Wren Privacy Promise

Last updated: 30 July 2026

Wren is a private diary for people living with Parkinson's, ALS, Alzheimer's and MS, and for the people who care for them. Health information is among the most personal information there is, so Wren is built to hold as little of it as possible, in as few places as possible.

This is the whole of it. Nothing important is kept for a footnote.

The short version

Your diary is stored only on your phone. There is no account, no password, and no sign-in. We do not sell, share, rent, or mine your information, and we never show you advertising.

Some things do leave your phone, so that Wren can answer you and write your letter. They go to Wren's server and are passed to Anthropic's Claude, which reads them and sends its answer straight back. We do not store them. Anthropic does not train on them, and holds them only for a short period described under "What leaves your phone" below.

When you write an entry, the words of that entry are sent, so they can be sorted into symptoms and times.

When you talk to Wren, more is sent, because a companion that cannot remember you is not much of a companion. Each time you send a message, Wren sends your name, what you live with, your medicines and their times, your last few diary entries, what you told Wren about yourself, everything Wren has learned about you since, and the counts it keeps: how often things have happened, how your doses have been going, and your check scores. You can see everything in the "what Wren remembers" list, and anything you delete there stops being sent.

When you ask for the doctor's letter, the whole of that period is sent, including sentences you wrote in your own words and the spirals you drew.

Your videos are never sent anywhere, and neither Wren nor anybody working on it ever receives a voice recording. The only way a recording leaves this phone is if you send it yourself, from the "Your voice" screen, to somebody you choose. Photographs and documents you attach are sent to be read, once, at the moment you attach them, and are not kept there.

If you turn on the care circle, a summary of counts is uploaded to our server so that a person you name can see it on their own phone. It is sealed on this phone first. That section is below, in full, and it is the most important one in this document.

If you buy Wren Plus, Apple takes the payment and a service called RevenueCat checks the receipt. That section is below too. Every company that receives anything at all is listed in one place further down, under "Who else receives anything", and there are more than the two named here.

Calling Wren

You can talk to Wren out loud and hear it answer. Your speech is turned into text on this phone, by the phone. The audio of a call is never recorded and never leaves the device. The text of what you said is sent so that Wren can reply, along with what Wren knows about you, as described under "What leaves your phone" below.

A call ends the moment you put the phone down, lock it, or leave the app. Wren does not listen in the background, and there is no way to make it.

So that Wren does not sound like a robot, the sentence Wren says back to you is sent to a speech service, which returns it as audio. Only Wren's own words are sent. Never yours, never your diary, and never your name unless Wren used it. The audio is played once and kept nowhere on your phone. If that service is unavailable, your phone reads Wren's words aloud in its own voice instead, and nothing else changes.

The speech service we use is ElevenLabs. It receives Wren's sentence and returns audio, and it is bound by its contract with us not to use it for anything else.

Photographs, videos, voice memos and documents

You can attach four kinds of thing to a diary entry: a photograph, a document, a video, or a voice memo. A bruise after a fall, a clinic letter, a short film of how you are walking, a message you did not want to type.

Videos and voice memos are kept and never sent. Wren cannot open them, so it never tries. They are copied onto this phone, played back from this phone, and are not part of anything that goes to Anthropic or to your care circle. If you want them in the record, tell Wren what is in them and it writes that down beside the file.

Wren copies the file onto this phone and keeps it there. It is never uploaded to us, and we never hold a copy of it.

A page is sent to Anthropic to be read. When you attach a clinic letter, a pharmacy list, a scan report, or anything else that is a page of writing, Wren sends it so it can tell you what it says. Up to four pages go at a time, as images or PDFs. Anthropic does not train on it. Nothing Wren reads off a page goes into your diary, your medicines, or your memory until you tap it yourself.

A photograph of your body is described, not judged. People photograph pressure sores, bruises after a fall, rashes, catheter sites and swollen ankles, and a description written down on the day, read next to one from a fortnight later, is often the most useful thing in the record. So Wren describes what it can see: where it is, roughly how big, the colour, whether the skin is broken.

It stops there. It will not tell you what something is, it will not tell you what to do about it, and it will not tell you whether it looks better or worse. It will not reassure you, and that is deliberate: one photograph in one light is not an examination, and a machine saying "that looks fine" is how something that needed seeing gets left. If you are worried about something, ring somebody.

