Privacy policy

Last updated 1 November 2026

This policy explains what information Mantle (“Mantle”, “we”, “us”), operated by TwelveSuite UG (haftungsbeschränkt), Reinshagener Str. 40, 42857 Remscheid, Germany, handles when you use the Mantle app for iPhone and iPad, its server and this website (the “Service”).

1. How Mantle works

Your phone is the system of record. The app’s database on your phone is the only readable store of widget content.

The company is the controller for account data: your username, passkey credential, sessions, device registration, OAuth clients and connection graph.

For widget content, it acts as a processor-like intermediary: it carries that content encrypted and never stores it readable. The same holds for the encrypted backup: the company stores it and cannot read it. Mantle is a processor for data in transit, not a bystander.

Mantle connects to none of your mail, calendar, bank, files or health accounts. An AI client you connect sends Mantle only what it chose to display, using connectors you gave it yourself.

2. What the server stores

Your account id and username.
Passkey credentials and sessions.
OAuth clients and tokens, with tokens hashed.
One registered device per account, with its push token, device public key and key fingerprint, timezone, language, device type, platform, Apple Pencil flag, Health availability and last seen time.
Pending items for your phone, as ciphertext, with sequence numbers.
One encrypted backup per account, if you keep the feature on: the sealed copy your phone sends, up to 25 MB, its version and the time it was saved. The key is created on your phone and never sent to the server, which cannot open the backup. Each new backup replaces the last; it is deleted when you delete it in the app and deleted with your account.
For each widget: its id, owner, type, creating client, version and timestamps, one bit saying whether it is Health-sourced or a photo widget, and the hash of a key if your AI set one.
Dashboard records: ids, owner and membership.
Share membership, invites and offers, and your connections with other users. A live invite includes a snapshot of the shared widget, as ciphertext, under a key the server never receives. It expires with the invite.
Delivery metadata: ids, sequence numbers, timestamps, acknowledgement state and error codes.

The server stores no readable widget titles or content, no Health numbers and no keys to any shared snapshot or encrypted backup.

IP addresses. The server stores an IP address in two places: with a sign-in session, along with the country and a truncated user agent, and in per-IP rate-limit counters.

Logs. The request log records a timestamp, a request id, the method and path, the status, the latency, and the account id for signed-in calls. It records no IP address and no user agent. A visited connection link contains the username in its path, so that username appears in the request log. Widget, dashboard and invite links carry random ids only. Error lines carry a reason code. An IP address appears in one log line only when a rate limit is exceeded.

3. Content in transit

Content reaches the server over TLS. It is plaintext in the server’s memory while being validated, then encrypted to your device’s key with HPKE (RFC 9180: P-256, HKDF-SHA256, AES-256-GCM) and stored as ciphertext until your phone acknowledges it, or for at most 30 days. When your AI reads a widget, the answer passes through memory and is never stored. Content is never written to logs.

Push notifications from the server carry ids and a generic body, never titles or content. Reminders are local to your phone and can show a widget’s title.

4. Things outside our control

iCloud device backup. The app’s database and device key are included in your iCloud device backup by default, in a form Apple can read unless you enable Advanced Data Protection. Photo images are excluded from this backup.
iCloud Keychain. The key to your encrypted backup is in your iCloud Keychain, which Apple syncs between your devices under Apple’s terms. Your recovery phrase is the other copy; keep it where only you can read it.
Home Screen widgets. iOS keeps rendered snapshots of Home Screen widgets in system storage outside the app.
Invite links. The key in a sharing link’s fragment stays in the browser history of whoever opened that link in a browser.

5. Apple Health

If you or your AI ask for a Health-sourced widget, the iPhone reads the numbers itself, with your permission per metric. They stay in the phone’s database, are excluded from iCloud backup and your encrypted backup, and are read again after a restore. They leave the phone only when your own AI client reads the widget, passing through the server’s memory like any read. The server never stores them. Health-sourced widgets cannot be shared.

6. Microphone, speech recognition and camera

Permissions. Mantle asks for the microphone and speech recognition only for a voice widget. It asks for the camera to scan connection codes and for a photo widget. Scanning reads the code and stores no image. iOS asks you first, and you can turn each off in iOS Settings.

Voice. Your speech is transcribed on your device, using only on-device recognition. If that isn’t available for your language, nothing is recorded. The audio is deleted after transcription, is not stored and does not leave your device. You can edit or delete the text before it is saved. A widget keeps up to 50 notes. The saved text is widget content: it is in your iCloud device backup, your own AI client receives it when it reads the widget, and members see it if you share the widget.

Photos. A photo widget takes pictures with the camera only and has no access to your photo library. Metadata is removed and the picture is reduced in size before it is saved on your device. A widget keeps up to 20 photos. Images are excluded from iCloud device backup and from the JSON export, are not synced, and cannot be shared. They are included in your encrypted backup when attachments are included. If the widget is set to return images, your own AI client receives the newest photo when it reads the widget. It passes through the server’s memory like any read and is never stored on the server. Captions, sizes and times are widget content: they are in your iCloud device backup and in the export, and your AI client can read them.

