Last updated: 2026-10-05
Ballast is a paced-breathing app for iPhone and Apple Watch. You set the rhythm - box breathing, 4-7-8, or a pattern of your own - and it paces you through it. It works without an account, and almost everything it does happens on your own devices.
Two things are exceptions, and both are switches you control:
Everything else stays on your devices. This policy explains exactly what each switch does, and how to turn it off or undo it.
There is no setting, and no version of this app, that sends any of the following anywhere:
identifierForVendor, no hardware serial, nothing that identifies your
phone or watch.Your heart rate is read on your Apple Watch during a session, and only with Apple Health logging turned on. It stays on your devices and in Apple Health. It is excluded from the usage data by an explicit list of the fields that may be sent, and excluded from iCloud backup by a second, separate list. Both lists are enforced by automated tests, and our server rejects any field it does not recognise rather than storing it.
We had no way of knowing whether anyone uses this app, which patterns people actually breathe, or where they give up. This switch is how that question gets answered without collecting anything personal.
When a session ends and this setting is on, the iPhone app queues a row and sends it to our server later. That happens whether you finished the session or stopped part-way through, which is what the Completed field records. A session you stopped part-way is not added to your own history list in the app, so the row can describe a session your history does not show. That row contains exactly this and nothing else:
| Field | What it is |
|---|---|
| Install ID | A random identifier, described below |
| Event ID | A random identifier for this one session, so a retry cannot count it twice |
| Time | When the session happened |
| Duration | How many seconds it ran |
| Cycles | How many complete breath cycles |
| The four phase lengths | Breathe in, hold with air, breathe out, hold without air |
| Pattern type | A number meaning "standard box", "4-7-8", or "custom". Never the name you gave it |
| Where it ran | iPhone or Apple Watch |
| App version | For example, 1.0 |
| Completed | Whether the session finished or was abandoned |
| Planned length | How many seconds you had set the session to run, so we can tell a finished short session from an abandoned long one |
| Started from | A number meaning Quick Start, a saved pattern, the iPhone widget, or the watch complication |
| OS version | The major number only, for example 26. Never the full version |
| Feedback settings | The haptic strength, and whether background music and the interval ding were on |
| Theme | Whether the app was set to System, Light, or Dark |
| Saved patterns | How many patterns you had saved. A count only, never their names |
Our server adds one more field when it stores the row: the date it arrived. That is a date only, with no time of day, and it exists so we can limit how many rows one install can send per day.
On first launch the app generates a random identifier (a UUID) and saves it on your device. It is sent with each row so we can tell one session from another and count returning use.
Some deliberate choices about it:
We look at aggregate patterns: how long sessions run, which patterns are popular, how often sessions are abandoned. That is the whole purpose. We do not build profiles, we do not advertise, we do not sell or share this data, and there is no third-party analytics company involved. The data goes to a Cloudflare database we control and nowhere else.
Settings > Share Anonymous Usage Data. Turning it off stops all future uploads immediately, and also discards any rows still waiting to be sent. To also undo what has already been sent, use Delete My Data, described below.
Session history used to live only in the app's container on your iPhone. Deleting the app, or moving to a new phone without an encrypted backup, lost all of it permanently. This switch fixes that.
Where it goes. Your own iCloud private database, in the container
iCloud.com.veryalien.boxbreather, using the Apple account you already have.
There is no sign-up and no account with us.
We cannot read it. This is a technical fact, not a policy promise. A CloudKit private database belongs to your Apple account. We do not have credentials for it, and there is no interface, key, or request we could make that would show it to us. It is also why we chose CloudKit over storing your history ourselves.
Do not confuse the two switches. The anonymous usage rows described above are held by us, on our server. Your backup is held by Apple, for you. Only one of these is data we can see, and it is the one with no heart rate, no names, and no history in it.
What the backup carries: for each session, the date, the pattern name, the duration, the cycle count, and the four phase lengths. Plus your saved patterns. It does not carry your heart rate, your heart-rate trace, or your calories. Those stay on your device and in Apple Health.
How to turn it off. Settings > Back Up My Sessions. Turning it off stops any further syncing. It does not erase what has already been copied to your iCloud, because that copy is yours, not ours. To remove it, delete the app's data from your iCloud storage in the Settings app under your Apple account, or delete the app.
The two switches above are genuinely independent. There is no combined "turn everything on", and turning one on never turns on the other. You can use every feature of the app with both of them off.
