Khaki — Privacy Policy

Khaki is a habit, goal and journal app that runs on your iPhone. It has no account, it never asks you to make one, and by default nothing you write in it leaves your phone. No analytics. No advertising. No tracking. Nothing sold to anyone, ever.

There is one exception, and you have to choose it. People who work at White Rock can sign in with their work Microsoft account. Then — and only then — Khaki copies your data to a server we run, so that it survives a lost phone and shows up on a second device.

If you never sign in, everything in this policy about servers simply does not apply to you.

Khaki is made and published by White Rock LTD, which is responsible for the data described here.

• Company: White Rock LTD
• Registered address: Abu Dhabi, United Arab Emirates
• Privacy questions: appsupport@white-rock.ae
• Support: appsupport@white-rock.ae

This is the default, and it is how most people will use Khaki.

Until you sign in, the app makes no network connection at all. Not a quiet one in the background, not a version check, not an error report. Your habits, your daily marks, your moods and your journal live in exactly one place: the app's own folder on your iPhone.

We receive nothing. We have no way to know that you installed Khaki, what you track in it, or whether you opened it today.

Inside its private folder, the app keeps:

• everything you create — habits, goals, the day-by-day record of what you did, moods, journal entries, journal prompts, tools, and which celebration screens you have already seen;
• your display name and a couple of preferences;
• if you have signed in, a small bookkeeping file that remembers your account id, which rows still need to be sent, and when the last sync happened;
• a small archive of rows that were replaced by the synced copy — it can contain journal text, moods and your name;
• occasionally, a quarantined copy of the data file, if the file was ever found damaged.

One more store sits outside that folder, and only if you have signed in: Microsoft's sign-in library keeps its own cache in the iPhone's keychain, holding your work email, your display name and the handle of your Microsoft account.

No other app can read any of this. Deleting Khaki from your iPhone removes every file listed above. The Microsoft sign-in cache is the exception — it lives in the system keychain, which iOS does not clear when an app is deleted. If you want it gone, sign out before you delete the app: signing out clears that cache. It does not touch your Microsoft session on the phone, which belongs to Microsoft rather than to us, and which we cannot clear for you.

One thing worth knowing: these files are not excluded from backups. If you back your iPhone up, a copy of your Khaki data is inside that backup, and it stays there until the backup is replaced or removed. An iCloud backup is encrypted by Apple. A backup to a computer is encrypted only if you turned on "Encrypt local backup" — if you did not, your journal sits in that backup in the clear.

You can also erase everything without deleting the app: Settings → Data → Reset all data. To open Settings, tap the greeting at the top of the Today screen.

Who can sign in

Only people in White Rock's Microsoft directory. A personal Microsoft account, or an account belonging to another company, cannot sign in — Microsoft refuses it before it ever reaches us. Signing in is an optional row in Settings, not a gate on the app.

Your password

You never type it into Khaki. Sign-in opens Microsoft's own page, and Microsoft hands the app a short-lived access token. The app does not store that token itself; it sits in the Microsoft sign-in library's own secure cache on your device.

The Microsoft sign-in component

That library is the only piece of third-party code inside Khaki. It collects its own account, device and diagnostic information for Microsoft, under Microsoft's privacy statement rather than this one. We never receive any of it.

What synchronises

Once you are signed in, all of this is sent to our server and stored there:

• Habits and goals — name, icon, colour, the kind of habit it is (yes-no, quantity, timer, quit, checklist or entry), which goal it belongs to, schedule, reminder settings, how many sessions a day and at what times, a timer's length, the moments its chimes fire and the sound it uses, target and units, checklist items, the affirmation you wrote, any journal prompt or tool attached to it, notes, planned pauses, whether the item is active or archived, and its position in the list.
• Your daily record — for each habit on each day: done or skipped, how much, how many minutes, how many sessions, which checklist items you ticked.
• Your daily mood — a number from 0 to 4, with the date.
• Your journal — the title, the full text of the entry, the mood attached to it, the icon, the colour, when it was written, and the prompt it was written from.
• Journal prompts — the built-in ones and any you wrote yourself.
• Tools — the techniques attached to a habit: name, short description, when to use it, and every step.
• Which celebration screens the app has already shown you, so a second device does not repeat them.
• Your display name, your timer animation, and whether you turned off the journal prompt on low-mood days.

