Privacy at Clarendon. No ads, no third-party tracking, never sell your data. Per-app details below.

Clarendon. / Privacy

House Rules

An honest word on privacy.

We won't pretend every app is empty of every byte. Some need accounts; that's a feature, not a betrayal. Here's what's true everywhere we work — and what changes per app.

Always true

Six commitments. Across every app.

No advertising

Nothing in our apps is paid for by an advertiser. We don't carry ads in any form.

No third-party trackers

We don't embed analytics SDKs, social pixels, or attribution services. No cross-app tracking, ever.

Never sold

Your data is never sold, brokered, or rented. There is no other business model behind the one you see.

Minimum collection

We collect only what an app needs to do its job. If a feature can work without your data, it does.

Plain-English policy

This page is written in sentences, not legalese. Read once, understand once.

Founder support

Privacy questions are answered by the engineer who wrote the code. Not a queue, not a chatbot.

Per app

How our apps differ.

Some apps live entirely on your device. Others need a server because the app itself is about coordination. Here's how each one handles your data.

Data behaviour by app Updated 7 Aug 2026
Gag Order.
On-device. Gag Order plays without an account. Votes and prompts stay on the phones in the room; nothing is uploaded to us.
On-device
Rolligan.
On-device. No account, no online required. Scores stay on the phone. The dice are kept honest by physics.
On-device
YulePick: Secret Santa
Account-based — by necessity. Anonymous gift exchanges require coordination across devices, so YulePick syncs your group, draws, and wishlists via Supabase. Encrypted in transit, deleted on request, never shared.
Syncs to cloud
Borea.
Hybrid — on-device first. Your food log lives on your phone and in Apple Health. Meal photos, voice notes, and coach questions are sent to our AI providers only when you use those features, then discarded — never sold, never used to train models.
Hybrid
Privacy Policy Last updated 7 Aug 2026 · Version 1.1

Overview.

Clarendon Labs LLC (“Clarendon,” “we,” “us”) builds iOS apps. This page describes what data each of our apps collects, why, where it goes, and what we never do with it.

The short version: we collect only what an app needs to do its job, we never sell your data, we don't carry ads, and we don't allow cross-app tracking. Some apps are entirely on-device with no account; others — like YulePick: Secret Santa — need an account to coordinate between people, and we're honest about what that means. Borea, our AI macro coach, keeps your log on your phone and in Apple Health — when you use its AI features, only what's needed to answer you is sent to our AI providers, then discarded.

Information we collect.

What we collect depends on which app you're using. We've broken it out below so you can see exactly what's involved with each.

Gag Order

Gag Order is on-device. Gameplay, votes, and prompt selections never leave the phones in the room — there is no account and nothing is sent to us. Purchases are handled by Apple via the App Store; we receive aggregated, anonymized sales reports only.

Rolligan

Rolligan runs entirely on your device. We don't require an account, and the app doesn't send any gameplay data, scores, or personal information to us. Purchase information is handled by Apple via the App Store under Apple's privacy practices — we receive aggregated, anonymized sales reports only.

YulePick: Secret Santa

YulePick is account-based because the whole point — running an anonymous gift exchange between separate people on separate devices — requires coordination. To make that work, we collect:

  • Email address — used to sign you in and send transactional emails (your draw, exchange invitations, reveal-day notices).
  • Display name — the name other participants see in your exchange.
  • Exchanges you're part of — group names, dates, and rule settings (budget, exclusions).
  • Your wishlist — items you add and any links you provide.
  • Your draw assignment — who you're buying for, stored privately so only you can see it.
  • Basic diagnostic data — crash logs sent via Apple, which never include personal content.
  • Device push token — stored only if you turn on notifications, used solely to deliver them, and tied to your account.

We do not collect contacts, location, photos, or anything beyond what's listed above. We don't profile users, build advertising audiences, or share data with other services.

YulePick may also send push notifications — a gift reveal, a new member joining an exchange, or a wishlist reminder. These are optional: you can opt in or out at any time in iOS Settings. When enabled, your device's push token is stored on our backend only to deliver these notifications and is tied to your account.

