Privacy Policy
Effective date: September 7, 2026 · Last updated: September 24, 2026
The short version. Pillar reads head position from your AirPods and analyses it on your iPhone. Your posture data never leaves your device, there is no account, and there is no camera or photo of you anywhere in the product. We send product analytics about how the app is used (never a posture reading), Apple handles every payment, and our measurement partner Airbridge tells us which ad, if any, led to an install — using your advertising identifier only if you allow tracking. We never sell personal data.
This policy explains what Pillar (“Pillar”, “we”, “us”) does with data when you use the Pillar iPhone app. Pillar is developed and operated by Maksym Pustovit. You can reach us any time at glowdapp@gmail.com.
1. What we do not collect
- No user accounts. No name, email address, phone number or password is required or created.
- No camera and no photo library access. Pillar never asks for either, and there is no image of you anywhere in the product.
- No audio recording. The app plays sounds; it never listens.
- No raw motion data on our servers. The stream of head-angle readings is processed on your iPhone and is never transmitted.
- No GPS or precise location tracking.
- No advertising identifier unless you allow it. Pillar asks once, through Apple's App Tracking Transparency prompt; if you decline, the identifier is never read and nothing in the app changes. You can change your answer any time in Settings → Privacy & Security → Tracking. See section 5.
- No session recording or screen recording. Both are switched off in our analytics configuration.
- No Health app data. Pillar does not read from or write to Apple Health.
2. On-device processing
When you wear AirPods with motion sensors and start a session, Pillar receives head-orientation readings from iOS several times a second. All of the following happens locally on your iPhone:
- Head pitch (how far your head is tipped forward) is compared against the tall and slouched angles measured during your own calibration.
- The app decides when to nudge you, escalate, back off or stay quiet.
- Session score, tall time, nudges fired and nudges heeded are calculated and saved.
None of the underlying readings are uploaded, and neither are the scores and times calculated from them. What leaves the device is the usage analytics in section 4 and the attribution data in section 5 — never a posture reading.
3. What is stored on your device
- Session history — one record per session (start time, duration, score, tall and slumped time, nudge counts), in the app's local database.
- Your calibration — the tall, natural and slouched angles measured during setup.
- Your settings — sensitivity, sounds, quiet hours, Pomodoro lengths and so on.
- What you told the onboarding — your first name and your answers about desk hours, where the tension sits, age range and motivation. These are kept in local app storage so the app does not have to ask twice. They are not sent to us.
- A snapshot for the widgets and Live Activity — today's score and state, in a shared container that only Pillar and its own widget can read.
You can erase all of it from inside the app: You → Delete my data. Deleting the app removes it as well.
4. Analytics
We use PostHog to understand how the app is actually used, so we can fix what is broken and drop what nobody needs. Events are tied to a random identifier generated on your device, not to your name or any account. The same random identifier is used by RevenueCat (section 6) and Airbridge (section 5), so we can tell which ad a subscription came from. This is the complete list of what we send:
| Event | What it carries |
|---|---|
| App opened / became active / backgrounded | Nothing beyond the timestamp and the device properties below. |
| Onboarding and paywall | Which setup screen you reached, whether you skipped a step, the shape of your quiz answers (for example, how many options you picked) — never your name, the answers themselves or any measured angle — when the paywall was shown and which plan you chose. |
| Session started | Open-ended or Pomodoro, planned number of cycles, whether motion permission is granted. |
| Session ended | Duration in minutes, open-ended or Pomodoro, number of cycles, which session number it was for you, how the session was ended. No score and no posture measurement. |
| Session blocked | The reason a session could not start (for example, AirPods not connected). |
| Permission result | Whether Motion & Fitness and notifications were granted or denied. |
| Calibration completed | That you completed calibration. No angle, rounded or otherwise. |
| Streak milestone | The number of days reached. |
| Setting changed | Which setting, and its new value. |
| Device properties, attached to all of the above | Device model, iOS version, app version, locale and time zone, an anonymous app-install identifier, and your IP address — which PostHog uses to derive an approximate region and does not expose to us as a precise location. |
This website
The pages on pillar.glowd.tech send the same PostHog project three events, and
nothing else: site_page_viewed (which page, and the domain you arrived from — not
the full referring address), site_cta_clicked (which App Store button you pressed and
where on the page it sat) and site_faq_opened (which question you expanded). Your IP
address reaches PostHog with them, as it does with any web request.
The site sets no cookies and writes nothing to your browser's storage: web analytics here is kept in memory for the length of the page visit and then discarded, so you are not recognised on a later visit or followed to another site. That is also why there is no cookie banner to dismiss. If your browser sends a Do Not Track signal, nothing is sent at all. Session and screen recording are switched off.
We deliberately send no body angle and no posture score at all. A measurement of somebody's neck, even a rounded one, is the kind of data that should not be collected without a reason, and the questions we need answered do not require it.