When you first install the app, it asks our server one question to decide which way the switches should start out:
You can change either switch at any time in Settings, whichever way it started.
The app makes one request to our server, once, on first launch. That request contains no data about you. It has no body, sends no identifier, and does not include your install ID.
Our server sees the country and state that Cloudflare attaches to any incoming web request, uses them to work out the answer, and sends back only which way the switches should start. The country, the state, and your IP address are not stored or logged. We do not use a location lookup service, and we never ask for location permission.
This question is asked once in the lifetime of the install, and never again, so opening the app in another country later does not change what you have chosen.
Settings > Delete My Data, under the two switches.
This tells our server to sever the connection between you and the usage rows you have already sent. Specifically, it erases the install ID from those rows and reduces their timestamps to a date with no time of day. What remains is a set of rows that cannot be traced to you or to each other. We keep those anonymous rows because the aggregate picture is the only reason we collected them.
It also turns Share Anonymous Usage Data off, so nothing new is sent. If the request cannot reach our server, the app tells you it failed and still turns the switch off. You can try again.
What it does not do. It does not touch your session history, your saved patterns, or your iCloud backup. Those are your data on your devices, and the button deliberately leaves them alone. To remove your history, delete records in the app or delete the app itself.
| Data | Stays on device | Sent to us | Your own iCloud | Apple Health |
|---|---|---|---|---|
| Saved patterns (including names) | Yes | Never | Only with backup on | No |
| Session date, duration, cycles | Yes | Only with usage data on | Only with backup on | No |
| The four phase lengths | Yes | Only with usage data on | Only with backup on | No |
| Pattern name | Yes | Never | Only with backup on | No |
| Heart rate, and its trace | Yes | Never | Never | Only with Apple Health on |
| Active calories | Yes | Never | Never | Only with Apple Health on |
| Install ID | Yes | Only with usage data on | No | No |
| Your location | Not collected at all | Never | No | No |
| Any device identifier | Not collected at all | Never | No | No |
Breathing profiles sync from your iPhone to your paired Apple Watch, and completed watch workouts sync back to your iPhone's session history. This happens exclusively through Apple's WatchConnectivity framework, which is a direct, local, encrypted channel between your own paired devices. It does not pass through any external server, and no other party, including us, can see this data.
The Apple Watch app never connects to the internet. It contains no networking code whatsoever. A session you run on your watch reaches your phone over the local channel above, and your phone is what uploads it, if you have turned usage data on.
Both apps have an optional, off-by-default setting ("Apple Health" in the watch app's settings, and in the "More Options" menu on iPhone) that logs each completed breathing session to Apple Health as a Mindful Minutes entry. Turning it on triggers Apple's standard Health authorization prompt, which you can decline or revoke at any time in the Health app under Sharing > Apps. Each device's setting is independent, so turning it on for your iPhone doesn't turn it on for your watch, or vice versa.
While it is on, a session started on your Apple Watch also runs as a Mind & Body workout. That means three further things, all of them local to your own devices:
With the setting off, none of this happens: no heart rate is read, no workout is saved, and the watch runs sessions exactly as it always has. Data written to Health is governed by Apple's own Health privacy protections, not by this app.
None of the data described in this section is ever uploaded to us, in any configuration. See "What never leaves your device" above.
The app does not track you across other apps or websites, does not share data with data brokers or advertising networks, and contains no advertising or analytics SDK from any third party. Because of this, the app does not ask for permission to track you, and there is nothing for you to decline.
There is also no crash-reporting service. Diagnostic messages the app writes go to your device's own local console and are never transmitted.
The app has no account, no social features, and no advertising. It does not knowingly collect personal information from anyone, including children. The optional usage data described above is anonymous and contains no personal details at any age.
Ballast is made by an independent developer, Evan Parshall, who is the data controller for the anonymous usage data described in this policy. Your iCloud backup is held in your own Apple account and is not ours to control.
You can ask what data is held about you, ask for it to be erased, or object to its collection, using the contact address below or the Delete My Data button, which does the erasure immediately and without needing to ask us.
If a future version of the app changes what it does with data, this policy will be updated to reflect that before the change ships. Any collection or sharing of data outside your own devices will remain something you switch on yourself, never something switched on for you.
Questions about this policy, or requests about your data, can be sent to: evanator@me.com