If you would rather a photograph never left this phone at all, do not attach it.

Photographs are copied without their location data. Deleting the diary entry deletes the files with it.

Video

Wren can film a short movement check, such as your walking or your hands, when you choose to. You pick which one, or none at all.

The film is written to this phone's own storage and it stays there. It is never uploaded, never sent to Anthropic, never sent to us, and never included in anything Wren shows an AI. Nobody but you can see it unless you show it to somebody.

Deleting the diary entry deletes the film with it. Deleting Wren deletes every film.

We do not analyse these films. Nothing looks at them, on this phone or anywhere else. Wren records, keeps and plays them back, so that you can show your doctor something they would otherwise only hear described.

The spiral is worth a word, because it is the one thing that is not a film. When you draw a spiral with your finger, that drawing is a set of points on a screen, and the phone does describe it: how long it took, and how far the line ran from the printed guide it was traced over. Those go on the page you take to your appointment, beside the drawing itself. It happens entirely on this phone, and the drawing is never uploaded.

That is the whole of it. Wren does not work out how fast your hand shakes, does not put a number on a tremor, does not tell you what any of it means, and does not say whether a drawing is better or worse than the last one. It describes a line against another line. The picture is the thing worth having, it is kept so you can show somebody, and the only person who can read anything into it is your clinician.

What Wren stores, and where

Wren stores the following on your device only:

• Your first name, and the name of the person you care for, if you gave one.
• The condition you selected during setup.
• Your medicine names, doses and reminder times.
• Your diary entries, including the full text of what you said or typed, and the tags Wren derived from it.
• Which doses you have marked as taken, or skipped.
• Photographs, documents, videos and voice memos you attached, as files.
• Any recordings you deliberately made under "Your voice", as sound files.
• How many of a medicine you told Wren you had, and when you counted them.
• Your cognitive check scores, your spiral drawings, and your game results, if you did any.
• The walking measurements read from Health, if you turned that on.
• If you use the care circle: the 3-word code, your role in it, and what you chose to share.
• Anything you wrote in the community. There is no community server yet, so it stays here.

This information is held in your phone's private application storage, which other apps cannot read. It is included in your device backup only if you have your own phone backup turned on, in which case it is protected by your device and backup provider, not by us.

If you delete Wren, all of it is deleted with it, including every voice recording. Inside the app you can delete any single thing at any time: a diary entry from the diary, a fact from "what Wren remembers", a letter from the doctor screen, and a recording from "Your voice". Deleting the app is the way to remove everything at once.

Turning your speech into text

When you tap "Talk to Wren", your phone's built-in speech recognition converts your speech to text.

• On iPhone, Wren requests on-device recognition, so your speech is processed by the phone itself.
• On Android, Wren uses the system speech service. Depending on your device and settings, and whether an offline language model is installed, that service may process audio using Google's speech recognition. This is the same service used by your keyboard's dictation button, and it is governed by Google's privacy policy.

Wren does not keep audio after it has been turned into text, except in the two places described in the next paragraph, where you asked it to. Your audio never leaves your phone. The resulting text is sent to be organized, as described below. If you would rather not use the microphone at all, every part of Wren works by typing instead.

Wren keeps audio in only two places, and you put it there in both: the recordings you deliberately make under "Your voice", described next, and a voice memo you record for your diary. A voice memo asks you, once you have finished speaking, whether to keep the recording or only your words; choosing your words deletes the sound from this phone there and then. Neither is ever uploaded.

Your voice, kept on purpose

Wren has a screen called "Your voice" where you can record yourself: messages for the people you love, and a set of sentences read aloud so that, one day, a service could build a synthetic voice for a speech device out of them.

These are the only sound files Wren keeps on purpose.

• They are saved on this phone, in Wren's own private storage, along with a plain text list of what is in each file so that somebody could make sense of the folder years from now without this app.
• Wren never uploads them. Not to us, not to Anthropic, not to any speech service. They are never sent to be transcribed, analysed, or described. The only way one leaves this phone is if you send it yourself, to somebody you choose, using your phone's own share button. That does not go through us.
• Nobody in your care circle can hear them. The summary that goes to a person watching over you carries counts and labels, never words and never sound. Recordings are not part of it in any form.
• Wren never listens back to them and never forms a view about them. It will not tell you that your voice has changed, and it does not compare one recording to another.
• You can delete any recording, and the sound file goes off the phone with it.

