ZORYA

What ‘your data stays on your device’ actually means, in plain words, and why it is the only promise that cannot quietly break.

There is a phrase you have probably seen dozens of times on App Store pages and privacy banners. ‘Your data stays on your device.’ Or: ‘private by design.’ Sometimes the more cautious version: ‘we take your privacy seriously.’ It sounds reassuring. It might even be true. But most of us have never stopped to ask what it means, and more importantly, what would happen if it stopped being true.

This is my attempt to explain it plainly. No legal language, no jargon.

Your phone as a notebook

Think of two ways to take notes during pregnancy.

The first: you carry a personal notebook. You write in it, you keep it, no one else ever touches it. If you lose it, those notes are gone. But no one can read them unless they physically have your notebook in their hands.

The second: you dictate your notes to an assistant, who types them up and stores them in a filing cabinet at their office. Any time you want them, you ask and they fetch the page. It feels like your notes. But they live in someone else’s building, in someone else’s filing system.

Most apps on your phone are the second kind of notebook.

When you open a free app and log a symptom or a mood, that information travels across the internet to a server. A server is just a computer, usually sitting in a data centre somewhere, owned by the company that made the app (or by a tech giant they pay for storage). Your data lives there. The app on your phone is a window into that remote filing cabinet.

A local-only app is the first kind of notebook. When you log something, it goes directly into a small database on your iPhone. It never leaves your device. There is no server, because there does not need to be one.

Why pregnancy data is different

Your step count is not very sensitive. Neither is your weather app knowing roughly where you live.

But pregnancy data is different. The things you track during those forty weeks are not neutral data points. A missed period that becomes a heartbeat at eight weeks. A diagnosis you got on a Tuesday that you have not told anyone yet. Kick counts that start dropping off at 34 weeks. A loss. They are intimate. They are medical. In many parts of the world right now, they are political.

App data has been subpoenaed in cases related to reproductive health in the US. In Europe, health data is classified under GDPR as a special category with stricter protections, but that only applies if the company holding your data follows the rules, and if you even know they have it.

In a survey we ran with 53 mothers, 70% said local-only storage was extremely important to them. And yet 96% had used a pregnancy app with documented privacy violations. The expectation of privacy is there. The reality almost never matches it.

This is the difference between a promise and a structure. Promises can be broken quietly. Structures just exist.

The promise that cannot quietly break

When a company tells you your data is safe, that is a promise. Promises are held by people, and people and companies change.

Privacy policies get updated, usually with a notification buried in an email you will never open. Companies get acquired, and the new owners inherit your data along with the servers. Startups that seemed well intentioned run out of money and sell their user data as an asset. All of this has happened to pregnancy apps. The companies did not set out to betray their users. They ran into circumstances that their promises could not survive.

Local-only architecture is not a promise. It is a structure. There is no server to breach. There is no policy update that could suddenly allow your data to leave your phone, because your data has never left your phone. If the company behind the app disappeared tomorrow, your records would still be right there. Intact. Yours.

The architecture makes the promise unnecessary. That is what ‘your data stays on your device’ means.

What this looks like in Zorya

Zorya stores everything in a small database on your iPhone. When you log a contraction, a symptom, or a note, it goes into that database and nowhere else. There is no account to create, because there is no server to log into. No analytics quietly reporting home in the background. No third party tools collecting usage data.

When you delete the app, the data is gone. When you keep it, it stays exactly where you put it.

This is a deliberate choice, not a default. Building local-only means I cannot offer things that require a server: syncing across multiple devices, cloud backup, push notifications from outside the app. Those are real trade-offs. I made them because I think pregnancy is private, and private things deserve architecture that makes privacy structurally unavoidable, not just promised in a document.

One thing local-only does not mean

It does not mean your data is automatically backed up. If you lose your phone without a device backup enabled, that data is gone. Zorya will support encrypted exports in a future update. Until then, your iPhone backup (iCloud or a local backup to your Mac) will include your Zorya data if you have backups enabled. Worth checking that you do.

It also does not mean the app needs to be offline. Zorya works completely without internet. It just never uses the internet for your data.

Original survey of 53 mothers conducted for Zorya, 2026. Referenced findings from Flo Health FTC action (2021) and Privacy International app research (2019).