Last updated 18 October 2026
Sundry is local by default. You can use it without an account, export your information whenever you like, and optionally turn on end-to-end encrypted Backup & Sync. This policy explains what stays on your iPhone; what leaves it only when you choose a connected feature; and the controls available to you.
Everything you enter about your medications is stored in the app's private storage on your device:
If you do not create a Backup & Sync account, these details are not uploaded to Sundry or Supabase. Sundry contains no advertising, does not sell data, and does not read or write Apple Health. Sundry does not include its own general-purpose analytics tracker.
Deleting the app removes its local database. A normal encrypted Apple device or iCloud backup may include the iOS app data according to the backup settings you control with Apple.
On iOS, Sundry also keeps a small set of Apple's on-device crash and performance reports in the app's private storage — at most five at a time, for 30 days, and excluded from device backups. Crash and performance diagnostics stay on this iPhone; nothing is sent unless you share the report yourself. Sundry keeps only Apple's technical crash data — stack traces, exception types and version numbers — and removes any message text before storing a report, so it contains none of your medication records. On iPhone Duo, the report also includes screen layout measurements, such as the screen size, the hinge position and how many columns the Organizer shows. A report also names your iPhone model, iOS version and region format. To send one, use Settings → How Sundry handles data → Share diagnostic report to open the share sheet.
Home and Current time zones can always be chosen by searching for a city or time-zone name. If you instead tap Use My Current Location, Sundry asks the operating system for location access at that moment and uses the platform's mapping or geocoding service to turn the one-time location fix into a city and time zone. Sundry keeps only the resulting city label and IANA time-zone identifier in ordinary app preferences. It does not keep latitude or longitude, does not continuously track location, and does not send coordinates to Sundry, Supabase, Netlify, or OpenAI. Apple may process the lookup under its own privacy terms. Denying location access does not block manual city and time-zone search or any medication feature.
If you choose to create a Backup & Sync account, Sundry uses Sign in with Apple. Apple authenticates your account and gives Supabase a short-lived identity token to verify. Supabase keeps the encrypted copy available to your other authorized devices in its U.S. East region.
The identity provider may share your email address, provider account identifier, and the profile name you approve. Apple may instead provide a private relay address and normally supplies a chosen name only on first authorization. Sundry stores any non-empty name in Supabase account metadata. No medication contents are sent to Apple as part of sign-in.
Medication contents are encrypted on your device before upload. Sundry uses AES-GCM with a random vault key. Supabase receives ciphertext, not readable medication names, strengths, notes, schedules, counts, time zones, refill information, or reminder-response history. Row-level security separately limits every vault and record to the signed-in account. Optional authenticator-app verification adds a second sign-in factor.
Saved reminder-response events are included in encrypted sync. The iOS reminder-occurrence history used to identify a due reminder with no saved response is device-local and is not uploaded through Backup & Sync. As a result, the Unknown total can differ between devices.
Supabase can still see and process the information needed to provide the account and sync service:
On iOS, the vault key is kept in Apple's Keychain and Sundry first marks it for end-to-end encrypted iCloud Keychain synchronization. When iCloud Passwords & Keychain is available, a new Apple device normally restores and verifies the key automatically after sign-in; Sundry retries before presenting recovery choices. If a synchronized write is unavailable, Sundry retains a device-only Keychain copy and clearly identifies that limitation in Settings.
Sundry offers a separate Recovery Kit as an optional independent backup, not a condition of everyday sync. Revealing it requires device-owner authentication such as Face ID, Touch ID, Optic ID, or the device credential. The Recovery Kit is not sent to Supabase in readable form and cannot be reset or looked up by Sundry. A copy from the app is marked local-only and expires from the clipboard after ten minutes.
You can instead approve a new supported device from another signed-in Sundry device. The existing device scans a one-time QR code that carries the new device's request identifier and ephemeral public key directly between the screens; this prevents the relay from substituting a different public key. A displayed six-digit code helps you confirm the two screens match but is not an encryption key. After device-owner authentication on the existing device, the devices use ephemeral key agreement to create a one-time encrypted vault-key package. Supabase relays that ciphertext but lacks the private keys needed to open it. A request stops working after 15 minutes. Sundry attempts to delete it after approval or cancellation; expired relay metadata is also deleted during later approval activity or when the cloud account is deleted. Losing access to every already-authorized device and the optional Recovery Kit can make the encrypted cloud copy permanently unreadable.