They are included in your phone's own backup if you have one turned on, which is between you and your backup provider. There is no copy of them anywhere else, so if you want somebody else to have them, send the ones that matter to somebody you trust.

What your phone measures by itself

Your iPhone has been quietly measuring how you walk for years: your walking speed, how long your steps are, how steady you are, how much one side differs from the other. Apple measures it. Wren does not, and cannot.

If you turn it on, Wren reads those numbers so they can go on the summary you take to your appointment.

• Off unless you turn it on, in Settings, and you can turn it off again at any moment. Turning it off deletes every reading Wren has read.
• Read only. Wren asks Apple for permission to read six things and for permission to write nothing. There is no version of this app that adds to your health record.
• They stay on this phone. They are never uploaded to us and are never sent to Anthropic. They are not part of what is sent to write your doctor's letter: they are added to the document on this phone, as it is printed, so the only place they ever arrive is the page you hand to your own doctor.
• Nobody in your care circle sees them.
• Wren does not interpret them. It prints this fortnight next to the fortnight before, with the dates, and says nothing about which way it is going. That reading belongs to your doctor. Wren will not tell you your walking is getting worse.

Health data is never used for advertising, never sold, and never shared with a third party for their own purposes. It is not used for anything except the page you print.

Everything in Wren works exactly the same if you say no.

Permissions Wren asks for, and why

• Microphone. So you can speak your diary entry instead of typing it, so you can call Wren, and so you can record yourself under "Your voice". Wren asks the first time you use the talk button, and you can decline. If you decline, typing still works and every other part of the app is unaffected.
• Notifications. To remind you to take your medicine at the times you chose, and, if you are watching over somebody, to knock when something is worth a look. You can decline, or turn reminders off.
• Camera and photo library. Only when you attach a photograph or film a movement check, and only for the file you pick.
• Health. Only if you switch it on, and only to read the walking measurements your phone already takes. Wren asks for no permission to write, and requests no other kind of health data. See above.

Wren asks for nothing else. It does not request your contacts, your location, or your medical records.

What leaves your phone

Some versions of Wren run entirely on your phone and send nothing at all. If that is the version you have, the app tells you so on the welcome screen and in settings, and this section does not apply to you. The rest of this section describes the version that can talk back.

To turn what you say into an organized entry, and to hold a conversation with you, Wren sends to our server, which passes it to Anthropic's Claude and returns the answer:

When you write or speak an entry: the words of that entry.

Every time you send Wren a message, or say something on a call: your first name and, if you are caring for somebody, their first name and the fact that you are the one caring; what you live with; your medicines, the times they are due and which days they are taken; your last eight diary entries; what you told Wren about yourself when you set it up; everything Wren has learned about you since; the counts it keeps about you, meaning how often things have happened, how your doses have been going, and any check scores; and the emergency number for your country, worked out from your phone's region setting, so that Wren does not tell somebody in Pennsylvania to dial 999. Wren needs this to answer you as somebody who knows you rather than a stranger, but it is a great deal more than one sentence and you should know that.

When you ask for the doctor's letter: everything above for the period you chose, including sentences you wrote in your own words and the spiral drawings you made.

When Wren looks for patterns: up to sixty of your diary sentences, with their dates.

When Wren reads a page you attached: the page itself, as an image or a PDF, up to four of them at a time.

When a caregiver asks Wren about the person they watch over: the counts already on their own screen, and whatever the caregiver themselves wrote about their own situation when they joined the circle. The diary the watcher has never had cannot leak through that door.

What is never sent to our server or to Anthropic, in any version: your videos, any voice memo or recording of your voice, and anything read from Health. Sending a recording to somebody yourself, from the "Your voice" screen, does not go through us and we never see it.

What is never sent: your surname, your address, your email, your phone number, or an advertising identifier. There is no login and nothing that names you as a person to us.

There is one identifier, and here it is. The first time Wren runs, it makes a random string on your phone, keeps it, and sends it with each request to our own server. It is not sent to Anthropic and not sent to the speech service. It exists so that counting can be fair: a care home behind one internet connection is a dozen people, not one person behaving suspiciously, and without something to tell them apart they would take each other's limits away.

