Hazumi privacy policy

Last updated October 17, 2026.

Hazumi is a task app for iPhone and Mac, made by one person. It has no accounts, no analytics and no ads, and it doesn't track you. This page says what Hazumi keeps, where, and who can see it.

On your devices

Your tasks, projects, tags, habits and notes are stored on your device. So are Hazumi's own backups, which it makes each day, and its settings.

On iPhone, iOS encrypts your library on the device: it can't be read until you've unlocked your iPhone once after it starts up. On a Mac, it's encrypted on disk when FileVault is on.

• iPhone backups. If you back up your iPhone to iCloud or to a computer, that backup includes your Hazumi library, under Apple's terms. Hazumi's sync keys are never included: they stay in this iPhone's Keychain and can't leave it.
• Copies you make. Keep a copy in Files saves a copy of your library wherever you choose. Where it goes, and who can see it there, is up to you.
• On-device features. Reminders are notifications your iPhone makes for itself. Spotlight search, widgets and the Share sheet work on your device. If you use Handoff, Apple passes the Hazumi page you're looking at between your own devices.
• The camera is used only to scan a Hazumi code shown on another of your devices, when you choose to join a library. Nothing it sees is kept.
• Latency Readout, if you turn it on in Settings, writes a log of how long each gesture took to show on screen. The log holds timings and your device's conditions (such as Low Power Mode), not what your tasks say. It stays on your device unless you send it to someone yourself. While the readout is off, nothing is measured.

Without sync, nothing you write in Hazumi leaves your device.

If you use sync

Sync is optional and by invite. When you turn it on, your devices send each change to Hazumi's sync service, so each device can catch up with the others.

What the sync service can't see. Your records are encrypted on your device before they're sent, with keys only your devices and your Recovery Kit hold. The service stores them but can't read them. It never sees your tasks' titles, notes, dates, projects, tags or the names of your devices.

What the sync service holds. To route, check and store records it can't read, the service keeps:

• the encrypted records themselves, with their sizes and the times they arrived;
• your library's devices, each by an ID and its public keys, and whether it is still a member;
• when each device last synced, how much it sent, and which version of Hazumi it runs;
• when invites were made and used, and when a Recovery Kit was used or replaced;
• when each device last made a backup on itself (the time and kind, not the backup);
• a request to delete the library, if you make one.

Encrypted at rest. Everything the service stores is encrypted on disk, the list above included. Its backups are encrypted again with the service's own key.

The person who runs Hazumi can see this about your library: how many devices it has, when they sync and how much, and its backup status. Never what's in it. The person who runs Hazumi keeps a note of whom each invite was for on their own computer, not on the service.

Cloudflare. The service runs on Cloudflare. Like any web service, Cloudflare sees your device's IP address when it connects, and handles that under its own privacy policy. Hazumi's service uses the address only for a moment, to limit how many requests one place can make in a minute. It doesn't store it, and its logs don't contain it.

Backups of the service. The service keeps encrypted backups of what it holds, in a separate Cloudflare account and on a computer at home run by the person who runs Hazumi, which stores its copies in that person's iCloud Drive. These hold only what the service holds, so they can't be read either: not by Cloudflare, Apple, or the person who runs Hazumi.

Your Recovery Kit is yours. The service never has it, so nobody can recover your library for you without it.

No analytics, no tracking

Hazumi contains no analytics, advertising or tracking code, and it doesn't share anything with data brokers or advertisers. It doesn't use your location, contacts, photos or calendar.

TestFlight

While Hazumi is in testing, you install it through Apple's TestFlight. Apple collects some information for TestFlight and shares it with the developer: the email address and name your invitation went to, when you installed the app and how often you open it, crash reports, your device model and iOS version, and any feedback and screenshots you choose to send. Apple's own TestFlight terms and privacy policy cover that. Hazumi itself sends none of it.

Deleting your data

• On your device: delete the app. That removes Hazumi's library, backups and settings from it. Copies you saved in Files stay where you put them.
• From the sync service: choose Settings › Sync › Turn Off Sync and Delete from Server…, on any of your devices. Your library is deleted from the service a day later; until then any of your devices can cancel. (To protect you, it can't be asked for in the day after a device is removed or the Recovery Kit is replaced, or while a Recovery is under way.) Your tasks stay on your devices. The service's encrypted backups of your library are removed within about two months after that: the copies at Cloudflare and on the home computer within about a month, after which iCloud Drive keeps deleted files in its Recently Deleted folder for 30 more days.
• From TestFlight: stop testing in the TestFlight app, or ask to be removed from the test.

Changes

If this policy changes, this page changes with it, and the date at the top says when.

Questions

Ask the person who invited you, or choose Send Beta Feedback in the TestFlight app's Hazumi page.