Hodie collects nothing, stores nothing about your calendar, and sends nothing anywhere. This page says exactly what that means and how each sentence is checked.
The start time and the end time of your calendar events, over today and the preceding 28 days. From those it derives three things: today’s busy intervals, how many minutes each past day carried, and how many entries each past day held. Nothing else about an event is read.
The title is not read. Neither are the participants, the location, the notes, the URL, the organiser, or the name of the calendar the event lives in. This is not “read and discarded” — those fields are never accessed, and a build gate scans every file that touches an event for exactly those reads. Data that was never collected cannot leak.
All-day events are skipped entirely. A birthday or a public holiday is not nine hours of work, and counting it as such would turn every one of those days into a day with no room.
Four settings, on this device, in the standard user-defaults store: the shortest block you consider usable, how much work you want to fit, and the start and end of the window you count as your day. No events, no measurements, no history — the calendar is read fresh each time and released.
One thing, and only if you have a paired Apple Watch with the Hodie watch app open: today’s answer. That is a small set of numbers — the verdict, its reason, and the budget — sent over Apple’s own device link between your phone and your watch. Nothing about any event crosses, and nothing reaches Apple, us, or any server. If you have no watch, nothing leaves the device at all.
Calendar. Without it there is nothing to measure. iOS asks you once and you can withdraw it at any time in Settings; Hodie then simply has nothing to measure and says so.
Each claim above corresponds to a check that runs on every build and fails the build if the claim stops being true. The source is scanned with comments stripped for URLSession, URLRequest, CFNetwork, NWConnection, CLLocationManager and StoreKit. Separately, any file that mentions EKEvent is scanned for reads of title, notes, location, url, attendees, organizer or the structured-location and identifier fields, and finding one fails the build. The permission keys that must be absent are checked for absence; the calendar key that must be present is checked for presence. A privacy promise nobody measures is worse than none at all, because people rely on it.
Hodie is rated 4+ and contains no user-generated content, no messaging, no web browsing and no advertising. It has nothing to collect from anyone, of any age.
If any of this ever changes, this page changes with the release that changes it, and the corresponding build gate changes too — they cannot drift apart.
Questions: hello@norea.studio.