Being exact about what that means, because it is the kind of thing people are told loosely. It is not your name and it is not derived from anything about you or your phone. We never connect it to a payment, an email or a person. What it does allow, in principle, is for the requests from one phone to be recognised as coming from the same phone. That makes it pseudonymous rather than anonymous, and we would rather say so than let you find out. Deleting Wren destroys it, and a fresh install makes a new one.

What our server can see anyway. Every connection over the internet carries the IP address your phone is on, so our server and the companies that host it necessarily see it. We use it for one thing: a rolling count of how often one address has asked, so that a script cannot run up our bill. Those counts are stored by our data store as short-lived counters, keyed on the address, holding nothing but a number. Most expire within minutes. The one that limits how many pages can be read runs over a day, so it lives for up to two days. They are not tied to anything about you and are not used to work out who you are.

What is kept, and by whom.

• By us: nothing about you. We do not store or log the words you send, and we do not train anything on them. They are held in memory long enough to answer and then they are gone. The one exception is the care circle, which does upload a sealed box, and has its own section below.
• By Anthropic: Anthropic processes what we send as our service provider, under its commercial terms. It does not train on it. Under its standard terms for the API, inputs and outputs may be retained for up to 30 days for trust and safety purposes, such as detecting abuse, and are deleted after that. We do not have access to that copy and neither does anybody else outside Anthropic's own safety processes.

You can see everything Wren has learned about you, and delete any of it, on the "what Wren remembers" page. Anything you delete there stops being sent.

If it cannot be sent, because you have no signal or the service is down, Wren organizes your entry on your phone instead and you will not notice a difference. Everything essential in Wren works completely offline.

The care circle

This is the one part of Wren where health information about you is uploaded to our server, so it gets a section of its own, in full.

It is off until you turn it on, on your own screen, having read what will be shared. Nothing about the care circle happens by default.

What is uploaded

When you turn sharing on, your phone packs a digest and puts it on our server every minute or so while the app is open, so that the person watching over you sees it on their phone. The digest covers a rolling fourteen days and carries:

• Your first name and the condition you selected.
• For each day: whether you wrote anything (not what), how many doses were ticked out of how many were due, each scheduled dose by medicine name and time with whether it was ticked, the names of the symptoms logged, and how many falls or near-falls were logged.
• For each medicine: how much of it you take, in the words you or Wren wrote, such as "2 tablets, 100 mg"; which days it is taken on; and what form it comes in. A person standing at a pill box for somebody else needs the number, not only the name. Never the private note you wrote yourself beside a medicine.
• Short "worth a look" alerts built out of those counts.
• Medicines running low, by name and the day they run to.
• Your cognitive check scores, as a first score, a latest score, and how many times you have sat one. This has its own switch on the sharing screen. It starts on, and you can turn it off there whenever you like.
• An alarm, if you told Wren about a physical emergency, with a short note of what crossed and the time. Never your words.
• Which categories you are sharing, and which powers you granted.

A category you turn off is not sent as a zero. It is not sent at all.

Where those symptom names come from. Not only the buttons you tap. Wren writes what you tell it into your diary, so a symptom can come from a sentence you typed, a sentence you spoke, or something you said to Wren in conversation. What crosses is a short label of two or three words, such as "tremor" or "trouble swallowing", written by the AI as it sorts the entry. It is never the sentence itself and never a quotation of it.

Two smaller boxes go up alongside it: one holding the watchers' first names, their phone's notification token, and their "I am seeing to this" acknowledgements; and one holding anything a watcher did back for you, such as ticking off a dose or noting a symptom. A watcher can also send one short sentence of their own, up to 140 characters, describing something they noticed. It arrives in your diary with their name on it, and you can undo it. Wren Plus status is kept in a third box, so that one payment can open both phones.

If somebody else starts it

A circle can be started from either end. Somebody who is going to watch over you can make the code first and hand it to you, rather than waiting for you to make one.

When they do that, one small sealed box goes up straight away. It holds their own first name and their phone's notification token, so that the first alarm can reach them without anything else having to happen first. The name they have written down for you stays on their phone and is never uploaded. There is no health information in it, because at that point there is none to have.

Nothing about you leaves your phone until you accept and turn sharing on, on your own screen, having read what will be shared. An invitation nobody takes up is deleted from the server after 30 days, like everything else on the shelf.

