DenkOS← HomePrivacy Policy
Last updated: 9 September 2026
1. Who is responsible
This policy covers the DenkOS apps for iPhone, iPad and Mac, the DenkOS hosted service, and os.denker.ai. The controller is Denker AI UG (haftungsbeschränkt), Fibigerstraße 141b, 22419 Hamburg, Germany. For privacy requests, contact support@denker.ai.
2. Your journal and iCloud
You can write and read your journal without creating a DenkOS service account. Notes, ordinary conversations, habits, check-ins and areas of focus are stored on your device. The iCloud-enabled app synchronizes journal data through the private CloudKit database associated with your Apple Account. Apple provides this storage under its own privacy terms. Search indexing runs on your device.
You can delete entries and export or restore a journal backup in Settings. Deletions synchronize when iCloud is available. Exported JSON files are separate, readable copies: protect and delete them separately. They exclude API keys, device health snapshots and health-assisted chats. Deleting your DenkOS service account does not delete your local journal, iCloud data or exported files.
3. Optional AI and memory
When you enable AI, selected notes, instructions and conversation context are sent over HTTPS to the DenkOS service, OpenRouter and the model-hosting provider to generate replies, summaries, rewrites or reflections. Enabled background memory features can also process relevant context to extract memories and connect your notes. These features may process personal or sensitive information you include in your writing. Generated journal sections and saved memories remain available in the app; you can review and correct saved memories.
The DenkOS service does not persist or log journal prompts or model replies. Hosted requests require OpenRouter endpoints marked for zero data retention and request that provider data collection be disabled. This is a routing requirement, not a claim that no request or billing metadata is processed. Our configured chat model is Qwen3 30B A3B Instruct; Google Gemini 2.5 Flash-Lite is used for background extraction and as an availability fallback. OpenRouter and the provider operating the selected endpoint process the request under their applicable privacy terms.
You can withdraw AI consent and manage background analysis in Settings. Withdrawal stops future processing through the disabled feature; it does not erase text already saved on your devices or information independently retained by a provider. DenkOS does not use your journal or health content for advertising or to train its own models.
4. Accounts, purchases and service records
The free AI trial uses a device credential stored in Keychain and a hashed trial identifier. Sign in with Apple is used for service accounts and purchases. We store a pseudonymous Apple account identifier, an encrypted Apple refresh token, hashed service sessions, purchase and transaction records, subscription entitlements and reply balances. Apple handles payment; DenkOS does not receive your card details.
Service records include request identifiers, status, token counts, model, cost and timing information used to provide access, apply usage limits and avoid duplicate charges. Sessions expire after 30 days. Detailed request and usage metadata is cleared after 30 days; minimal records remain to prevent request replay. Active account and purchase records are kept to operate the service and recognize your purchases.
In Settings → Plans → Manage account, you can restore purchases or delete your service account. Deletion removes sessions, Apple access tokens and associated live health data, and forfeits unused replies. A keyed account identifier and purchase records remain to prevent trial abuse and duplicate purchase credits; these retained anti-replay records have no automatic expiry. Apple subscriptions must be cancelled separately in your Apple account settings.
5. Optional health connections
Apple Health is a read-only connection on supported iPhone and iPad devices, with permission managed through Apple. Health snapshots are stored in a separate local database and are excluded from journal iCloud sync and journal backups. If you enable iPhone sharing, daily sleep, step and exercise summaries are sent to the DenkOS service, stored encrypted for a rolling 30-day period, and made available to other devices signed into your DenkOS account.
Connecting Oura authorizes DenkOS through OAuth. Oura access and refresh tokens are stored encrypted until disconnection. Oura summaries, such as sleep, activity, readiness and available heart-rate measures, pass through the service to your device without being saved in the service database. The service can decrypt shared summaries and tokens to provide these features; this server storage is not end-to-end encrypted.
Connecting health data and using it with AI are separate settings. “Use health in AI” defaults to on for signed-in Plus accounts with AI enabled, while preserving a previous off choice. When enabled, up to seven days of sleep, activity and readiness context can be sent to DenkOS, OpenRouter and the selected model provider for Daily chat and Today/Becoming reflections. Health-assisted chats stay in the separate device database, outside journal iCloud sync and exports; health-assisted headlines are held in memory. Turn this setting off in Settings → Connectors to stop future health sharing with AI.
