How we build

We made some choices most apps don't. No trackers. No analytics. No advertising business hiding behind the free tier. Only a handful of companies ever touch your data, and we can name every one of them.

Those choices cost us something, and we'd rather be honest about the whole picture than show you only the flattering half. Here it is — what we do, what we refuse to do, and what we're not pretending to be.

The four companies we hand your data to

That's the whole list. Four companies, each with a narrow job, and we can tell you exactly what each one sees.

• Cloudflare — hosts the entire surface, so it carries every request and response while it's in flight, plus the edge cache and DNS.
• Turso — stores your per-patch app data and our control database at rest, including backups.
• Resend — sends the one-time recovery codes to your email, and holds waitlist addresses so we can tell those folks when Sprigged opens up.
• Anthropic — runs Claude for the build-with-AI authoring loop. It sees the prompts you write there, and under its commercial terms it does not train its models on what you send.

Your phone's operating system, the app store you used to install Sprigged, and the payment processor also handle some data in the course of their own jobs — but those are your existing relationships with Apple or Google, not companies we chose; the full picture is in our privacy policy.

That's it — four companies, and we can name all four. Adding a fifth isn't a quiet config change for us; it's a deliberate decision we have to argue ourselves into and write down.

What we don't do

Some of these are guaranteed by how Sprigged is built, not just by a promise we're making. You could check the code and find them true.

• No analytics SDKs. There's no Google Analytics, Mixpanel, Amplitude, PostHog, Sentry, or anything in that family watching what you do.
• No cookies. Sprigged doesn't set them. Signing you in uses a token, not a tracking cookie.
• No localStorage. We deliberately avoid it, because browser extensions can read it without asking you. Your identity and your app data live in sandboxed, per-origin storage instead.
• No data sale. We don't sell your information to advertisers, data brokers, or anyone else. There's no ad-funded business hiding in here.
• No outside trackers. Every third-party origin the app talks to stays inside the four-company list above. Nothing else gets a line to you.

What we don't claim

A stance is only worth anything if it survives a hard look. So here's what Sprigged is not, said plainly.

• It's not end-to-end encrypted. The server can read your data — Turso holds it, and the authoring loop needs it in plaintext to work. Apps like Signal genuinely can't read what you send; Sprigged can. "We don't sell it" is not the same as "we can't see it," and we won't blur the two.
• It's not open source — at least not today. Open code is a real credibility multiplier, and until that changes we're not going to imply an auditability we haven't earned.
• One person has the keys. Sprigged is run by one operator, who has root access to the systems that hold your data. That's the honest operational reality, and we'd rather you know it than imagine a larger machine behind the curtain.

There's a cost to all of this we'll own up to: turning down trackers and analytics means we fly blind on a lot. We see far less about how Sprigged is actually used than most software does, and that makes the job harder. We've decided that's a trade worth making.

Want the legal version, in full detail? Read the privacy policy.