Watching more than one person

A watcher can hold more than one code, for a parent and a partner, say. Each is a separate circle with its own key. Nothing crosses between them, neither person is told about the other, and neither sealed box can be opened with the other's code.

What is never uploaded

Never your diary text. Never your chat with Wren. Never a quotation of anything you said or typed. Never a video, never a voice recording, and never a walking measurement from Health.

About the hardest thing you might tell Wren. If you say something about wanting to harm yourself, your words are never sent to your circle, and Wren never raises the family alarm for it. That alarm is for physical emergencies, a fall, a collapse, choking, and it is deliberately not for this. What Wren does instead is show you, on your own screen, the people whose job it is to help.

What can still cross is a symptom label, in the same way any other symptom does. If that conversation is written into your diary and Wren sorts it as low mood, then "low mood" can appear among that day's symptoms, and it can raise a worth-a-look note on your family's screen saying you logged it. Never the words, never a quotation, and never an alarm. We would rather tell you that plainly than let you discover it. If you would rather your family saw no symptom labels at all, turn symptoms off on the sharing screen, and none of them will cross, this one included.

It is sealed on this phone

The digest is encrypted on your phone before it is sent, with a key derived from your 3-word code. The code never leaves your phone and is never sent to our server. What we hold is a blob of ciphertext filed under a hash. We cannot read it, we cannot tell whose it is, and we have never been told a name, a date of birth or a condition.

And now the limit of that, which we would rather write down than have somebody discover. The key is made from your 3-word code, and a 3-word code is small. Somebody who stole our entire store of boxes could work through every possible code on their own machine and open them. Our server refuses to be asked at anything like that speed, so this is not an attack that can be run against Wren as it is running; it is an attack on a stolen copy. We are building a pairing step that removes it. Until then, this is the honest ceiling of a secret short enough to be read down a telephone by one person and written down by another.

The 3-word code is the whole of the credential. There is no account and no password. The code is short on purpose, so a person with a tremor can read it aloud to a person with a hearing aid, and that is a real trade-off worth saying out loud: a short code is a weaker secret than a long password. Treat it like a house key. Give it only to somebody you would let read the fortnight, and do not put it anywhere public.

The notification we send to a watcher's phone crosses Apple's servers, so it deliberately carries no name and no condition. Ordinarily it says only that something is worth a look. There is one exception, and it is on purpose: when you have told Wren about a physical emergency, the knock says that somebody they watch over may need help right now, because a notification that gives nothing away is a notification that gets ignored at three in the morning. Even then it never says who, and never what.

How long it is kept, and what happens when you stop

The box holds one digest at a time. Each new one replaces the last, so what is on the server is a sealed copy of the last fourteen days and nothing older.

When you stop sharing, or leave the circle, Wren asks the server to delete all four boxes, not just the link to them: the digest, the watchers' names, anything a watcher did back for you, and the Plus status. Not the link to them, the boxes themselves. If one of those deletions fails, because the connection dropped part way, Wren tells you which one is still there rather than pretending it is gone. Nothing is deleted from your diary. Your diary is yours and it stays exactly where it was.

You can also change what is shared without stopping altogether, at any moment, and you never have to say why.

What we cannot do is make somebody forget what they have already seen. Nobody can. Stopping stops anything further from crossing.

Paying for Wren Plus

Wren is free to use. Wren Plus is a paid subscription, and paying for anything means somebody has to know that a payment happened.

Apple takes the money. We never see your card, your billing address, or your Apple Account. Apple handles the purchase, the renewal, and any refund under its own privacy policy.

RevenueCat checks the receipt. RevenueCat, Inc. is a service that validates App Store receipts and remembers what you are entitled to, so that a subscription survives a reinstall or a new phone. Wren starts it when the app launches. It receives:

• A random app user identifier that RevenueCat generates on this device. It is not your name and not your Apple Account, and we do not connect it to anything else about you, because we hold nothing else about you.
• What was bought, when, whether it is a trial, and when it expires.
• Basic device and app information, such as the model of phone, the operating system version, the app version and your country.
• The IP address your phone is on, as any internet request carries.

RevenueCat is our processor. It does not receive your diary, your name, your condition, your medicines, or anything a doctor would recognise as health information. It is bound by its contract with us not to use what it gets for its own purposes. Its own privacy policy is at https://www.revenuecat.com/privacy.

