tenfold privacy policy
This policy explains what happens to your data when you use the tenfold iPhone app. The short answer: it is encrypted on your device, and nothing readable leaves it. The long version follows, including the little the server sees once you switch sync on.
1. Who is responsible
Freshlab Iberia S.L.U. · NIF ES B87323754 · Spain · info@freshlab.es. For support questions about the app, write to support@freshlab.es. Full company details are in the imprint.
2. Scope
This policy covers the tenfold iPhone app and the sync server it uses, which Freshlab Iberia operates. The freshlab.es website is covered by the general privacy policy.
3. What data the app processes
tenfold collects no personal data. There is no user account: no name, no email address and no password ever reaches a server, so there is nothing that could tie a list to a person.
- Your goals, steps, notes and context cards are stored encrypted in the device's local storage. The app writes nothing but the sealed blob into that store.
- Stored unencrypted are only three appearance preferences and, if you enable biometric unlock, a local pointer that holds no secret.
- No cookies, no analytics SDKs, no advertising and no tracking identifiers are used. The one outside component is the one that checks tips, described in section 8, and it reaches none of your content.
- The app works entirely offline.
4. Zero-knowledge encryption
Content is encrypted on the device with AES-256-GCM under a random 256-bit master key. That master key is wrapped by your passphrase and by your recovery key, both derived with PBKDF2-SHA256 at 600,000 iterations with a random salt. The passphrase is never stored, never transmitted and not recoverable. The recovery key is shown exactly once during setup, and keeping it is your job.
Face ID unlock adds one more wrapper: the system keeps a key in the device keychain that is released only for your face and that wraps the master key. It is a convenience, not a recovery path: a device that is gone takes its wrapper with it.
The consequence is deliberate and worth reading twice: if the passphrase and the recovery key are both lost and no export exists, the data cannot be recovered. There is no reset link, no key escrow and no backdoor, and nobody at Freshlab holds anything that would open your sealed blob.
5. Optional sync and what the server sees
Sync is off by default. Switching it on is a deliberate act in settings and exists so that the same list can be on several devices. What is sent is only the encrypted blob, identified by a code generated on your device that is not derived from any personal detail.
The server stores: the encrypted blob, a version counter, the hash of the write token, that mailbox code and the most recent versions of the blob. It also sees the size of the blob and when it last changed. It cannot see any title, note, card or setting, it does not know whose a mailbox is or how many goals it holds, and it cannot decrypt anything because no key material is held there. The server also never merges versions: that happens on your device.
As with any web server, the IP address is processed transiently for abuse prevention, on the legitimate interest basis of Article 6(1)(f) GDPR, and is not written to disk. Technical log lines contain at most the first six characters of the mailbox code.
6. Aggregate server statistics
The server may keep a daily, aggregate usage count with no identifiers. What is counted: page loads, distinct visitors for the day, bot requests, the referring domain where there is one, the country reported by the network, the platform type and the number of devices that synced through the app that day. Distinct visitors are counted through a hash with a random salt that is regenerated each day, held only in memory and gone with the day, which is why two days of the same person cannot be linked.
No IP addresses, user agent strings, cookies, sessions or persistent identifiers are recorded. Only numbers per day reach the disk, kept for at most 400 days. An app used offline appears in none of those numbers.
7. Artificial intelligence: there is none inside
tenfold embeds no AI system. There is no configured provider, no key, no address and no setting for one, and the app makes no request to a model under any circumstances. That is why the transparency duties under Article 50 of Regulation (EU) 2024/1689 (the AI Act) do not apply to Freshlab for this app, as they do for our apps that genuinely carry AI.
What the app does do is write a prompt about one goal for you to copy and, if you want, carry to the AI tool you already use. At that moment you are the transport: the data leaves your device through your own action, the legal basis is your decision under Article 6(1)(a) GDPR, and it is a fresh decision every time. The prompt holds only the goal being worked on, the goals it hangs under, its direct steps and the linked cards by name and relation, never the whole tree; anything you marked as excluded produces no prompt at all, and the app names what was held back before anything is copied. How the AI provider you choose handles that text is governed by that provider's terms, not by this policy.
