Legal

Privacy

Everything happens on the watch. There is no account, no advertising identifier, no third party analytics and no network permission.

Last updated 15 August 2026On device by design

Summary

Nothing leaves the device unless you export it yourself. SENSE does not create an account, does not ask for a network, and does not talk to a server about you.

Data the app handles

Data	Where it lives	Retention
Motion samples during a scan	Memory, rolling buffer	Discarded when the scan ends
Microphone samples during a scan	Memory, rolling buffer	Discarded when the scan ends
Feature vectors and quality reports	Saved with each scan	Until you delete the scan
Scan results	App container	Until you delete the scan
Calibration profile	App container	Until reset, or until the feature schema changes
Research exports	App container	Until you delete them
Preferences	UserDefaults	Until reset
Research pseudonym	UserDefaults	Until research contribution is turned off
Usage log	App container	Capped at 200 bucketed events, erasable at any time

Microphone

The microphone runs only while a scan or a calibration is active. Audio is converted to 16 kHz mono, analysed, and dropped. It is written to storage only when both of these are true:

Research contribution is on.
Raw audio retention is on.

These are two separate opt ins and both default to off. Turning off research contribution automatically turns off raw audio retention, so retention cannot outlive the consent it depends on.

SENSE listens to the sound your tap makes so it can tell a hollow surface from a solid one. Audio is analysed on your watch and is only stored if you turn on research contribution.

Motion

Motion is captured only while a scan or a calibration is active. There is no background sensing, which is a privacy requirement as much as a battery one.

SENSE measures how your watch moves when you tap a surface. Motion is recorded only while a scan or calibration is running.

Research contribution

A contributed session contains sensor windows, the surface type, the watch model and OS version, the wrist side, a wall identifier the contributor chooses, and a locally generated pseudonym.

The pseudonym exists so that grouped validation can hold out one contributor at a time. It is random, generated on device, never derived from hardware or account identifiers, and deleted when research contribution is turned off or when you erase all data.

No name, no contact details, no location, no health data and no device identifier is recorded. Transfer is manual and deliberate. The app cannot upload anything.

Your control

Settings offers:

Turn research contribution and raw audio retention on or off independently.
Delete individual scans or the whole history.
Delete individual research exports or all of them, with the total size shown.
Reset the calibration.
Read every entry in the usage log, turn it off, or erase it.
Erase all SENSE data, which clears scans, calibration, exports and the pseudonym.

Children

SENSE is not directed at children and collects nothing that would identify one.

Usage log

SENSE keeps a local, capped log of what you did: scans started, scans completed, calibrations finished, unlock screens viewed. It never records what the sensors measured. Continuous values are bucketed before storage and the log is limited to 200 events. It is shown in full under Settings, Usage, where it can be turned off and erased, and it is removed by “Erase all SENSE data”.

Purchases

StoreKit handles payment. The app never sees payment details, never stores a receipt of its own and never contacts a server about a purchase. Free tier usage is a counter in UserDefaults.

Third parties

None. No SDKs, no trackers, no crash reporting service, no remote configuration.