What stays on your phone

1

What stays on your phone?

Your health readings and everything Aera works out from them. There is no Aera account and no Aera server that holds them.

Aera reads Apple Health and works out your scores on the iPhone itself. The results sit in the app's own storage on the phone. Widgets and the Watch app show snapshots that the app writes for them.

Aera mostly reads. It saves to Apple Health only workouts, with the readings that belong to them, and the effort you give a workout. The workouts are the ones you record with Aera on the phone or the Watch, and the ones a Polar link or an import brings in.

A few small things live in the iPhone's Keychain, a protected store. They are random codes, for your install, for usage counts, for crash reports and for purchases, your answer about usage counts, and the keys of a Polar link. A code is not made from your name or your Apple ID.

Settings has a Privacy page with a Delete all data button. It removes everything Aera keeps on the iPhone, including the copies for the watch and widgets, settings, routes, photos and exports, and it unlinks Polar. Apple Health is not touched. What stays is a code that lets you ask Aera to erase crash and usage records.

2

What does leave your phone?

A few things, none of them a health reading: usage counts, crash reports, purchase records, and requests for maps and places.

The Privacy page has a heading, What leaves this iPhone, with a switch for each of Share analytics and Send crash reports. Under the heading it says: Neither ever carries your health. Purchases, maps and a Polar link send things too, and they come further down.

Usage reports are built from fixed words, yes-or-no answers, counts in ranges and timings. Crash reports keep only named fields, plus Apple's own phone details and the code that failed. Free text, places and health values have no way onto either.

3

What do usage counts and crash reports hold?

Usage counts say which screens you open and tap, and crash reports say what failed and on which phone. Neither carries your name.

Share analytics sends the screens you open and tap, without your name. Each report is a fixed event name with a few set words, ranges or timings. It goes to Mixpanel, a usage-statistics service, on its European servers. With it go the app version, the kind of device, the system version, whether you have Premium, the region from your device settings, and a random code for your install.

Send crash reports is on in the App Store version until you switch it off. A report says what failed, the phone model and system version, and how the phone was doing, such as battery, heat and memory. It carries no screenshot, no picture of the screen and no record of your network traffic. It is filed under a random crash code, never under your name, and goes to Sentry, a crash-report service.

4

What do purchases, maps and a Polar link send?

A purchase code and Apple's signed records, the area you are looking at, and the sign-in code for a Polar link.

Purchases go through Apple's App Store. Every purchase carries a random purchase code that Apple keeps on the transaction, so Aera can count trials and renewals next to usage. Aera's purchase helper ties that code to usage counts only while you share analytics, and a no unlinks it. Separately, when your phone holds a Premium subscription, it sends Apple's signed record of it to the helper once, and the helper passes it on to RevenueCat, the subscription service. That happens whatever you answered about analytics.

The purchase helper keeps a short table for linked codes. Each row holds the code, when it was linked, the subscription's state and whether a trial is open. It never sees your install code and it logs nothing. No name, health reading or place is in that table.

Maps, places and sight photos load as you look. Aera asks free services for map tiles and fonts, height data, the ground and sights in the area on screen, and Wikipedia and Wikimedia for a sight's photo. If you pick the Terrain map on the Watch, its tiles come from OpenTopoMap. Each request names an area or an item, not you and not a reading. Race lists load from Aera's own website, and that request carries only the list's address. Apple's own map, search and App Store services follow Apple's policy.

With a Polar link, the sign-in page is Polar's. Aera's login helper receives the sign-in code and swaps it for keys. It does not see your readings, and it logs nothing and stores nothing. Aera then tells Polar that you use Aera and asks Polar directly for your nights and workouts. The keys stay in the iPhone's Keychain, on that phone only. Unlinking tells Polar to stop sharing.

5

When does nothing leave?

Usage counts stay home unless sharing is on. Crash reports stay home once you switch them off.

Usage sharing is off until you say yes. The one exception is a phone whose App Store country and device region are both the UK or Switzerland: there it starts on, with a notice, and you can switch it off in Settings under Privacy.

Crash reports have their own switch, Send crash reports, in the same place. Once it is off, Aera sends no crash report. Until you switch it off, it is on in the App Store version.

Say no and Aera deletes whatever usage reports were still waiting to be sent. It also retires the random usage code, so a later yes gets a new one, and it unlinks the purchase code at the helper.

6

What can't it tell you?

What other services do with a request, or whether any data can be fully anonymous. This page describes this version of Aera.

Mixpanel, Sentry, RevenueCat, Polar, Apple and the map services each have their own policies. Aera sends them only what is listed above. What they do with a request, including the network address it arrives from, is set on their side, not in the app.

Leaving out a name is not the same as being anonymous. Researchers studied 15 months of mobile-phone location data for 1.5 million people. Where a person's place was given hourly, to the resolution of a carrier's antennas, four points in place and time were enough to pick out 95 percent of them. Even coarser data gave little anonymity. Aera's usage and crash reports carry no places. A map service does see which area you looked at, and when.¹

You can see the switches for yourself. Settings has a Privacy page with Share analytics, Send crash reports, What leaves this iPhone, the Privacy policy and Delete all data.