Being honest about two things:

1. RevenueCat starts on every launch, not only when you buy something. So even a person who never pays a penny has had a pseudonymous identifier created on their phone and a purchase check made on our behalf. That is how the subscription works at all, and it is more than "nothing leaves the phone", which is why it is written here.
2. That identifier is pseudonymous, not anonymous. We cannot turn it into your name and we never try. But it is a stable identifier tied to a device, and calling it "nothing" would be a lie.

We do not use RevenueCat's analytics to profile you, and there is no advertising attribution in Wren of any kind.

What we collect about you

Beyond what is described above: nothing.

Wren contains no advertising identifiers, no advertising SDKs, no attribution or ad-tracking libraries, no social media SDKs, and no crash reporting that transmits your content. We do not track you across other apps or websites, and we do not permit anybody else to. Nothing in Wren is sold, rented, or shared for anybody's marketing.

We do not know how many entries you have written, when you open Wren, how long you spend in it, or what you talked about. There is no analytics of any kind. The one thing our own server necessarily counts, because it is what stops a script running up the bill, is how many requests have come from one phone inside the current window, and it forgets that within minutes.

Who else receives anything

Every company that receives anything at all, named here so that they are in one place:

• Anthropic, which reads what you send and answers it.
• ElevenLabs, which turns Wren's own sentences into speech. It receives Wren's words, never yours.
• Apple and RevenueCat, which handle payment.
• Vercel, which runs our server. Everything that goes to us passes through them.
• Upstash, which is where the sealed care-circle boxes are stored, and where the short counters described above live. They hold ciphertext they cannot read.
• Apple's push notification service, which carries a knock with no content in it, and Expo's push service, which passes that knock along.
• ClinicalTrials.gov, run by the United States National Library of Medicine, and Europe PMC, run by EMBL-EBI in the United Kingdom. If you open the research screen, your phone asks them directly what is being studied for your condition. What they receive is the condition, and for trials a country worked out from your phone's region so that it does not offer you a study on another continent. Not your name, not your diary, nothing else, and nothing at all unless you open that screen.

Sharing your summary

The Doctor screen can produce a plain-text summary of your diary. Nothing is shared until you choose to share it. When you tap "Send it to someone" or "Copy it as text", your phone hands that text to whichever app you pick, such as your mail app. What happens to it after that is governed by the app you chose and the person you sent it to.

How long things are kept

Your rights over your information

Wren was built so that most of this is in your hands rather than ours. You do not have to ask us for your diary, because we have never had it. But you have rights in law, and they are set out here honestly, including where Wren's design makes one of them awkward.

Who is responsible. Sritej Padmanabhan is the controller of the small amount of personal information described in this policy. Write to hello@wrenapp.care. If you are in the UK or EU and we are required to have a representative there, their details will be published at https://wrenapp.care/privacy.

If you are in the UK or the European Economic Area

Under the UK GDPR and the EU GDPR, you have the right to ask for access to your personal data, its correction, its erasure, a portable copy of it, a restriction on how it is used, and to object to processing. You also have the right to complain to your data protection authority, which in the UK is the Information Commissioner's Office.

The legal bases we rely on:

• Your consent for the things you switch on: reading a page, the care circle, reading walking measurements from Health, and notifications. Health data is a special category of personal data under Article 9, and where it is processed at all it is on the basis of your explicit consent under Article 9(2)(a). You can withdraw that consent at any time, in the app, and it takes effect at once.
• Performance of a contract for taking a payment and keeping your subscription open.
• Legitimate interests for keeping the service standing up, which amounts to a rate limit counted on an IP address.

How to exercise them, honestly. Nearly everything is in the app.

• Access and portability: everything Wren holds about you is on your phone, and the Doctor screen will produce a copy of your diary as plain text that you can send anywhere. We hold no copy to give you.
• Erasure: delete an entry, a memory, a letter or a recording in the app, or delete Wren, which removes everything at once. Stopping the care circle deletes the sealed box from our server.
• Correction: every field in Wren is editable by you. There is nothing we hold about you that we could correct on your behalf.
• Objection and restriction: turn off the feature you object to, or stop using the parts that send anything. Wren works offline.
• The awkward part: because there is no account, we usually cannot identify you and so cannot answer a request in the way a company with a customer database would. If we cannot connect a request to any data we hold, we will say so plainly rather than pretend. If you have bought a subscription, tell us the Apple order ID and we can ask our payment processor to delete the records tied to it.