Sync is local-first: signing out or deleting the cloud account does not delete medications already stored on that device. Deleting an individual synced medication leaves an encrypted deletion marker containing an opaque ID and timestamps so an old device cannot restore it, and removes its encrypted response-event rows. Deleting the cloud account removes the account, vault, encrypted medication and response-event records, and those markers from the live database. An Apple-linked account requires fresh Apple confirmation and revocation; use the iOS app or the account-deletion request page. Supabase's managed backups may retain an earlier encrypted database state for its documented backup window; because medication fields and deletion markers are ciphertext, Supabase still does not have the key needed to read them.
The Sundry Android edition was discontinued and withdrawn from Google Play on 18 October 2026. An Android install already on a device keeps working offline with the information stored on it, but Continue with Google sign-in and Backup & Sync are no longer supported there and are being switched off. An installed copy may still use Android's own encrypted backup and the platform geocoding service as described in earlier versions of this policy. If you used a Google-linked Sundry account, its encrypted records stay in Supabase until deleted; email joshua.w.lyons@outlook.com to ask for that account and its encrypted data to be deleted.
Dose reminders, follow-ups, and snoozes are scheduled locally with the notification and alarm systems on your device. Sundry does not send medication names or reminder responses to a push-notification server. Reminder titles use a partially masked medication name, and response actions require device unlock. Apple controls final delivery, lock-screen display, notification permissions, Focus or Do Not Disturb modes, battery restrictions, and background execution.
Each medication can use Off, Gentle, or Persistent reminders. Gentle schedules one standard local notification. Persistent schedules follow-ups until the dose is explicitly answered, snoozed, skipped, or stopped. On iOS 26 and later it can also use an authorized alarm-style alert. A normal notification swipe does not count as a response. No mobile operating system can guarantee delivery in every condition.
Settings can create a portable JSON export containing your full, unmasked medication data, response history, and on iOS the device-local reminder occurrence dates and time zones used to explain Unknown. The file is created on your device and goes only to the destination you choose in the system share or save chooser. It is not encrypted by Sundry after export, so store or share it only somewhere you trust.
Sundry has three optional features that use a photo:
When you use any of them, that single image is sent over an encrypted connection to Sundry's service hosted by Netlify, which passes it to OpenAI using priority processing. The answer comes back to your phone. Sundry's function does not save the image or include medication records, your account email, or a persistent user/device identifier in the AI request. Netlify and OpenAI necessarily process ordinary network metadata such as an IP address and request time to operate and protect their services.
Each OpenAI Responses API request is marked store: false. OpenAI states that API inputs are not used to train its models by default. Under OpenAI's default API data controls, abuse-monitoring logs may contain customer content and be retained for up to 30 days, unless law requires longer retention.
Please note that a photo of a pharmacy label often shows your name, your pharmacy, and your prescriber. That information is part of the image you choose to send. You can cover anything you would rather not send, or skip these features entirely and type the details in yourself.
Sundry asks for your explicit permission before the first photo, and explains what will be sent. There are two permissions: one covers counting with the camera and setting a medication's appearance from a photo, and the other covers filling in a medication from a label. Each time you set an appearance from a photo, the app also reminds you that the photo goes to OpenAI. You can decline and still use every other part of the app.
You can withdraw either permission at any time in Settings → Photo features inside the app. Turning it off means no image will be sent again unless you choose to turn it back on.
Supabase provides optional account infrastructure and encrypted sync; Netlify hosts the optional photo-processing functions; OpenAI analyzes only the photos you choose to send; and Apple provides Sign in with Apple, Keychain, optional iCloud services, notifications, alarms, system sharing, location and geocoding. These providers process data under their own terms and privacy commitments. Sundry does not sell personal information or share it for advertising, marketing, or profiling.
Sundry is an organization, supply-projection, and reminder tool. It is not a medical device, does not diagnose or treat any condition, and does not provide medical advice. Counts, projections, AI photo results, sync, and reminders can be wrong, delayed, or unavailable. Always check medication details and photo suggestions yourself, follow the label and the directions from your licensed healthcare professional, and speak with your doctor or pharmacist before changing how you take, refill, or stop a medication. If you think you may be experiencing a medical emergency, contact local emergency services.
Sundry is not directed at children and does not knowingly collect information from them.
If this policy changes, the date at the top of the page changes with it. If Sundry ever begins sending something new off your device, it will say so in the app before it does.
Questions about privacy in Sundry can go to joshua.w.lyons@outlook.com.