Disable iPhone sharing to remove its server summaries, disconnect Oura to remove stored tokens, or delete your service account to remove both. You can also revoke access in Apple Health or Oura. Other devices remove downloaded shared copies after their next successful refresh; offline copies cannot be erased immediately. DenkOS does not sell health data or use it for advertising.
6. Dictation and weather
Dictation starts only when you choose to record and grant the required permissions. On supported devices and languages, Apple speech recognition works on-device using Apple-managed language models. The compatibility recognizer uses on-device recognition when available and may otherwise use Apple servers; the recording screen identifies the mode. DenkOS temporarily buffers audio for transcription and does not save recordings or send audio to OpenRouter. If you subsequently use AI with the transcript, the selected text is processed as described above.
Weather and location access are optional. When authorized, the app uses your location to request weather through Apple’s weather services. You can revoke location permission in your device settings.
7. Website, analytics and support
The website and hosted DenkOS service use Hetzner infrastructure. Your IP address and request information must be processed to deliver web pages and service responses and protect the service. The current static website configuration disables access and error logs. This is separate from the service usage records described above.
Website analytics use PostHog’s EU ingestion endpoint only after you accept analytics, and are disabled when Do Not Track is enabled. Events cover page views, download-option clicks and FAQ interactions, with page paths and browser/device properties. Network delivery exposes your IP address to the receiving service; we do not promise that it is anonymous. We exclude URL query strings, fragments and referrer properties, disable session replay and automatic interaction capture, and keep the analytics identifier in memory rather than a persistent analytics cookie.
Your analytics choice is saved in local storage. Use “Analytics settings” in the website footer to change it. Declining stops future capture; it does not automatically delete events already sent to PostHog. Analytics records are retained for website measurement and improvement under our analytics project’s retention settings. Contact us for information about retained records or to request deletion. The native app contains no advertising or analytics SDK.
If you email support, we process your email address, message and any attachments you choose to send to handle your request. Feedback in the app opens your email application; journal content and diagnostics are not automatically attached. We retain correspondence while needed to resolve and document the request and meet applicable recordkeeping obligations. External community links open third-party services governed by their own privacy terms.
8. Retention, backups and security
Local journal and health data remain until you delete them or remove their local storage. The specific service retention periods and records retained after deletion are described above. We use HTTPS, access controls and encryption for stored service tokens and shared health summaries. No storage or transmission method is guaranteed to be completely secure.
Deleted live data can remain in restricted recovery backups. Our backup policy retains the latest three snapshots plus seven daily, five weekly and twelve monthly recovery points. Seven daily Hetzner server images can also contain these backups. Removing a recovery point does not immediately erase its encrypted storage blocks; storage is reclaimed in separate maintenance. Backups are used for recovery rather than ordinary product access, so live-account deletion is not immediate erasure of every backup copy.
9. Purposes, legal bases and international processing
We process account, purchase and requested service data to provide the service and administer purchases (Article 6(1)(b) GDPR), and records required by applicable law to meet legal obligations (Article 6(1)(c)). Optional AI processing, health connections, location and website analytics rely on the applicable permissions and consent (Article 6(1)(a)); processing health information requires the applicable health-data consent under Article 9(2)(a). Limited security and anti-replay processing protects accounts and prevents fraud and duplicate credits (Article 6(1)(f)). You can withdraw consent without affecting the lawfulness of earlier processing.
Apple, Hetzner, OpenRouter, the selected AI hosting provider, Oura when connected, and PostHog when analytics are accepted receive the data needed for their respective features. Provider processing can take place outside the European Economic Area, including in the United States. Their published privacy information describes their locations and transfer safeguards. Contact us for details about recipients and applicable transfer arrangements. Do not send sensitive information to optional AI features unless you are comfortable with this processing.
AI produces suggestions, memories and reflections that you can inspect or correct. DenkOS does not use these outputs to make decisions about you with legal or similarly significant effects.
10. Your choices and rights
You can use the journal without hosted AI, withdraw optional permissions, turn off website analytics, disconnect health services, export journal data and delete your service account. Providing data for optional features is voluntary; those features cannot work without the information they need.
Depending on the applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Contact support@denker.ai. We may need information to verify that a request concerns your account, and legal retention duties can limit deletion. You may complain to your data protection supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information.
We will update this page when our practices change and revise the date above. Material changes to optional processing may require a new notice or consent in the relevant feature.