Sound clips. Your AI can attach a sound clip to a deck card or a list item, inline or as a link. An inline clip is widget content and travels sealed to your phone. A linked clip is fetched once by your phone from that link; the server never fetches it and stores only the link as part of the sealed widget. The host of that link sees your phone’s address when it is fetched, as with any download. Clips are kept on your phone, up to 1 MB each and 10 MB per widget, shown in Storage, and included in your encrypted backup when attachments are included.

Your AI provider. What your AI client does with text or photos it receives is governed by your AI provider’s terms and privacy policy.

7. Location

Place reminders. If you or your AI set a reminder for a place, the iPhone monitors that place itself with the system’s region monitoring, which is why it asks for location access even when the app is closed. The place name and coordinates are widget content on your phone. No location ever leaves your phone and the server never receives one; the reminder fires locally.

8. Sign-in and connected AI clients

Sign-in uses passkeys only. There is no password and no email sign-up. AI clients connect with OAuth 2.1, and each one is listed in Settings, where you can revoke it.

9. What your AI client and other people see

A connected AI client receives widget content when it reads a widget, pictures of your widgets when it asks for one, and your timezone and local time, language, device type, Apple Pencil flag, Health availability, when your device was last seen, and how many widgets and dashboards you have. What it then does with them is governed by your AI provider’s terms and privacy policy.

If you share a widget or dashboard live, its members see its content on their phones, and each copy is encrypted to that phone’s key. An image or file you share through the system share sheet leaves your phone by your own action and does not pass through the server.

10. How we use information

We use this information to provide the Service, deliver content to your devices, keep the Service secure, respond to you and meet legal obligations. Install attribution data from AppsFlyer is used only to see which campaigns bring installs. We do not sell your personal information.

The legal basis for account data is performance of the contract, GDPR article 6(1)(b).

Install attribution rests on our legitimate interest in measuring campaigns. The SDK stores a small identifier on the device for this purpose.

11. Service providers

We share information only as needed with providers that operate the Service or measure its installs: a Hetzner Cloud cluster in Germany (server hosting), Cloudflare (DNS, CDN, the tunnel to the server, and hosting this website), Apple (push notifications and the App Store) and AppsFlyer (install attribution). Cloudflare sees every request’s IP address as the network in front of the server and keeps its own logs under its plan. The server receives the client IP address from Cloudflare for the two uses in section 2. We also share it with authorities where required by law, or with a successor in a merger, acquisition or asset sale.

The iOS app includes the AppsFlyer SDK, in its variant without advertising identifiers, to measure which installs came from which campaign. It sends AppsFlyer the install and app-open events with app version, system version, device model, time zone, Apple’s vendor identifier for this app and IP address, which AppsFlyer masks. AppsFlyer also receives Apple’s attribution postbacks on our behalf. AppsFlyer never receives your account, your username, any widget content or any in-app events, and the SDK does not track you across other apps or websites.

12. This website

This website sets no cookies and has no analytics, advertising or third-party scripts.

13. Retention

Deleting your account in the app removes the server’s records at once: your account, passkey credentials, sessions, OAuth grants and tokens, device registration, pending items, your encrypted backup, widget ids, dashboards, share membership, invites and offers, connections and delivery records. It also erases the widgets on your iPhone and cannot be undone. OAuth client records (client id, redirect addresses and client name) are not tied to an account and are cleaned up separately. A nightly database dump is kept off the server: daily copies for at most 14 days and a weekly copy for at most 40 days. It holds the same records as the server, including a sealed backup that is unreadable without your key, and a deleted account leaves the dumps as they expire.

Pending items are deleted when your phone acknowledges them, or after 30 days if it never does.
Read answers are never stored.
Sign-in sessions, with their IP address, are deleted when a session lapses after 30 days without use, one day after you revoke it, or when you delete your account.
Rate-limit counters expire within 24 hours.
Logs are rotated on the order of days, not months. If we add a log store, its retention will be stated here.
Attribution data at AppsFlyer is kept under AppsFlyer’s retention for our account; we keep no copy.

You can export every widget as one JSON file from Settings. A widget you delete stays in the Trash on your phone for 30 days. See Delete your account and data.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal data, and to object or withdraw consent. To exercise these rights, contact us: [email protected]. If you are in the EU or EEA, these rights arise under the GDPR, and you may lodge a complaint with your competent supervisory authority. For us, that is the data-protection authority of North Rhine-Westphalia, Germany.

15. International transfers

We may process and store information in countries other than yours. Where required, we use appropriate safeguards for such transfers.

16. Children

Mantle is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will remove it.

17. Changes

We may update this policy. We will change the date above and, for material changes, give additional notice in the app.

18. Contact

[email protected]. You can also write to the address in our Imprint.