Last updated June 12, 2026
Your raw health data never leaves your device. Kiln reads Apple Health on this device, scores it on this device, and syncs only abstract game state — XP totals, levels, streaks, forge marks — to your personal iCloud. We run no servers and cannot read your data.
With your permission, Kiln reads workouts, sleep, steps, mindful minutes, heart-rate variability, and VO2 max from Apple Health. Each sample is attributed to its true source app (for example WHOOP, Oura, Strava, Apple Watch) for the verification badge. Kiln never writes to Health and never uses health data for advertising.
Everything decodable into a health measurement: raw samples, per-deed durations, distances, sleep hours, per-deed XP values, deed categories, and source app names. These live in a device-only database that is never synced, and an on-device analytics log that is never transmitted.
Capped per-day per-stat XP totals, stat levels, streaks, forge marks, tally completion state, and your profile (display name, build, bedtime). This is your private iCloud database — Apple's infrastructure, your account. The developer cannot access it.
If you join a party, your abstract snapshots (per-stat level, day XP totals, tally streak, phantom share) and chat messages are shared with that party through Apple's CloudKit sharing. Chat message bodies are stored as CloudKit encrypted fields: there is no Kiln server, and the developer cannot read your chat. The one exception is a message you explicitly report — reporting shares that message's text with us for moderation review within 24 hours.
Optional at onboarding, required to create or join a party. Kiln stores the stable Apple identifier on your device to recognize you; there is no token exchange with any server. You can additionally revoke Kiln under Settings → Apple ID → Sign-In & Security.
GitHub and Toggl integrations are optional and use tokens you paste yourself. Tokens are kept in the device Keychain and used only to fetch your commit days or time entries directly from those services.
Kiln keeps an append-only event log (tally started, level up, and similar) on your device only. It is never transmitted, contains no health values, and ships in your data export. There are no third-party SDKs and no tracking.
Faith mode is yours. The selection, your observance record, and your Spirit stat live on your phone and are never uploaded, synced, or shared — not with your party, not with us, not with anyone. Turning it off can erase it entirely.
Subscriptions are processed by Apple. Kiln never sees your payment details.
Settings → Privacy → Delete account purges your iCloud records and every local store, posts an anonymized departure to your party (dissolving it if you own it), and wipes the Keychain. Your data export is available anytime before that.
Kiln is for ages 13 and up. We do not knowingly collect data from children under 13; if you believe a child under 13 has used Kiln, contact [email protected] and we will delete the account.
[email protected] — abuse reports are reviewed within 24 hours.