Your audio never leaves your device.
ARP is built around a single privacy claim: every byte of audio is processed on the device you imported it on. We don't have a server. We don't have an account system. The privacy manifest Apple reviews (PrivacyInfo.xcprivacy in both the iOS and Mac apps) declares NSPrivacyCollectedDataTypes: [] — the empty list, by design.
Summary
- Audio files stay on the device you imported them on. No upload, no sync, no cloud copy.
- RNNoise, the parametric EQ, and the export pipeline all run on-device. The Watch is a remote; no audio processing happens on the watch.
- No analytics, no telemetry, no third-party SDKs.
NSPrivacyTrackingisfalsein every target. - No account. No login. No email collection by ARP.
- Delete the app, the library is gone. That's the design.
1. What we collect
Nothing that leaves your device.
The iOS and macOS privacy manifests (App/PrivacyInfo.xcprivacy, ARPMac/PrivacyInfo.xcprivacy) both declare an empty NSPrivacyCollectedDataTypes array. The only "required-reason" APIs ARP accesses are the local filesystem (DiskSpace, reason E174.1) to manage your library and exports, and UserDefaults (reason CA92.1) to remember your settings. Both are local, on-device APIs Apple defines; neither transmits anything.
What this means concretely: ARP does not collect your name, email, contacts, location, photos, microphone input, camera input, calendar, health data, browsing history, advertising identifier, or anything else covered by Apple's privacy nutrition labels. It does not run analytics. There is no Firebase, Sentry, Mixpanel, Amplitude, or Crashlytics dependency in the source.
2. How your audio is handled
All audio processing — RNNoise AI noise reduction, the 10-band parametric EQ, the export to M4A / WAV / AIFF — runs locally on your iPhone, iPad, or Mac using Apple's AVFoundation and ARPCore frameworks. Your audio files are read from a location you choose (the Files app, iCloud Drive, or your Music Library), processed in-memory or in a sandboxed temp file inside ARP's container, and written back to a location you choose.
The original audio and the enhanced audio are stored in the iOS app's Documents directory or on your Mac. The macOS app's entitlements (ARPMac/ARP Mac.entitlements) only request the user-selected read-write file scope and read-only access to the Music library. There is no entitlement for an outbound network connection.
Import sources in the iOS app are: the Files app (including iCloud Drive), the system Music library, and any audio file shared into ARP from another app. ARP does not request microphone access; the iOS Info.plist has no NSMicrophoneUsageDescription key.
3. Preferences and library
Your in-app preferences are stored locally in UserDefaults, and your library in the app's sandbox. The settings stored include: default enhancement intensity, default EQ preset, the 10 EQ band values, your custom EQ presets, the crossfade duration, the sleep-timer setting, the floating-player setting, the keep-screen-on setting, and the purchased/premium flag.
Your library — the list of imported tracks, their enhanced versions, waveform data, and artwork — is persisted as a JSON file named library.json in the app's Application Support directory inside its sandbox. It is not shared with any other app, process, or service.
The Watch app shows a snapshot of what is currently playing on your iPhone, using an app-group shared container (group.com.arp.shared) and Apple's Watch Connectivity framework. The Watch reads the snapshot; it does not process audio.
4. Payments
ARP Premium is sold as a single non-consumable in-app purchase through Apple's App Store. The product ID is ARP.ARP.premium and it unlocks unlimited AI enhancements and 24-bit WAV / AIFF export. M4A export is free for everyone.
Apple handles payment processing. ARP receives the StoreKit transaction receipt — what you bought and when — but not your Apple ID, payment details, or billing address. Apple does not share those with developers. Refunds are handled entirely by Apple through the App Store; ARP cannot issue refunds directly.
The premium flag is stored in UserDefaults on the device that completed the purchase. Apple propagates the entitlement across devices you own through StoreKit's transaction observer; ARP doesn't run a server to do that.
5. Apple Watch
The Apple Watch app is a companion to the iOS app. It does not capture, process, or store audio. It uses the system Watch Connectivity framework to mirror the iPhone's "now playing" state and offers playback controls (play / pause / skip / scrub). The Watch app is a remote, in the same sense that a pair of AirPods is a remote.
Because the Watch is a remote, removing the iOS app or revoking its permissions will make the Watch app inert. The Live Activity (Lock Screen / Dynamic Island) is part of the iOS app; it is not a separate product.
6. Security
ARP runs inside Apple's standard iOS and macOS app sandbox. The iOS app's only entitlement is the app group needed for the Watch companion. The macOS app's entitlements are the user-selected read-write scope and read-only Music library access. Neither app declares an iCloud container, CloudKit, push notifications, background-fetch, or any network capability beyond the system frameworks Apple grants every app.
Because nothing is transmitted, there is no transport encryption to describe. The "support service" that older versions of this page mentioned does not exist. If you contact support by email, the transport is your mail client.
ARP does declare ITSAppUsesNonExemptEncryption: false in the iOS Info.plist — the app does not use any non-exempt encryption APIs, so you can ship to any region without an annual encryption registration.
7. Your rights
Access. Your library and preferences live in the app; open it to see them.
Delete. Deleting the ARP app from your device removes its sandbox and the app-group shared container. The library, settings, and enhanced files go with it. Originals in the Files app or your Music library are untouched.
Opt out of everything. The only network behaviour ARP has is what Apple's frameworks do on your behalf (StoreKit checking your entitlement, the system asking the App Store for the latest product metadata). You can disable that by turning off iOS / Mac network access in System Settings, but you'll lose the ability to restore purchases.
Children's data. ARP is not directed to children under 13. We do not knowingly collect data from children because we do not knowingly collect data from anyone.
8. Changes
If this policy changes materially — a new data flow, a new third-party SDK, a new destination server — we'll bump the date at the top of this page and, for substantial changes, surface a notice in the app. Editorial changes that don't change the actual data flows (clarifying language, fixing typos) won't be announced.
9. Contact
For any privacy question — including a request to confirm what is or isn't collected — email matthew.worner@me.com. We don't have a portal, a web form, or a support team; it's one person and one inbox.
ARP is operated by Matthew Worner in New Zealand. Support email is the only information we may hold about you (if you write in). That correspondence is handled under the Privacy Act 2020. Audio processing remains on-device and is not collected.