What leaves your phone
Every app in this category promises privacy. But that promise lives in a policy document, and documents get rewritten. TEMPLE has no networking code in it.
Every app in this category says it respects your privacy, and most of them mean it on the day they say it. The trouble is where that promise lives: in a privacy policy, which is a document the company can rewrite — in the next update, under the next set of investors, or by the next owner after an acquisition. Nothing about the software has to change for the promise to stop being true.
The data itself is what carries the risk. Once your record is on somebody's server it can be breached, subpoenaed, sold with the company, or quietly repurposed under a revised policy you agreed to by continuing to use the app.
The only privacy claim that cannot be revised later is one that describes a missing mechanism rather than an intention. So the app was built without the mechanism.
It is meant literally. There is no code in TEMPLE that opens a network connection. No account system, no server, no sync, no analytics SDK, no crash reporter, no advertising identifier, no telemetry of any kind. Not present and disabled by default — not present.
The practical consequences follow from that one fact rather than from a policy:
There is no account, so there is no password, no email address on file, and no database of users anywhere. A breach needs somewhere for the data to have been, and there is nowhere.
Your protocol and your training cannot be sold, leaked, subpoenaed or handed to an acquirer, because they are not anywhere to be handed over. This holds even if the app changes hands.
The whole app does — the passages, the sessions, the arithmetic, the export. None of it was ever waiting on a network, so none of it degrades without one. That is also the simplest way to check the claim yourself.
Local-only would be worth very little if it also meant locked in. The export is therefore the point where you, not the app, move the data: a CSV of the raw record, and a PDF laid out to be handed to a physician, both generated on the device from what is already there. Nothing is uploaded to produce either one, and you choose where the file goes.
This is the real price and it should not be buried. Delete the app and the record goes with it. Lose the phone without a device backup and the record is gone. There is no account to sign back into, because an account is exactly the thing that would undo everything above.
So: export anything you want to keep, before you need it. Your record lives on your device and leaves it only when you move it yourself.
Worth separating, because the claim above is about the app and this is a website. This site is served by Cloudflare, and Cloudflare counts pageviews for it: one script from their domain, and one request telling them a page was loaded. That is the only thing here that measures anything, and it is the host's rather than ours.
What it does not do is also worth stating. It sets no cookies, stores nothing in your browser, and follows you nowhere else. There is no advertising on this site and nothing is sold to anyone. The typefaces are served from this domain rather than fetched from someone else's.
None of it can see anything in the app, and that is the part that matters: a pageview counter knows a browser opened this page, and nothing on earth knows what is in your record, because the app has no way to send it. Open your browser's network tab and check — both halves of that are visible there.
The four pillars