Effective: September 11, 2026
Sundial is a small app for staying close to the handful of people who matter most. You share a day with someone, and it fills up with notes, photos, drawings, voice, and songs. This page says exactly what Sundial collects, what it cannot read, and how to get rid of all of it. It is deliberately short, because there is not much to say.
What you send is end-to-end encrypted on your device before it leaves it. Our servers only ever hold the encrypted version of what you send, so we cannot read your messages, see your photos or drawings, or hear your voice notes. A few basics have to stay readable for the app to work, and they are listed below. We never ask for your email address, phone number, contacts, or location. We do not show ads, and we do not sell anything about you to anybody, ever.
Sundial is made by Jacob Cacheria. You can reach us any time at support@sundialus.com.
Everything you write, snap, draw, or record for an orbit is encrypted on your phone before it is uploaded, and only the phones of the people in that orbit can open it. That covers your written beams, sunprints and doubletakes, inklings, hums, moonflowers and their answers, golden hours, sunsongs, backdrops, the FaceTime link for an eclipse, and the captions on any of them.
Our servers, and the companies that run them, only ever store the encrypted version. Nobody at Sundial can open it. Neither can Google, whose infrastructure it sits on.
One consequence is worth saying out loud: if you lose your devices and your keychain, that history cannot be recovered. Not by you, and not by us. That is the trade for us not being able to read it.
Some information has to be readable by our servers for the app to work at all. We would rather list it than let you assume otherwise:
You sign in with Apple. Apple gives us an identifier for your account and nothing else. Sundial does not request or receive your email address, never asks for a phone number, and there is no password to lose.
Your profile photo, and any world you draw for someone, are encrypted on your phone and stored with us so your own other phones can put them back when you sign in. We cannot see them, and they are never sent to the people you orbit with.
Your settings also travel between your own phones through your iCloud Keychain, which Apple protects with end-to-end encryption: your name, your birthday, the postcode you entered, your music service, your widget style, your north star, the order of your orbits, your reactions, and for each orbit the world it wears, the relationship you picked, the ring you drew, their birthday, and your anniversary. Of these, the only one our servers ever see is your name, as described above.
If you enter a postcode so the sun in the app matches your sky, your phone asks Apple's maps service to turn it into a rough latitude. The postcode is never sent to us.
Sundial records a small amount of information about how the app is used, so we can tell which parts work and which are broken. Each record is an event name such as "a beam was sent", "a sunprint failed to load", or "the almanac was opened", sometimes with a small detail like an error code, along with your account identifier, a nickname generated from it, the hour on your clock, your time zone offset, and your iPhone model and iOS version. Sundial also keeps a running count of how often each feature is used.
If connecting with someone fails, the app sends a short report of why, with part of your account identifier, the app version, your iPhone model, your iOS version, and your time zone offset, so we can fix it.
These records say that something happened, never what it was. The contents of anything you send never appear in them. There is no third-party analytics company involved, no advertising identifier, and no tracking across other apps or websites.
Nothing from any of these is uploaded except the specific thing you chose to send, and that goes up encrypted like everything else.
So you can say "beam mom in sundial", Sundial gives Siri the names you use for the people you orbit with. What you say to Siri is handled by Apple under its own privacy policy.
Notifications and widgets are filled in on your phone. The notification our server sends only says who something is from and what kind of thing it is, and the copies your widgets show are kept on your phone.
Sundial Gold is a one-time purchase handled entirely by Apple. Payment details never reach us. We store only whether an account has unlocked it.
If someone sends you something wrong, you can report that beam from inside the app. Because what you send is encrypted, we only see what you choose to send us: the words of that one beam as your phone shows them, which beam it was, and the reason you picked. Nothing else is uploaded, and only when you tap report. Reports are reviewed within 24 hours, and accounts that abuse other people are removed.
You can also block a person. That ends the orbit, and we keep a list of who you have blocked so they cannot start a new one with you.
If you send feedback from Settings, we receive your message, a screenshot if you attach one, and your iPhone model and iOS version. Feedback is written to us, so it is not encrypted.
Sundial runs on Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions, and Cloud Messaging) and uses Apple for sign-in, push notifications, iCloud Keychain, Siri, and payments. It also uses Apple's App Attest to check that requests come from the real app, which helps keep out abuse. Everything is encrypted in transit, and your content is additionally encrypted by your own phone before it gets there.
A day's beams leave the main page at midnight and are kept in your almanac, which only the people in that orbit can open. You can take back something you sent for three minutes after sending it. If somebody leaves an orbit, the shared history is deleted within twenty-four hours. Invite codes and links expire. Usage records, feedback, and reports are kept until your account is deleted.
You can delete your account from inside the app, in Settings. It leaves every orbit you are in, which deletes that shared history within twenty-four hours, and removes your name, your profile photo and drawn worlds, your usage records, the feedback and reports you sent, and your block list. It also clears the settings kept in your iCloud Keychain, revokes Sign in with Apple, and deletes the account itself. It cannot be undone. If you would rather we did it, or you no longer have the app, email support@sundialus.com and we will.
Sundial is not directed to children under 13, and we do not knowingly collect anything from them. If you believe a child has made an account, email us and we will remove it.
If this policy changes, the effective date at the top changes with it, and the new version is posted here.
Questions, deletion requests, or anything at all: support@sundialus.com.