Plumb — Privacy

Plumb asks for no permissions at all, collects nothing, and sends nothing anywhere. This page says exactly what that means and how each sentence is checked.

What Plumb reads

The direction of gravity, from the device-motion stream, fifty times a second while a hold is running. That stream needs no permission and carries no identity: it says which way is down, and nothing else. Nothing is read between holds.

What Plumb stores

One setting — the hold length you aim for — and three numbers per hold: the sway, its band, and the drift slope. The gravity samples themselves are released the moment a hold ends and are never written to disk. Keeping the raw series would be keeping a recording of your body, and the record type has no field for one, because a field that exists will eventually be filled.

What leaves the device

One thing, and only if you have a paired Apple Watch with the Plumb watch app open: the verdict for the pose you have measured most. That is a key name, a decision code and at most two numbers, sent over Apple’s own device link between your phone and your watch. It does not reach the internet. If you have no watch, nothing leaves the device at all.

What Plumb does not do

• No HealthKit. It is not linked, and the build fails if it appears. Nearly every app in this category asks for it.
• No camera, no microphone, no location, no contacts, no photo access, no calendar.
• No network requests of any kind. There is no server to talk to.
• No analytics, no crash reporting, no identifiers, no advertising, no tracking.
• No account, no sign-in, no email address.
• No in-app purchases and no subscription, so no purchase data.
• No video, and therefore nothing streamed and nothing logged about what you watched.

The permissions it does not ask for

None. iOS will never show you a permission prompt from Plumb, because the measurement comes from the accelerometer and the accelerometer asks for nothing. An app in this category with no permissions is not a smaller app; it is one that decided what it does not need.

How these sentences are checked

Each claim above corresponds to a check that runs on every build and fails the build if the claim stops being true. The source is scanned with comments stripped for URLSession, URLRequest, CFNetwork, NWConnection, CLLocationManager and StoreKit; separately for HealthKit, HKHealthStore, HKWorkout and HKQuantityType. The measurement class is checked for any persistence call, and the stored record for the absence of a raw-sample field. Every permission key that must be absent is checked for absence. A privacy promise nobody measures is worse than none at all, because people rely on it.

Children

Plumb contains no user-generated content, no messaging, no web browsing and no advertising. It has nothing to collect from anyone, of any age.

Changes

If any of this ever changes, this page changes with the release that changes it, and the corresponding build gate changes too — they cannot drift apart.

Contact

Questions: hello@norea.studio.