Privacy policy

Effective October 26, 2026

tabula is a journal. What you write in it is yours, and it stays with you. This policy explains, in plain words, what the app does with your information and what leaves your device.

The short version

• The iPhone and Mac apps have no servers, no accounts of ours and no sign-in. There's no advertising and no tracking across other apps or websites.
• The web version of tabula keeps your tabula in your browser. If you turn on tabula sync, it's sent to our server already locked with a key only your devices hold, so we can't read what you write. You can sync with only a recovery code, or optionally sign in with an email code.
• Your tabula is saved on your device and, if you turn on iCloud sync, in your own private iCloud, which only you can read. We never see it.
• A small amount of anonymous information about the app (its version, your device type, a few settings) is sent once a day so we can keep tabula working. You can choose to share more, but never less, and none of it is ever anything you write or log, or anything that identifies you.
• When you use a feature that looks something up (a book, the weather, a recipe page), only what that lookup needs is sent to the service that answers it.
• We never sell or share your information, and nothing is used for advertising.

What stays with you

Everything you write or log (daily logs, notes, pages, trackers, mood check-ins, health and medication entries, tarot and I Ching readings, books, recipes, projects, events, attachments, voice notes and settings) is stored on your device by the app.

• iCloud sync. If you turn it on, Apple keeps a copy in the private iCloud database of your Apple Account so it appears on your other devices, and your settings are kept in iCloud's key-value storage. This is covered by Apple's privacy policy, and neither we nor anyone else can read it.
• Backups. Once a week the app saves a backup of your tabula in your own iCloud Drive (in a tabula folder), or on your device if iCloud Drive isn't available. Only you can open it.
• Profiles. Each profile is a separate tabula, stored and synced the same way.
• Widgets, Shortcuts, Siri, the share sheet and the menu bar. These read from and add to your tabula on your device. Nothing they handle is sent to us.
• Passwords and keys. Keys you enter for Zotero or Steam are kept in your device's keychain. Your Google Calendar sign-in is kept in your iCloud Keychain so your other devices are connected too.

Oratio

Oratio lets you say or type your day and files it into your trackers, medication, chores and daily log. What you say is turned into text on your device by Apple's speech analyzer, and sorted by Apple's on-device model (Apple Intelligence) together with simple rules on your device. Your words, the lines they become and your trackers' names are never sent to us or anyone else, never stored by us, and never used to train any model. Nothing said is kept: only the lines you tick are saved, in your tabula. Oratio checks what the model understood against what you actually said before it logs anything, and every change can be undone.

The oracles

The oracles that read your tarot, I Ching and patterns run entirely on your device, with Apple's on-device model (Apple Intelligence). Your questions, cards and writing are never sent to us or anyone else, never stored by us, and never used to train any model. Apple states that it doesn't use your interactions with its on-device models for training.

If something you write for an oracle mentions suicide or self-harm, it's checked on your device and the oracle isn't asked at all. Nothing about it is recorded, counted or sent anywhere. The app shows where to find help instead; opening that help link takes you to findahelpline.com in your browser.

Permissions the app asks for

You're always asked first, and you can change your answer in your device's Settings at any time.

• Calendars. The app reads your calendar events on your device to show them in your daily log and calendar. When you add, change or delete an event in one of your device's calendars from tabula, the change is saved to that calendar on your device, which syncs it through that calendar's own account as usual. We never receive it.
• The Health app (iPhone and iPad). The app reads your sleep, steps, water, weight, menstrual cycle and symptoms from Apple Health to fill in your Health page and trackers. It only writes to Health if you turn on "also save to Health": then the weight, sleep and cycle you log in tabula are saved to Health too, marked as entered by you, and nothing already in Health is replaced. What it reads is kept in your tabula like anything you log yourself. Health data is never sent to us or anyone else, never used for advertising or analytics, and never shared or sold. You can stop it in the Health app, under Sharing › Apps › tabula.
• Camera. Only while you're scanning a book's barcode. The camera reads the number on the barcode; no picture is taken or kept. The number is sent to Open Library to find the book.
• Microphone and speech recognition. Only while you're recording a voice note or talking to Oratio. A voice note's recording is stored with your tabula like anything else you write. What you say to Oratio is turned into text on your device and is not kept.
• Photos. The system photo picker gives the app only the photos you choose.
• Face ID, Touch ID or your passcode. If you turn on the lock, your device checks it's you. The app never sees or stores your face, fingerprint or passcode.
• Location. Used to look up the weather. A rough position (to about a kilometre) is sent to Apple Weather for the forecast, and to Apple Maps to name the place. It isn't stored by us or linked to you. If you turn on "Follow me", the app checks where you are at most every few hours, and only while it's open. The town's name is kept with each day's weather in your tabula, so you can see where you were.
• Notifications. Reminders (for events, trackers, medication, writing and your budget) are scheduled and shown on your device.
• Files. The app opens only the files and folders you choose (pictures for a tarot deck, a calendar or markdown file, a font, a community widget) and saves only where you choose.