8. Purchases
tenfold is free, and nothing it does sits behind a payment. The iPhone app carries three voluntary one-off tips; they unlock nothing, because nothing is locked. The payment itself runs end to end through Apple's App Store. Freshlab receives and stores no payment data: we do not know your name, your address or your payment method, and from Apple we get only aggregated sales reports that do not identify individual buyers.
To check that a tip actually went through, the app relies on RevenueCat, a provider acting as a processor on Freshlab's behalf. RevenueCat receives the purchase receipt Apple issues and the transaction data it carries: the product bought, the amount, the storefront country, the timestamps and the state of the purchase. It does not receive your name, your address, your payment method or your Apple ID, and no goal, step, note or card, nor the mailbox code itself. That path touches neither the encrypted blob nor any key material: they are two separate circuits inside the app, and RevenueCat is not on the one that holds your list.
Device and advertising identifiers do not reach it either. The app configures that component with automatic identifier collection switched off and gives it no identifier of our own, so the tip hangs on a random code that means something only inside this app. It is not linked to your identity, it feeds no tracking and no advertising. RevenueCat's privacy policy is on its own site. If that service does not answer, the purchase carries on directly through Apple's StoreKit, and with no connection the app works exactly as before: only the purchase goes unchecked.
9. System permissions
The app asks for iOS permissions only when a feature you enabled actually needs them:
- Notifications: reminders are local notifications scheduled by your own iPhone. They travel through no push service and need no internet connection.
- Face ID: only if you enable biometric unlock. The system performs the check; the app receives no biometric data.
- Camera and microphone: never requested, because the app does not use them.
You can withdraw any permission at any time in iOS settings under tenfold. The app keeps working, with the corresponding feature switched off.
10. Retention and deletion
Your data lives encrypted in the app's local storage and, if you switched sync on, additionally as an encrypted blob on the server. Freshlab can read neither.
- Wipe this device: removes the local copy and this device's keys, leaving the synced copy untouched.
- Delete everywhere: removes the server copy first and stops if that fails, rather than half-deleting; then this device, the keys and the biometric enrolment go.
- On the server the whole mailbox goes, version history included. Not even a marker that the code existed is kept.
- Deleting the app from the iPhone removes the local copy. If sync was on, please delete the server copy first with the option above.
- You can export your data at any time, either encrypted or as readable text. The readable file can be opened by anyone who gets hold of it, so keep it accordingly.
11. Third parties, transfers and open source
We share your content with no third party, because we hold no readable data: all we could hand over is a blob we cannot open either. The one exception is in section 8: RevenueCat Inc., a company based in the United States, checks Apple's purchase receipts on our behalf as a processor, receiving nothing from your list, and that processing is governed by the data processing agreement that forms part of its terms and by its privacy policy. Beyond that, your use of the app results in no international data transfers on Freshlab's side, beyond the relationship with Apple as operator of the App Store, which is governed by Apple's own terms and privacy policy. Everything described here is checkable: tenfold's source code is open under the MIT licence at github.com/freshlabde/tenfold, and you can run the sync server yourself if you would rather the encrypted mailbox were not with us either.
12. Your rights, children and changes to this policy
The General Data Protection Regulation gives you rights of access, rectification, erasure, restriction, objection and portability. Because there is no account and we cannot read your content, those rights are exercised inside the app: export is portability, delete is erasure. If you would like to contact us, write to info@freshlab.es. You may also lodge a complaint with a supervisory authority, in Spain the Agencia Española de Protección de Datos (aepd.es). tenfold is intended for adults, does not ask for your age or any other personal detail, and contains no content directed at children. If a future version changes anything material about data handling, we will update this page before releasing it and change the date at the bottom.
Effective date: 16 August 2026 · Last updated: 16 August 2026 · tenfold · Imprint · Home