PostHog's own privacy policy is at posthog.com/privacy.
5. Ad attribution
We pay for some ads, and we want to stop paying for the ones that do not work. To learn which ad, if any, led to an install, Pillar uses Airbridge (AB180 Inc.), a mobile measurement service. When the app is opened it sends Airbridge: that the app was installed or opened, three steps in the app (finishing setup, tapping a plan on the paywall, finishing a first session — never how it went), device model, iOS and app version, language and time zone, your IP address, and the random identifier from section 4. Airbridge compares this with clicks on our ads to estimate where installs come from.
- If you allow tracking in Apple's App Tracking Transparency prompt, Airbridge also receives your device's advertising identifier (IDFA) and the app's vendor identifier (IDFV), so the match with an ad click can be exact.
- If you decline, neither identifier is sent. Airbridge can then only estimate attribution statistically from the information above, and Apple's own privacy-preserving measurement (SKAdNetwork) reports installs to ad networks without any identifier.
Subscription events (trial started, subscribed, renewed, cancelled, and their amounts) reach Airbridge from RevenueCat (section 6). Airbridge receives no posture data, no name and no onboarding answers. Its privacy policy is at airbridge.io/privacy-policy. Apple Search Ads attribution works separately, through an Apple-issued token that identifies the ad, not you.
6. Purchases and subscriptions
If you subscribe, the payment is processed entirely by Apple through the App Store. We never receive or store your card number, billing address or Apple Account credentials.
We use RevenueCat to check whether a subscription is active. RevenueCat receives a randomly generated app user ID, your purchase receipts from Apple, your subscription status and, for Apple Search Ads, Apple's attribution token. If you allow tracking, it also receives your advertising and vendor identifiers and your IP address. It forwards subscription events to Airbridge (section 5). It receives no payment card details and no posture data. Its privacy policy is at revenuecat.com/privacy.
7. Notifications
If you allow notifications, Pillar can post a nudge as a local notification when it cannot reach you any other way. These are composed and scheduled on your device — there is no push server, and no device token is sent to us. You can revoke the permission at any time in Settings → Pillar → Notifications.
8. Third parties we rely on
| Service | Purpose | What it receives |
|---|---|---|
| Apple (App Store, iOS) | Distribution, payments, motion sensor access, notifications | Apple handles all payment data. Head-orientation readings are provided by iOS to the app on your device. |
| PostHog | Product and website analytics | See section 4. |
| Airbridge (AB180 Inc.) | Ad attribution | See section 5. |
| RevenueCat | Subscription status; forwards subscription events to Airbridge | See section 6. |
None of them receive your raw motion data, your name or your onboarding answers.
9. Retention
Data on your device stays until you delete it, in the app or by removing the app. Analytics events are retained according to PostHog's standard retention policy, and attribution data according to Airbridge's. Subscription records are retained by Apple and RevenueCat according to their own policies and applicable tax rules.
10. International transfers
All posture analysis happens on your device. The analytics events in section 4, the attribution data in section 5 and subscription records may be transferred to and stored on servers operated by PostHog, Airbridge and RevenueCat, including outside your country (for example in the United States or South Korea), under those providers' own terms and safeguards.
11. Your rights
Because Pillar has no accounts, we generally cannot connect any data to a named individual, which limits what we can look up on request. What you can do:
- Erase everything we hold on your device — You → Delete my data, or delete the app.
- Ask us about the analytics — write to glowdapp@gmail.com. If you can give us the anonymous identifier from your install, we will delete the matching events.
- Revoke any permission — Motion & Fitness, notifications and Live Activities are all controlled in Settings → Pillar; tracking in Settings → Privacy & Security → Tracking.
If you are in the European Economic Area or the United Kingdom, you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR. Our lawful basis for the analytics in section 4 is legitimate interest in maintaining and improving the app; for ad attribution with your advertising identifier, your consent given in the tracking prompt; for ad attribution without it, legitimate interest in knowing which of our ads work; for processing your purchase, performance of a contract. If you are in California, we confirm that we do not sell personal information as that term is defined by the CCPA/CPRA, and we do not offer financial incentives for personal information.
12. Children
Pillar is not directed at children under 13, and we do not knowingly collect data from them. The onboarding asks for an age range only to phrase its own copy; that answer stays on your device.
13. Security
Everything the app stores lives in your iPhone's own protected app container, covered by iOS device encryption. Data in transit to PostHog, Airbridge and RevenueCat is encrypted with TLS. No system is perfect, and we cannot guarantee absolute security.
14. Changes to this policy
If we make material changes, we will update the “Last updated” date above and, where practicable, say so in the app. Continuing to use Pillar after a change takes effect means you accept the updated policy.
15. Contact
Questions about this policy or about your data: glowdapp@gmail.com. We answer in English or Ukrainian.