Private by default is an easy thing to write in a footer. Here is what it means in the app you can install today.
Where the data lives
On your phone. Check-ins, notes, recovery and journal are stored locally. Cloud sync is opt-in, behind Sign in with Apple, and can be turned off.
What leaves the device
Nothing, until you use live Refuel AI. Then a minimised, structured summary and the message you typed are sent to generate one reply. Your journal is never included. Crisis language is handled on the device and never reaches a model.
What delete deletes
Everything: the local store, the cloud copy if you had one, the widget snapshot, the Siri shortcut data, the sync ledger. A deletion epoch advances so an old device that was offline cannot bring the data back.
What is never sold
Health and family data. There are no advertising SDKs in the app and analytics can never carry a score, a mood or a symptom.