The web version and tabula sync

tabula on the web (app.tabula.re) is in early testing. It works like the app, with a few differences:

• Where it's kept. Everything you write or log on the web is stored in your browser, on that device. Nothing leaves it unless you turn on sync.
• tabula sync (optional). If you turn it on, your entries are locked (encrypted) in your browser with a key made on your device, and only then sent to tabula's sync server, so your other devices can fetch them. The key never reaches us, so we can't unlock or read your entries, and neither can anyone who got hold of the server. Photos and audio aren't synced.
• What our server can see. To keep things in order it sees: an anonymous id for your vault (not your name or email); what kind each locked entry is (for example a note, a mood check-in or a medication dose), but not what's in it; when each one changed or was deleted; how many there are and roughly how big; and your device's internet address while it's connected. We're working on hiding the kinds and sizes too.
• A tabula account (optional). You can sync with only a recovery code, with no email at all. If you choose to sign in, we send a one-time code to your email. We keep only a scrambled (hashed) copy of your address to recognise you, your username, and a link from your account to your vault. If you choose to let a new device unlock by signing in, we also keep your key locked with a long passphrase made for you, which we can't open.
• Who helps us run it. The web version and the sync server run on Cloudflare. Sign-in codes are sent by email through Resend. Like any website, they see your device's internet address, and they have their own privacy policies. Cloudflare keeps short-lived logs of requests; our server doesn't keep logs of what you send.
• The help card. If you choose "show lines near me", your browser's location is used on your device to pick nearby helplines. It isn't sent anywhere.

Services the app contacts for you

Some features fetch information from other services when you use them. Each request contains only what that feature needs (for example, a book's title to find its cover), never your tabula. Like any website, these services see your device's internet address, and they have their own privacy policies.

• Weather and places: Apple Weather and Apple Maps. The town you type for an astrology chart is looked up with Apple Maps to find its position; your birth date and time stay on your device.
• Books, films, shows, games, music and papers: Open Library, Wikipedia, the iTunes Search API, TVmaze, Steam, Spotify (to show a song you link), Crossref and DOI.org.
• Zotero, if you connect your own Zotero library: your user ID and key are sent to Zotero to read your library, or the app talks to the Zotero app on your Mac.
• Finding more about a paper (when you press "find more" on a reference): its title or DOI is sent to OpenAlex to fill in details and find related papers. If you add your own Consensus key and ask a question, your question and the key are sent to Consensus. A Consensus search link opens in your browser.
• Steam, if you connect your Steam account: your Steam ID and key are sent to Steam to read your games.
• Google Calendar, if you sign in with Google: tabula reads your calendars' events straight from Google, with read-only access, to show them. It never changes them. Signing out removes the sign-in.
• Tarot decks you choose to download: from Wikimedia Commons or the artist's own website.
• Recipe and web pages you choose to import or embed: the website you paste in.
• Embeds and community widgets. An embed block shows a web page, video, map or HTML inside your page, so whoever runs that site sees that it was loaded, as in a browser. A community widget brought in from a file can contain embeds and links; the app shows where they go before it's added.