Said plainly: your journal text is on our server. It is stored as ordinary text in a database. There is no end-to-end encryption. The people at White Rock who administer that database can technically read it. We treat that access as a maintenance necessity and not as a licence to read your diary, but you should know the shape of it before you decide to sign in.

These never leave your phone, signed in or not: whether the app has already asked you for notification permission, when you last left the Today tab, and a timer session that is running right now. Only the finished result of a timer — the minutes and the number of sessions — becomes part of your daily record.

What we know about you as a person

From the sign-in token, our server stores:

• your Microsoft object id and your company's tenant id — together, this pair is your identity to us;
• your work email address;
• your display name from the company directory;
• the name shown in the app's greeting — your directory name to begin with, and whatever you type over it;
• when your Khaki account was created, and roughly when it was last active (we move that timestamp at most once an hour).

There is no password and no password hash. We do not keep a refresh token, a list of your devices, or an IP address attached to your account.

Where the server is

Amazon Web Services, in the Asia Pacific (Mumbai) region — ap-south-1, India. The application, the database and the server logs are all there.

Wherever you are, signing in means your Khaki data is transferred to and processed in India. Our hosting provider's data-processing agreement covers that transfer and includes the European Commission's standard contractual clauses; write to appsupport@white-rock.ae and we will send you a copy.

Who else is involved

• Microsoft — the identity provider. Sign-in happens in Microsoft's own window, and Microsoft sees that sign-in the same way it sees any sign-in to a corporate app. Our server never sends your Khaki content to Microsoft. The only request it makes to Microsoft is for the public keys it needs to check your token's signature.
• Amazon Web Services — hosting: the servers, the database, the load balancer, the logs. AWS holds the data physically and does not use it.
• Sentry — error monitoring for our server, so that we find out when something breaks. It identifies you by an internal id only — no email, no IP address, no cookies — and it is not meant to receive anything you wrote. In rare cases a malformed or failing request can carry a fragment of what was sent into an error report. Sentry’s European instance, hosted in Germany
• Nobody else. No analytics vendor, no advertising network, no attribution service, no email or push provider.

Each of these companies handles the data only on our instructions, under a written agreement that requires them to protect it to the standard described in this policy, and none of them may use it for their own purposes.

There is one promise we cannot make, and we would rather say so than pretend: if a court, a regulator or another lawful order requires us to hand over data, we will comply. We will tell you when that happens, unless we are forbidden from telling you.

Every reminder is scheduled by the app on your phone. Our server sends no push notifications at all, and stores no device token for you.

A reminder has to say what it is reminding you about, so the notification's title is the habit's name, and its text is the affirmation you wrote for that habit, if you wrote one. Both appear on your lock screen. If a habit is something you would rather not have shown there, name it accordingly.

• No analytics. The app contains no analytics library of any kind, and no crash-reporting library either. The Microsoft sign-in component described above is the one piece of third-party code in it, and what it reports goes to Microsoft, not to us.
• No advertising. No ad identifier, no advertising SDK, and therefore no "allow tracking" prompt.
• No tracking. Not across apps, not across websites, not at all.
• We do not sell your data, and we do not share it with anyone to use for their own purposes. There are no partners. The only thing that can override this is a lawful order, as described above.
• No social layer. Your data is not visible to other people who use Khaki, including other White Rock employees.

• Signing in and syncing rest on your consent. Nothing is sent anywhere until you choose to sign in, and you can take that consent back whenever you like: signing out stops the syncing, and deleting your account withdraws the consent and removes what we hold. There is no separate form to fill in.
• Keeping the service running and secure is our legitimate interest. That is what covers the technical logs and the error reports described under "Security".
• Moods and journal entries are not ordinary data. A daily mood, and anything you write in the journal, can say something about your state of mind and your wellbeing. We treat them accordingly: they reach us only because you explicitly chose to sign in, they are never analysed, never used to profile you, never shown to anyone else, and they are gone from our side as soon as you delete your account.

If you never sign in, there is no processing on our side that would need a basis in the first place.

While your account exists, we keep your synced data. There is no automatic expiry and no inactivity purge — it stays until it is removed.

How deletion works is worth reading, because it is not what most people assume:

• When you delete something in the app — a habit, a journal entry, a mood — it disappears from your devices immediately. On our server the row is marked as deleted and stops being part of your data, but the row itself, including the text it held, stays in the database. We keep that marker so your other device learns about the deletion too.
• When you delete your account, everything goes, including those marked-deleted rows.

