How I keep it safe

Privacy shouldn’t need a lecture. You shouldn’t have to read a wall of badges to believe your record is yours — you should be able to tell from how the thing behaves. So instead of restating the policy, here’s the reasoning behind it.

Sacred content is never sent to UNA’s servers because I built UNA with two separate rooms, not one room with a privacy setting bolted on. Temple experiences, blessings, and the moments too tender for UNA’s servers live behind their own protected door. That is not a toggle someone could flip by accident. It is the architecture.

You may optionally place a sealed Sacred recovery backup in your own iCloud Drive. Only your Recovery Key can open it. Apple operates iCloud availability and transport, and UNA cannot recreate a lost key.

If you choose to sync your everyday entries, it’s because looking back is part of what makes keeping a record worth doing. Those entries travel across your devices and become your reflections — for you, and for nothing else. Never sold, never shared with advertisers, never used to train anything. That’s written into the agreements with everyone I work with, not left as a promise on a page.

Tomorrow and Heartfelt messages are future previews. They cannot be created or delivered in the first release, and I will not describe their protection as finished before that implementation ships.

And if you ever want to leave, download a portable copy of your Today data before account deletion. Sacred recovery remains separate and depends on your sealed own-iCloud backup and Recovery Key.

That’s the whole design. Not a policy bolted on afterward — the reason I built it this way.