International transfers. Our server and its data store, Anthropic, RevenueCat and the speech service are in the United States, as is ClinicalTrials.gov. If you are outside the United States, what leaves your phone is transferred there. Europe PMC is run by EMBL-EBI in the United Kingdom. Those transfers are covered by the European Commission's and the UK's Standard Contractual Clauses in our contracts with those companies, or by an equivalent approved mechanism. The two research registries are public services we send a search term to, not processors acting for us, and there is no contract between us and them.

If you are in California

Under the CCPA and CPRA, you have the right to know what personal information is collected and how it is used, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them.

• We do not sell your personal information and we do not share it for cross-context behavioural advertising. We never have. There is no opt-out link because there is nothing to opt out of.
• California treats health information as sensitive personal information. Wren uses it for one purpose: providing you with the diary you asked for. It is never used to infer characteristics about you, never used for advertising, and never disclosed except as described in this policy.
• The categories collected are those listed in this document. We do not collect the categories we do not mention, such as your location, your contacts, or your employment.
• To know, delete or correct, use the app, which does all three directly and immediately. To make a request to us, write to hello@wrenapp.care. An authorised agent may act for you with your written permission.
• As above, if there is no account we usually cannot verify who you are or connect a request to data we hold, and we will tell you so rather than guess.

We do not knowingly collect personal information from anybody under 16.

If something goes wrong

We will tell you. Not quietly, not late, and not in a footnote.

If there is a breach of security that affects personal information we hold, we will investigate it at once, stop it, and give notice as the law requires. Where the GDPR or UK GDPR applies, that means notifying the relevant supervisory authority within 72 hours of becoming aware of it, and telling affected people without undue delay where there is a high risk to them. Where United States state breach laws apply, we will notify people and regulators within the periods those laws set.

Wren and the FTC Health Breach Notification Rule. Wren is not covered by HIPAA. We are not a doctor, a hospital, or an insurer, and we are not a business associate of one. Wren is a vendor of personal health records under the FTC's Health Breach Notification Rule, 16 CFR Part 318, and we treat that rule as binding on us.

If there is a breach of security of unsecured identifiable health information held by Wren, we will:

• Notify each affected individual without unreasonable delay and in no case later than 60 calendar days after discovering it.
• Notify the Federal Trade Commission, within 60 calendar days if fewer than 500 people are affected, and within 10 business days if 500 or more are.
• Notify prominent media serving the relevant area if 500 or more residents of a state or jurisdiction are affected.
• Say what happened, when, what information was involved, what we have done, what you can do, and how to reach a person about it.

How we would reach you, said honestly. Wren holds no email address for you, no phone number and no postal address, because it never asked for one. So we cannot email you. Instead we would give notice by prominent posting on https://wrenapp.care for 90 days, put the same notice on the first screen of the app, and issue it to media as above. That is the substitute notice the rule provides for, and it is the only method available to a service built the way this one is. Not collecting your address is a privacy decision we stand behind, and this is its cost, so it is written down here rather than discovered later.

Children

Wren is not designed for or directed at children, and we do not knowingly collect information from a child. If you believe a child has used Wren and something needs removing, write to hello@wrenapp.care and we will help, although in almost every case deleting the app removes everything there is.

Wren is not a medical device

Wren records what you tell it and organizes it. It does not diagnose, treat, monitor, or give medical advice, and it is not a substitute for a healthcare professional. What Wren's AI writes can be wrong, so check anything that matters. Never change your medicines because of anything in this app. Always speak to your doctor or pharmacist.

Wren is not an emergency service. If somebody is in danger, ring emergency services.

Changes to this promise

If this promise changes, we will:

• Update the date at the top.
• Describe the change in the app's release notes.
• For any change that materially affects what leaves your phone, say so in the app itself, before it takes effect, and where the law requires consent, ask for it rather than assume it.

We keep previous versions of this policy at https://wrenapp.care/privacy so you can see what changed.

If a future version of Wren ever stores your diary outside your device, that will be opt-in, explained plainly, and never turned on for you.

Contact

Questions about privacy, or anything else in here:

hello@wrenapp.care https://wrenapp.care

A person reads it.