Efferent — Privacy Policy
This document describes how the Efferent iOS app (dev.korchasa.efferent) and its archive service handle your data. The app and the service are published by Stanislav Korchagin.
- Your Health data is encrypted on your phone before it leaves. The archive service stores ciphertext only and has no key to open it.
- There are no accounts, no sign-in, no advertising, no analytics and no third-party SDKs in the app.
- The service learns three things about your archive: which days exist, how large each sealed day is, and when it was written.
- You decide who reads the archive by handing over the reading key yourself. Nobody else — the developer included — can read it.
What the app reads on your device
With your permission, Efferent reads from Apple Health the categories you allow in the Health permission sheet: activity totals (steps, walking and running distance, active and basal energy, flights climbed, exercise and stand minutes) and records (sleep, workouts, heart rate, heart rate variability, resting heart rate, respiratory rate, blood oxygen). Apple never tells an app which categories you allowed; the app simply receives nothing for a category you declined. You can change the permission at any time in Health → your picture → Apps and Services → Efferent.
Health data is used for one purpose only: to build the day objects described below and send them to your archive. It is never used for advertising, marketing, or research, never sold, and never shared with data brokers, in line with Apple's HealthKit requirements.
What is stored on your device
The app does not keep a copy of Health; Health itself remains the source. It stores bookkeeping only: for each day whether it still has to be sent and a fingerprint of what was sent last time, which day each Health record belongs to, and where each reader stopped. It also keeps two keys in the iOS Keychain: the reading key that seals your days and the signing key that proves uploads come from your phone. Deleting the app deletes all of this. Deleting the app also deletes the reading key, so keep the connection prompt you shared with an agent if you want to read the archive afterwards.
What leaves your device
Each day of Health is encrypted on the phone (HPKE with X25519, HKDF-SHA256 and ChaCha20-Poly1305) and uploaded to the archive service at api.efferentapp.com, a Cloudflare Worker storing objects in Cloudflare R2. What the service receives:
- Sealed days — ciphertext, one object per calendar date, each replacing the previous version of that date.
- The archive identifier — a hash of your reading public key. It is an address, not a secret, and cannot be turned back into the key.
- Your phone's public signing key, recorded when the archive is created, so that only your phone can write to it afterwards.
- An App Attest attestation, once, when the archive is created — a certificate from Apple stating that the request comes from a genuine copy of Efferent on a real iPhone. It identifies the app, not you or your device.
- Ordinary request metadata that any web request carries — an IP address and a timestamp — processed by Cloudflare to deliver the request and kept in short-lived operational logs.
The service does not receive the reading key, your name, your Apple ID, your email address, a device identifier, or the contents of any Health reading.
What the service learns
Which dates are in your archive, how many bytes each sealed day takes, and when each was written. That is as coarse as it can be while still answering a request: the date is the address. Encryption hides contents, not the fact of them — the service can tell that your archive begins in 2015 and that a day is larger than another, and nothing finer.
Who can read your archive
Only a holder of your reading key. The phone creates it and keeps the private half in the Keychain; the developer never has it. When you tap Connect, the app shows a prompt containing the archive's MCP address and the reading key. Share it only with an agent you trust: whoever holds that prompt can read every day in the archive. The agent decrypts on its own machine; the archive service is never handed the key and cannot open a day. What an agent does with decrypted data is governed by that agent's own privacy policy, not this one.
Retention and deletion
Sealed days are kept until you delete them, so that an agent can answer a question months later without your phone being awake. Deleting the app stops all uploads immediately but does not delete the archive. To delete an archive, open a support issue on GitHub (see Contact) quoting the archive identifier from the MCP address; the sealed days are removed within 30 days. Because the service holds only ciphertext, this deletes data nobody but you could read in the first place.
Payments
Efferent is a one-time purchase handled entirely by Apple through the App Store. The app contains no in-app purchases and no subscriptions, and the developer receives no payment details.
Children's privacy
The app is not directed at children and does not knowingly collect personal data from anyone under 13.
Cookies and tracking
The Efferent app sets no cookies and embeds no third-party trackers, analytics scripts, or advertising identifiers. It is not configured for tracking.
This website (the pages on efferentapp.com, including this one) uses Microsoft Clarity, a web-analytics service by Microsoft, to understand how visitors use the site — aggregated traffic, engagement, and anonymized session interactions. Clarity sets cookies and is loaded only after you accept the cookie banner; if you decline, no Clarity cookies are set and no analytics data is sent. See Microsoft's privacy statement. To change your choice later, clear this site's data in your browser.
Your rights
You can stop collection at any time by revoking Health access or deleting the app, export everything by pointing an agent or the reference reader at your archive with your key, and delete the archive as described above. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA; exercise them through the contact below.
Changes to this policy
If the app or the service changes how it handles data, this page will be updated and the effective date at the top will change. Material changes will also be noted in the App Store release notes.
Contact
Questions, concerns, or data requests: GitHub Issues. Privacy contact: coupes-cape.0o@icloud.com.