Borea

Borea is our AI macro and calorie coach. There is no account and no sign-in. Your food log, weigh-ins, and settings live on your device, and your health data (weight, steps, workouts, DEXA results) stays in Apple Health, under your control. To power its AI features, Borea sends limited data to our server only when you use them:

  • Meal descriptions, photos, and voice notes — sent to our AI provider to estimate calories and macros. Processed, returned, and not used to train models.
  • Coach questions — your question plus a short window of recent log context (meals, totals, weigh-ins) is sent so answers reflect your actual data.
  • Spoken replies — the text of a coach reply is sent to a speech provider to generate audio when you play it aloud.

We do not build advertising or marketing profiles from any of this, and Apple Health data is never sold or shared with data brokers — full stop. Subscriptions are handled by Apple; we receive aggregated, anonymized sales reports only.

How we store and protect data.

For apps that store data with us (currently only YulePick), we use Supabase, a managed Postgres provider. Data is encrypted in transit (TLS 1.2+) and at rest. Authentication is handled by Supabase Auth using passwordless sign-in via email.

We store this data in commercial-grade data centers in the United States. Access to production data is limited to the founder; we don't share it with contractors, vendors, or advertisers.

What we don't do.

  • We don't sell, rent, or broker your data. Ever.
  • We don't carry ads in any of our apps.
  • We don't embed third-party analytics SDKs, attribution kits, or social-network pixels.
  • We don't track you across apps or websites.
  • We don't profile you for advertising, build audiences, or share data with ad networks.
  • We don't enable Apple's App Tracking Transparency prompt because we have nothing to track.
  • We don't use your data to train AI models.

Third-party processors.

For apps that talk to a server — YulePick for accounts and sync, Borea for AI coaching — we use a small number of carefully chosen processors. Each is contractually limited to processing data on our behalf and prohibited from independent use.

Supabase

Active
Database & Authentication

Hosts the YulePick database and handles passwordless sign-in. US-based, SOC 2 Type II.

Resend

Active
Transactional Email

Delivers YulePick sign-in links and exchange notifications. Emails contain no marketing material.

Anthropic

Active
AI Processing (Borea)

Generates Borea's calorie estimates and coaching replies. Requests are processed and returned — not retained as a profile, not used to train models.

ElevenLabs

Active
Speech Synthesis (Borea)

Turns Borea's coach replies into audio when you play them aloud. Receives reply text only.

Apple App Store

Required
Distribution & Payment

Handles app downloads, in-app purchases, and crash reporting. Governed by Apple's privacy policy.

Data retention & deletion.

For on-device apps (Gag Order and Rolligan), we never receive your data, so there is nothing for us to retain or delete on your behalf — deleting the app removes everything.

For Borea: your log lives on your device and in Apple Health, so deleting the app (and its Health data, if you choose) removes it. AI requests are processed transiently to generate a response and are not kept as a history or profile on our servers.

For YulePick:

  • You can delete your account directly in the app at any time — open Settings → Danger zone → Delete account. This permanently removes your profile, the exchanges you organized, your wishlists, and your draws and assignments.
  • Account and exchange data are kept while your account is active.
  • Inactive accounts (no sign-in for 24 months) are deleted automatically along with their associated data.
  • You can request immediate deletion of your account and all associated data at any time by emailing hello@clarendon.dev. We'll confirm the deletion within seven business days.
  • Backups containing deleted data roll off within 30 days.

Children's privacy.

Our apps are not directed at children under 13. We do not knowingly collect personal information from children under 13. YulePick requires an Apple ID and an email account, both of which require users to be at least 13 in the United States and 16 in many other jurisdictions.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

Changes to this policy.

We'll update this page when our practices change. Substantive changes will be announced in-app and in the newsroom, and the “Last updated” date at the top of this page will change. We won't reduce your existing privacy protections without explicit notice.

Contact.

Questions about privacy go to the engineer who wrote the code, not a queue.

Email: hello@clarendon.dev
Mail: Clarendon Labs LLC · 4801 N. Clarendon Ave. · Chicago, IL 60640 · United States

California residents have specific rights under the CCPA, and EU/UK residents have rights under the GDPR, including the right to access, correct, port, and delete personal data. To exercise any of those rights, email us at the address above. We'll respond within the timeframe required by the applicable law.