So the only way to remove something from our server completely is to delete your account.

If you leave White Rock, your Khaki account does not disappear along with your work account. It stops being reachable, which is not the same thing as being gone — and because sign-in is what puts the Delete account button on screen, you will no longer find that button in the app. You can still have the account erased; see "Your rights" for how to ask, and note that you do not have to be an employee to ask. We do not delete Khaki accounts automatically when a work account is closed — write to appsupport@white-rock.ae and we will delete yours for you.

A deleted row can survive for a short time in routine database backups until those expire on their own schedule; nothing restores it in the meantime.

Today screen → tap the greeting → Settings → Account → Delete account, then confirm.

The app asks the server to erase the account, and only once the server confirms does it wipe the local copy — including that small archive of replaced rows. It is irreversible.

What this deletes: every habit, goal, daily mark, mood, journal entry, prompt, tool and celebration record we hold for you, plus the account row itself with your email and name.

What it does not delete: your Microsoft work account. That belongs to your employer's directory, not to Khaki. If you sign in again later, you get a brand-new, empty Khaki account.

Signing out is different. It stops syncing and leaves your data where it is — on the phone and on the server. It does clear the Microsoft sign-in cache on the phone.

Resetting all data (Settings → Data → Reset all data) clears the phone. If you are signed in, those deletions travel to the server as well, and behave like any other deletion described above.

Where the law gives you these rights, we honour them — and we would rather honour them for everyone than argue about which of them reaches you.

• A copy of your data, in a form you can take elsewhere. There is no export button in the app yet. Write to appsupport@white-rock.ae and we will send you a machine-readable file: the same rows the app syncs, as JSON.
• Correction. Edit it in the app; the change syncs. Your work email and directory name come from your employer's Microsoft directory — to change those, ask your IT administrator, and Khaki will pick up the new values at your next sign-in.
• Deletion. Use Settings → Account → Delete account, or write to us and we will do it.
• Restriction. You can ask us to hold your data without using it while a question about it is open.
• Objection. You can object to the way we handle your data.
• Withdrawing your consent. Sign out to stop syncing; delete the account to withdraw consent altogether and remove what we hold. Withdrawing does not undo what was lawful before you withdrew.
• Complaint. Complain to us at appsupport@white-rock.ae, and complain about us to the data-protection authority where you live or work.

If you no longer have your work account. Once your White Rock directory account is closed, you cannot sign in, the Delete account button is no longer on screen, and your work mailbox is gone. Write to appsupport@white-rock.ae from any address that suits you, tell us the work email the account belonged to, and we will confirm through White Rock's IT or HR records that the request is yours before we erase it. We will not send you anything sensitive until we have.

We answer within 30 days.

• The connection between the app and our server is HTTPS.
• Sign-in uses your employer's standard corporate identity system. The app never handles your password, and does not keep the access token itself.
• Our server runs inside a private network, and the connection between our service and its database is encrypted.
• Server logs record ids, not content: an internal account id, the request path, the result. No journal text, no habit names, no email addresses. There are two exceptions — when a sign-in token fails verification we log the caller's IP address and a short fragment of the token, which is useless for signing in; and when an unexpected error occurs we log the error message itself, which in rare cases can quote part of what was sent.
• Error reports identify your account by an internal id only and are not meant to contain anything you wrote. In rare cases a malformed or failing request can carry a fragment of what was sent into an error report.
• There is no end-to-end encryption. Your data is stored as ordinary text in our database.
• Server logs are kept only as long as they are useful for finding and fixing faults, and are not used for anything else.

Khaki is not directed at children, and we do not knowingly collect data from them. Signing in is only possible with a corporate work account, which children do not have.

If we change how Khaki handles data, we will update this page and change the effective date at the top. Material changes will also be mentioned in the app's release notes. The changelog below records every version of this document.

appsupport@white-rock.ae White Rock LTD, Abu Dhabi, United Arab Emirates

This policy is governed by the laws of the United Arab Emirates, and disputes about it are subject to the courts of Abu Dhabi. Nothing here takes away a right you have under the mandatory consumer or data-protection law of the country you live in.

• 2026-09-21 — first version.