What AmGood knows about you, and what it never will.
The short version: for each day that is already over, we store whether your phone showed any activity. Yes or no. The people you connect with see that, if you let them, and you see the same about them, if they let you.
Last updated November 2, 2026
We store the name, photo and short note you choose to give us.
For each day, we store whether your phone showed activity, yes or no, and share that with the people you connect with, after the day is over.
What never leaves your phone
- Never where you are. AmGood does not ask for your location.
- Never when you're on your phone. No times of phone use are recorded or sent. (A few things you do by hand, like pausing, are noted with their time for up to three days, so your people can be told once. See "Everything we store".)
- Never anything about today, to the people you're connected with. Your phone may send today's yes early, so the 6:00 decision is reliable, but nobody sees it until the day is over. The one exception: a "No activity" line turns back to "All good" the moment your phone reports in, today's activity included.
- Never your step count. AmGood reads it on your phone to decide yes or no. The number itself is not sent anywhere.
- Never your contacts, messages, photos (other than a portrait you pick or take), or which apps you use.
How "activity" is worked out
On iPhone, AmGood reads your step count from Apple Health and your phone's motion history. On Android, it reads your step count from Health Connect and from Google Play services on your phone. A day runs from 6:00 in the morning to 6:00 the next morning. Once a day has more than a few dozen steps, or you open AmGood, or you tap the "All good" reminder, that day counts as a yes. Your phone does this working-out, and sends the yes as soon as it has one; then it stops checking until the next day. Our servers only ever receive the list of days that were a yes. And if you opened AmGood on a given day, that alone counts: the app doesn't read your steps for that day at all.
Health and fitness data is used for this one purpose. It is never used for advertising, never sold, and never shared with anyone.
Everything we store
| Your account | An identifier from Sign in with Apple or Google, and the email address they pass along. Apple lets you hide your real address; if you do, we only ever see the relay address. |
|---|---|
| Your name | The name you choose to show. You can change it at any time. |
| Your portrait | Optional. Only you and the people you're connected with can load it. |
| Your note | Optional. One short line you can write for the people you're connected with, like "Camping till Sunday". We don't record when you wrote it, and nobody is notified when you change it. |
| Active days | One entry for each day that had activity. No time, no count, no place. Kept for 90 days, then deleted, except your most recent active day, which is kept so a long silence still shows as a count. Like any web service, our hosting keeps short-lived request and sign-in logs (network address and time), which we delete after seven days; nobody you're connected with can see them. |
| Each day's decision | Whether your activity was in by 6:00 or arrived late. Kept 90 days, so we can see how often the app was wrong. |
| Your home time zone | Set once when you join, so your daily update happens at 6:00 in the morning where you live. It does not follow your phone when you travel. Your phone does tell us its current time zone with each report, so we know which day it means; we don't keep it. The people you connect with can work out your home time zone from your update time. |
| Pause and the morning summary | Whether you're paused, and when you paused (kept three days, so your people can be told once). Whether you've turned on the morning summary, and when your last one went out. |
| Your notifications' text | The text of notifications sent to you, which names your people and their status lines. Kept seven days. |
| Codes | Codes you create (seven days), and a count of wrong codes entered from your account (one day), so codes can't be guessed. |
| A Sign in with Apple token | So we can revoke your Sign in with Apple authorisation when you delete your account. |
| Your connections | Who you've paired with, and the private nickname you give each of them. |
| A widget key | If you use AmGood's widgets: a random, read-only key that lets them show the same summary the app does, without holding your sign-in. Removed when you sign out. |
| Your phone's push token | So we can deliver notifications. Removed when you sign out. |
On your phone only: the app keeps its own log of recent step counts and wake-ups for three weeks, to work days out and to help with support. A hidden diagnostics screen can export it; it leaves your phone only if you share it.
Who sees what
Only people you pair with, using a six-digit code one of you gives the other. They see your name, your portrait, your note if you've written one, and one line: "All good", or "No activity for 2 days". It describes yesterday, never today, and it changes once a day at a fixed time, 6:00 in the morning where you live. There is one exception: if you've been showing "No activity", it switches back to "All good" as soon as your phone reports in, today's activity included, because ending a worry quickly matters more. That is the only time the line moves at another hour.
You choose, person by person. Sharing starts on in both directions, and either of you can switch your own off for the other at any time. If you do, they see "Sharing off", so it reads as your choice and never as something being wrong, and nothing else about you reaches them. You can always see who has switched theirs off for you. The app shows you exactly what others see about you, word for word.
You can pause at any time without giving a reason, and you can disconnect from anyone.
Who helps us run it
- Supabase hosts the database and sign-in, in the United States (Virginia).
- Cloudflare carries the app's connection to that database (api.amgood.app), so it works reliably in more countries. It passes requests through and doesn't keep their contents.
- Apple and Google deliver push notifications and handle sign-in.
- AmGood's maker, JP AI LAB LLC, can see the database as any operator can. Nobody looks at it except to fix a problem, or when you ask us to.
No advertising networks. No analytics companies. No data brokers. We don't sell data and we don't share it for anyone's marketing.
Deleting everything
In the app: the Settings tab, then Delete account. Your account, name, portrait, note, active days, connections, push token and sign-in logs are deleted straight away, and your Sign in with Apple authorisation is revoked. People you were connected with simply stop seeing you. Notifications already sent to them keep their text for up to seven days.
Not an emergency service
AmGood tells you that a day which is already over was fine. It can be a day or two behind by design. It does not detect emergencies and must not be relied on for anyone's safety.
Children
AmGood is not for children under 13, and we do not knowingly collect information from them.
Changes and questions
If this policy changes in a way that matters, the app will tell you before it takes effect. Questions, or a request for a copy of your data: [email protected].