — processed by Cloudflare to deliver the request and kept in short-lived operational logs.
The service does not receive the reading key, your name, your Apple ID, your email address, a device identifier, or the contents of any Health reading.
What the service learns
Which dates are in your archive, how many bytes each sealed day takes, and when each was written. That is as coarse as it can be while still answering a request: the date is the address. Encryption hides contents, not the fact of them — the service can tell that your archive begins in 2015 and that a day is larger than another, and nothing finer.
It also learns, because it can wake your phone, the moments it did so — which are the moments an agent asked for an entry. The wake itself says nothing: no count, no metric, no value, no date, and nothing about what the phone did with the request. Your phone reads the waiting entry from the archive itself and decides everything that follows.
Who can read your archive
Only a holder of your reading key. The phone creates it and keeps the private half in the Keychain; the developer never has it. When you tap Connect, the app shows a prompt containing the archive's MCP address and the reading key. Share it only with an agent you trust: whoever holds that prompt can read every day in the archive. The agent decrypts on its own machine; the archive service is never handed the key and cannot open a day. What an agent does with decrypted data is governed by that agent's own privacy policy, not this one.
Retention and deletion
Sealed days are kept until you delete them, so that an agent can answer a question months later without your phone being awake. Deleting the app stops all uploads immediately but does not delete the archive. To delete an archive, open a support issue on GitHub (see Contact) quoting the archive identifier from the MCP address; the sealed days are removed within 30 days. Because the service holds only ciphertext, this deletes data nobody but you could read in the first place.
Payments
Efferent will be a one-time purchase handled entirely by Apple through the App Store; it is not on sale yet. The app contains no in-app purchases and no subscriptions, and the developer receives no payment details.
Children's privacy
The app is not directed at children and does not knowingly collect personal data from anyone under 13.
Cookies and tracking
The Efferent app sets no cookies and embeds no third-party trackers, analytics scripts, or advertising identifiers. It is not configured for tracking.
This website (the pages on efferentapp.com, including this one) uses Microsoft Clarity, a web-analytics service by Microsoft, to understand how visitors use the site — aggregated traffic, engagement, and anonymized session interactions. Clarity sets cookies and is loaded only after you accept the cookie banner; if you decline, no Clarity cookies are set and no analytics data is sent. See Microsoft's privacy statement. To change your choice later, clear this site's data in your browser.
Your rights
You can stop collection at any time by revoking Health access or deleting the app, export everything by pointing an agent or the reference reader at your archive with your key, and delete the archive as described above. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA; exercise them through the contact below.
Changes to this policy
If the app or the service changes how it handles data, this page will be updated and the effective date at the top will change. Material changes will also be noted in the App Store release notes.
Contact
Questions, concerns, or data requests: GitHub Issues. Privacy contact: [email protected].