Privacy policy

Muninn knows how to keep a secret. What it remembers is for your eyes only, and this page lists every byte that ever leaves your phone. Your diary and wherearbouts are some of the most personal records a phone can keep. This page tells you, what Muninn records, where it keeps it, and everything that ever leaves your phone. You should REALLY read this.

“Privacy first” is a much overused term. In Muninn’s case, it’s the whole reason it exists. EU/Norwegian laws, my own need and want for privacy, and the fact, that “you’re the product” makes me nauseous made me sit down and write those apps.

This page is long because “we respect your privacy” is worth nothing without the details underneath it.

The short version

No account, no server, no analytics, no trackers, no advertising.
Photographs, calendar, health data and journal text never leave your device.
Your days are stored as plain JSON in your own iCloud Drive, governed by the same privacy and security guarantees your iMessage, eMail, and everything else in Apple’s iCloud enjoy.
Muninn contacts five services, named in the table below. Three receive anonymous requests; the other two are accounts you connected yourself, fetching data you gave them before. Three stop with a switch, two by disconnecting.
Muninn for Mac has the same protections, and contacts one of the five: the weather. What’s different on the Mac.
I never see your data. Nothing in the app could send it to me.

No AI, Never AI

Muninn is you, not an AI. It is your thoughts, your pictures, and your data, whom you know, and where you went. Things you should be able to decide whom you share it with.

That is why Muninn does not plug into any AI, not a server, not Private Cloud Compute, no MCP, nothing.

However, if you whish to use AI on it, everything is plain text in your iCloud Drive, locked away until you let others read it. In JSON, the perfect format for AI analysis. That’s your choice, we won’t ship it in-app though.

What never leaves your control

Muninn asks for each permission the first time it uses that source, not at install, and never for a source you’ve switched off.

Photographs and video: Read through Apple’s PhotoKit and shown in place. Muninn does not copy them into its own storage, upload them, or analyse them anywhere but on your phone.
Calendar events: Read through EventKit, from only the calendars you select. Titles and times are shown and cached locally; nothing is transmitted.
Journal text: Day One exports are parsed entirely on the device. Attachments and photographs inside the export are ignored rather than imported. Apple Journal imports are read on the device too.

What is stored, and where

Muninn keeps a chronicle: one record per day, written as plain JSON into an iCloud Drive container belonging to your own Apple Account. Apple’s privacy policy governs that storage, exactly as it governs your other iCloud documents. Muninn has no access to it beyond your device, and neither do I. You can open the container in the Files app and copy it out at any time.

Alongside that, a local search index lives on the device only. Access tokens for services you connect are held in the iOS Keychain. Your preferences, such as which sources are on and which calendars count, are stored in the app’s own settings on the device. That is the complete list of places Muninn puts anything.

The five times bytes leave your phone

These five services, and no others, ever hear from Muninn. Each request goes straight from your phone to that service, with no proxy in between.

Service	What is sent	Why	Switch it off
Open-Meteo (EU)	A coordinate rounded to roughly one kilometre, and a date. No identifier of any kind.	Historical weather for that day	Settings → Sources → Weather
Apple geocoding	A coordinate, to turn it into a place name	So a day says “Hamburg”, not a pair of numbers	Switch off the source that produced the coordinate
Wikimedia	A month and a day, such as `09-12`. Not the year, and nothing about you.	What else happened on this date	Settings → Sources → World history
Foursquare / Swarm	Your own access token, issued to a developer app registered in your own Foursquare account	To fetch your check-ins	Settings → Sources → Swarm, or Disconnect
Träwelling (EU)	Your own personal access token	To fetch your rail journeys	Settings → Sources → Träwelling, or Disconnect

Muninn makes no other requests: nothing on launch, no heartbeat, no licence check, no remote configuration. With every source above switched off or disconnected, the app never opens a network connection.

Muninn for Mac

Muninn for Mac is an app of its own that opens the same chronicle, from the same iCloud Drive container in your own Apple Account. Everything on this page holds for it: no account, no server, no analytics, no trackers, and nothing that reaches me. Where this page says “your phone”, read “your Mac”.

It asks less of the network than the phone does. Of the five services above, the Mac contacts one: Open-Meteo, for a day’s weather, with the same rounded coordinate and date and no identifier. Settings → Sources → Weather switches it off.

It doesn’t import from Swarm or Träwelling. It never contacts Foursquare or Träwelling, and holds no access token for either. The check-ins and train journeys your iPhone or iPad has fetched are part of your chronicle, so the Mac shows them. It doesn’t fetch world history from Wikimedia either.

Photographs and calendar events are read on the Mac, after macOS has asked your permission, and Day One and Apple Journal exports are parsed on the Mac. Set to Read Only in Settings → Writing, it writes nothing to your chronicle and doesn’t fetch weather.

What I receive

Nothing. Muninn contains no analytics, no crash reporting, no attribution framework, no advertising identifier, no “anonymous usage statistics” and no A/B testing. If the app breaks, I only find out when you write to me; I chose that trade on purpose.

I don’t know how many days you have, which sources you use, whether you opened the app this week, or what your name is, unless you email me and tell me.

This website

This website sets no cookies, stores nothing about you, and loads nothing from any other domain: no analytics, no embedded video, no social widget, no tag manager, no content delivery network, no web fonts. It’s set in your device’s own system font and follows your device’s light or dark setting. That’s why there is no consent banner.

The server keeps the usual access logs, as every web server does. They are not used to build a profile of anyone. Access logs are deleted after three hours and error logs after 24.

The GDPR gives you rights of access, rectification, erasure, restriction, portability and objection. With Muninn you exercise them yourself, because the data is already in your hands. For services you connect, that service is the controller of the data it holds; Muninn only reads it, with a token you issued and can revoke.

Access & portability: Your chronicle is plain JSON in your own iCloud Drive. Open the Files app and copy it. No request to anyone is required.
Rectification: Edit or re-import the source. Muninn holds no master copy of anything: your diary lives in your iCloud Drive, and nothing is stored outside that folder.
Erasure: Delete the app and its iCloud container. No other copy exists.
Objection & restriction: Switch a source off. It is then never queried again.

I hold no copy of your data to produce, correct or delete. If you think I do, write to hello@mymuninn.app and I will answer.

Children, changes, and contact

Muninn is not directed at children and collects nothing from anyone, of any age.

If anything here changes, this page changes and so does the date below. There is no mailing list to tell you, so check this page when you update the app.

For anything at all: hello@mymuninn.app. Muninn is made in Norway and the EU by Mikka Luster.

Last updated: 11 October 2026