Owner’s Manual — Privacy

Last updated 12 September 2026

Your manual lives on your phone. Turn sharing on and a copy goes to your iCloud account, so the other people in the house can open the same one. That is the only time anything about your house leaves the phone, unless you export it and send it somewhere yourself.

We do not run a server and we do not hold your data. There is no account to make with us and nothing here for us to look at. The rest of this page is the detail.

With sharing off

Everything is in one file on the phone. Facts, tasks, history, photos, the drawing of your house. None of it goes anywhere.

The app still reaches the internet twice, and neither trip carries anything of yours.

• Apple’s check on the unlock. Buying the app, or restoring a purchase, is Apple’s payment system talking to Apple.
• A check for a newer version. The app asks whether an update is waiting. It sends the platform and which version it is running. No identifier, nothing about your house.

Facts in iPhone search puts your facts into your phone’s own search index. That index is on the phone. Turning it off takes them back out.

Export makes a file and hands it to you. Where it goes after that is up to you. Export is never behind the purchase.

Turning sharing on

Sharing puts a copy of the manual in the iCloud account of whoever turned it on. It sits in their private iCloud storage, the same place their photos and their notes sit.

We are not in the path. No server of ours sits between the two phones, there is no account of ours, and nothing of yours lands on anything we run. When the app syncs, it is talking to Apple.

The invitation goes to named people. Apple’s sharing sheet can offer a link that anyone who gets it can open. This app never turns that on, for one reason: a public link switches off end-to-end encryption for the whole share.

Everyone invited can write. There is no read-only guest. It is the people who live in the house.

What travels:

• The house and its zones
• Facts, tasks, and the history of what was done
• Photos, and the pictures themselves
• The record that the app is unlocked, because the purchase covers the house rather than one phone

What stays on your phone:

• Your pinned facts, and what you looked at recently
• Where you are in a walkthrough
• Your settings — reminders, notifications, search
• The id this phone uses to break ties when two people edit the same thing on the same day

Those are yours rather than the house’s.

Photos are allowed to be late. The entry arrives before the picture does. A photo added on one phone can show up on the other as an entry with no picture yet, and the picture follows.

It only syncs while the app is open. The app has no permission to wake itself in the background, and does not ask for one. It syncs when you open it, when you come back to it, and a moment after you write something. Opening the app is what catches it up.

It uses the owner’s iCloud storage — whoever turned sharing on. If their iCloud fills up, new entries stop saving for everybody until there is room.

Leaving. Whoever leaves, or gets removed, keeps everything already on their phone. Nothing is taken back. They stop receiving anything new, and the app tells them once.

Advanced Data Protection

Apple has a switch called Advanced Data Protection. It decides who holds the keys to your iCloud data, and it is off unless you went and turned it on.

With it off, your data is encrypted on the way to Apple and encrypted sitting on Apple’s servers, and Apple holds a key. Apple can decrypt it — for its own systems, to recover your account, and if a court orders it.

With it on, only your own devices hold the keys. Apple cannot read it. Apple also cannot get it back for you if you lose access to your account and your recovery contacts, which is the real cost of turning it on.

Three things about it that nobody tells you.

It has to be on for everyone in the share. One person without it drops the whole share to standard protection — for all of you, not just for them.

Nobody is warned. Apple’s sharing flow says nothing about it either way.

This app cannot check. There is no way for an app to ask whether Advanced Data Protection is on, for you or for anyone else in the share. So the app never tells you which state you are in.

Where to look: your phone’s Settings, your name at the top, then iCloud, then Advanced Data Protection.

About the encryption itself. The app writes every field through Apple’s encrypted-values interface, with one exception: a photo’s picture, which CloudKit encrypts its own way instead. Both get the same upgrade to end-to-end encryption once Advanced Data Protection is on, and both are Apple’s standard protection without it — the mechanism is different, not what it buys you. The app uses the strongest protection available either way, because it costs nothing and a house manual holds alarm codes and gate combinations. We do not describe this app as end-to-end encrypted, because whether it is depends on a setting we cannot see.

What this app never does

• No server of ours and no account of ours, under any version of sharing.
• No analytics. Nothing in here measures what you do.
• No “anyone with the link” sharing.
• No claim about encryption that the app cannot check.
• Sharing is never on by default, and the app never asks you to turn it on. It is a row in Settings you go and find.
• Nothing is clawed back from somebody who leaves.
• Your export is always yours, and never behind the purchase.

If you email us

Writing to us with a question or a problem reaches us the way any email does: with your address on it, and whatever you chose to write. We keep it for as long as it takes to deal with it and use it for nothing else. It is never added to a mailing list, never sold, and never connected to anything in the app — there is nothing in the app it could be connected to. If you would like your messages deleted, ask, and we will delete them.

Children

The app is not directed at children and collects nothing that would identify anyone of any age.

Changes

If this policy changes, the date at the top changes with it. If a change ever makes a material difference to what leaves your phone, it will be described in the app’s release notes as well as here, rather than left for you to notice.

Contact

Owner’s Manual is published by Schema Software, LLC, North Carolina, United States. For anything in this policy, including a deletion request, write to support@schemasoftware.co.