Privacy

Apps are picked through Apple’s Screen Time. Apple hands Nepsis opaque tokens, never app names or bundle ids, and those tokens stay on your iPhone. Nepsis never sees how long you use an app or what you do in it. When the shield shows on a locked app, the app on your phone learns that app’s name so your history can say “News, 5 minutes”, and the name stays on that phone. The one exception is below: apps you allow for agent sessions.

If you’d rather nobody glancing at your phone saw which apps you lock, turn on Hide app names (Settings, Privacy). Nepsis then stops showing locked apps’ names everywhere it draws: its own screens, the shield, its notifications, its widgets and Live Activity, and the Screen Time report. Apps read “Your app” or “App 1”, your history shows the game and the minutes, and your agent’s notes read “Note hidden”. Press and hold a hidden name in the app to see it for a few seconds. The setting is kept with your other settings so every device follows it, and the server reads it so the notifications it sends name no app. It changes what is shown, not what is kept: your assistant still gets names when you ask it.

If you turn on agent sessions (Settings, Assistant) and allow an app, Nepsis shares that app’s name with its server, as your phone knows it or as you typed it, with your device’s id and the app’s opaque id, so your assistant can ask for it by name. You are asked first, and only the apps you allow are shared; every other app’s name stays on your phone. Your device’s push token (see Your devices) is how the server tells your phone a session started or ended. Each session is kept with when it started and ended, how long it was for, the reason your assistant gave, who ended it, and which connected app started it. Sessions are listed under You and never count as unlocks. Turning an app off removes its name from the server; turning agent sessions off removes every name.

You sign in with Apple, Google, or an email address and password, handled by Firebase Authentication (Google). Nepsis keeps your email address and, if you give one, your name. With Sign in with Apple you can hide your real email. Your account is the same one used by Heft and Nibble, apps by the same developer: signing in to any of them with the same Apple, Google or email reaches the same account, and you can connect more than one way to sign in under You, Sign-in methods. Each app keeps its own data apart under that account, and none of them reads another’s except as described under Earned time.

Stored in Firestore under your account, readable only by you and the Nepsis server:

The sample question when you set Nepsis up is not recorded anywhere, and while you set it up, the step you are on is kept on your phone only, so closing the app picks up where you left off.

If you connect Margin (You, Earn time), you approve it on Margin’s own consent screen, and Nepsis may then read how many minutes you read each day and when: never which books, notes or highlights. The connection is kept encrypted on the Nepsis server, and the minutes for the last week are kept so the weekly summary can show them. If you use Heft with the same account, the Nepsis server reads when your workouts started and ended, and how they were logged, to credit training; it never changes anything in Heft. What was credited and spent is kept as a small record per day. Disconnecting Margin, or turning training off, stops it; minutes already earned stay.

On your iPhone, Nepsis and Heft share a few flags through a shared app group: whether Heft’s bedtime or workout focus is on and until when, and Nepsis’s “done for today”, how many apps it locks (a number) and the week’s counts. They stay on the phone.

Right answers in Train now earn coins, which you can trade in the app for a few minutes of earned time. Nepsis keeps your coin balance, how many coins you earned and minutes you traded each day (with an id for each paying answer, so none pays twice), and each trade: when, how many coins and how many minutes. Coins are written only by the Nepsis server; they can’t be bought and have no value outside Nepsis. Reset Nepsis and deleting your account remove them, apart from the last few days’ daily totals, which a reset keeps so the daily limits still hold.

When your assistant makes a trusted code, Nepsis keeps a salted scrypt hash of it, when it was made and used, how long it opens your apps for, the reason the assistant gave, and which connected app asked. The code itself is never stored, and the app never shows it. Wrong codes are counted for an hour to stop guessing.

Friends are optional. If you pick a handle, Nepsis keeps it with your account (and in a list of taken handles, so no one else can have it) and makes an invite link and QR code from it. Each friend sees your handle, your name if your account has one, and the time the two of you gave or asked for, such as “Pavel gave Ana 10 min at 21:14”. They never see your stats, your streak, which apps you lock, or what you opened. Nepsis keeps your friends, requests and blocks, the time given and asked for, and whether “Only a friend can unlock” is on. A six-digit code from a friend is kept only as a salted scrypt hash until it is used or runs out ten minutes later, and wrong codes are counted for an hour to stop guessing. A friend’s time reaches your phone through your device’s push token (see Your devices). Someone you block is never told.

If you connect an assistant, it reads and changes only what you approved on the consent screen, and only for your account. Access tokens are stored as SHA-256 digests. For each connection Nepsis keeps the name the assistant registered under, what you allowed, when you connected it and when it last renewed its access (about once an hour while in use), so the app can show whether an assistant is connected and offer assistant features only then. You can disconnect at any time from the app (Settings, Your AI assistant) or from your assistant; a connection also ends after 180 days, or after 30 days unused.

Each iPhone or iPad you sign in on keeps a small record in your account: its name and model, how many apps it locks (a number, never which apps), the app version, and when it was last open. Your other devices use it to list it under You, Devices, where you can remove one. Which apps are locked stays on each device; Apple does not let it leave.

While you allow Nepsis to send notifications on an iPhone or iPad, that device’s push token is kept on its record, so Nepsis’s server can reach it through Apple: an agent session starting or ending, or a friend’s gift or ask. The token goes only to Nepsis’s server and Apple. It is removed when you turn notifications off for Nepsis, when you sign out, and when Apple says it no longer works.

If you connect another device to send game results (You, Connected devices), Nepsis keeps the name you give it, when it was connected and last sent results, and how many it sent. Its key and the connect code are stored only as SHA-256 digests. Its results are kept like your own answers (right or wrong, time taken, which game), marked as coming from that device. Disconnecting stops it at once; deleting your account or resetting Nepsis removes it.

Premium is bought through Apple. RevenueCat tells Nepsis whether you have Premium, using an anonymous id tied to your account. Nepsis never sees your card or Apple Account. If you start the free trial with “Remind me before it ends” on, your iPhone schedules one notification for two days before the trial ends. It is scheduled and kept on your phone only (with its id, so it isn’t scheduled twice); nothing about it is sent to Nepsis’s server.

Delete your account in the app (You, Delete account), or write to info@pstepanov.dev from your account’s address. Because the account is shared, this deletes it everywhere it is used, in Nepsis, Heft and Nibble, with everything kept for it. To clear only what Nepsis keeps (progress, settings, earned time, the Margin connection, emergency code history, agent sessions, and your handle and friends) and keep the account, use You, Reset Nepsis. Either one also takes you off every friend’s list and frees your handle. You can also ask for a copy first.

Pavel Stepanov, info@pstepanov.dev.