Anonymous usage information

So we can see which devices and versions tabula runs on and make it better, the app sends a little anonymous information to TelemetryDeck (telemetrydeck.com), a privacy-focused analytics service. In Settings › privacy & data you choose how much, and each level includes the ones before it:

• The basics (the least, and where App Store versions start). Once a day: the app and system versions, whether it's a Mac, iPhone or iPad, your theme and text size, and whether iCloud sync is on. When you use Oratio, a count of how well it understood: whether you spoke or typed, how many lines it made and how many you unticked, whether your own speech model was ready, and the language, so its speech recognition can get better over time. Never anything you said or typed. It carries no lasting ID: each signal is sent under a new random one, so it can't be linked to you or to any other day.
• What gets used. The basics, plus which page you open (for example, the daily log or tarot) and that a feature was used (for example, that a check-in was saved), without anything about what was in it.
• Everything that helps (where beta versions start, which TestFlight testers agree to). All of that, plus once a day how your tabula is set up in rough numbers (for example "5–19 trackers" or "1–4 table blocks") and which settings are on, and roughly how long each visit lasts.

Above the basics, what's sent is grouped under a random ID made on your device, hashed before it's sent, and never linked to your Apple Account, your name or your tabula. Reset anonymous ID makes a new one at any time, so nothing sent before can be linked to anything sent after. Choosing a lower level stops the extra information straight away.

At no level is anything you write or log included, nor your moods, health, medication, readings, names, places, location, calendars, contacts or files. It's used only to improve the app, never for advertising, and never sold or shared.

When you contact us

• Help or report a problem (Settings › shop & about) makes a message for you to send yourself, by email or any other way you choose. It holds only what you write and, if you leave it on, the app and device details shown in full before you send it. Nothing from your tabula goes with it.
• Email and the tabula discord. If you email us or talk to us on the discord, we see what you send and your email address or discord name. The closed beta sign-up form on tabula.re sends the name, email address, the line you write and which devices you would use (iphone, ipad, mac, or web; ticking any is optional) to tabula's server, where they sit on a private list that only I can open, so I can reply and let you in; nothing else is collected there. They stay on that list until I answer or remove them, and declining or removing an application deletes it, email address included. Nothing is emailed to you automatically: I send each email myself. We use these only to answer you, help with tabula and, if you have aurum lifetime, send the thank-yous described in the terms. The discord is run by Discord, under Discord's own privacy policy; joining it is up to you.
• TestFlight. If you test a beta, Apple shares with us the crash reports and feedback you choose to send through TestFlight, as described in Apple's TestFlight terms.

Purchases

aurum is bought through the App Store, which Apple handles. We receive no payment details and don't learn who you are; the app only checks with the App Store what you've bought. In beta versions, purchases are pretend: nothing is charged and nothing reaches the App Store.

Children

tabula isn't directed at children under 13, and it collects no personal information from anyone. The anonymous information above contains nothing that identifies anyone.

Your choices and your data

• See and keep your data: everything is in the app, and you can export pages, notes and trackers, or make a backup, at any time.
• Share less: choose the basics in Settings › privacy & data, and turn off any permission in your device's Settings.
• Delete it: delete anything in the app (it waits in the trash for 30 days, or a year with aurum, then is gone for good), or delete the app to remove your tabula from that device. To delete the iCloud copy, open Settings (System Settings on a Mac) › Apple Account › iCloud › Manage storage, choose tabula, and delete its data. Backups are in the tabula folder in your iCloud Drive.
• On the web: clear the site's data in your browser to remove your tabula from it. In Settings › sync you can delete the server copy at any time, and in Settings › account you can delete your tabula account, which removes your account, your vault and everything locked in it from our server.

The apps keep nothing on our side. For tabula sync, we only ever hold your entries locked, so there's nothing readable for us to hand over. If you've emailed us and want those messages deleted, ask and we will.

Changes

If this policy changes, the new version comes with the app, with a new effective date. If a change would mean more leaves your device, the app will tell you before it happens.

Contact

Questions about privacy? Email [email protected]. For anything else, email [email protected], use Help or report a problem in Settings › shop & about, the support link on tabula's App Store page, or ask on the tabula discord. Beta and sign-in emails come from [email protected].