Privacy Policy

This page is the version 1.0 privacy policy. The current policy is version 1.1.

Effective 31 October 2026

Principal Seat is built to keep your career and your business private. This page explains, in plain language, what the app and this website do with your information. The publisher is Principal Seat. Contact: [email protected].

The short version

The app keeps your data on your device and in your own iCloud. Nothing leaves your device unless you export or share it, or turn on calendar sync, sun times or the drone checklist, Notify another app or service (including its state snapshot), or Get updates from a web address, which only requests the address you set and sends none of your data. The optional Apple Intelligence features run on your device only. We do not receive the roles, recruiters, people, companies, clients, quotes, invoices, shoots, notes or other content you enter. Emails you send to us are used only to reply to you. This website no longer has a waitlist. If you joined the earlier waitlist, we keep only your email address, the level you chose if you chose one, and the date you joined, only as long as needed to tell you the app is on the App Store or to delete the entry when you ask.

Where your data lives

Your data is stored on your device. When iCloud sync is turned on, it is also stored in your own iCloud account using Apple's CloudKit, and it syncs across your own devices the same way. Apple protects it in transit and on its servers. If sync is off, your data stays only on that device. Your iCloud data is governed by your Apple Account and Apple's terms. We have no access to it.

Your current role, role tracker and check-ins

My current role, your target roles, your wish list, your role tracker expectations, your offer details and your post decision check-ins are stored on your device and, with sync on, in your own private iCloud account, like everything else you enter. We have no access to them. Require Face ID (or Touch ID, or your passcode) can lock compensation screens, and the prices and fees in Business, on your device. It is on unless you turn it off. It is free. Lock again sets when it locks after you leave the app: Immediately, after 1 minute, after 5 minutes, or Never, which keeps it open until you quit the app or tap Lock now. Choosing a longer time, or turning the lock off, asks for Face ID or Touch ID first, and compensation is always locked when the app starts. The lock needs a device passcode. If your device has none, these screens cannot be locked until you set one. Face ID or Touch ID is handled by Apple on your device; the app never sees your face data.

Inbox and attachments

When you share or paste an email, PDF or text file into the Inbox, the app reads it on your device to suggest an opportunity. It is stored with the rest of your data and is not sent to us.

Prompts and exports

Apart from the optional features described below, the app does no scanning of the web or of your accounts. When you copy or export a prompt, it goes only where you paste it: an advisor you choose, or your own AI assistant, like ChatGPT, Gemini, Claude or Grok. Nothing is sent to us, and the app does not send anything to an AI service by itself. Send to AI assistant builds a text you share or copy yourself, with up to three parts: the setup instructions, your current state, and the items you select. The current state holds your opportunities with their ids, stages, next steps and follow-up dates, timeline summaries, call prep, commitments, your seats, and people's names and roles, and, if you use Business, your quotes, invoices, contracts and shoots without their amounts (see Business, clients and shoots). It never includes pay or notes. Contact details (email, phone, LinkedIn and website) and shoot addresses are added only if you turn on Include contact details, which is off by default. Pay figures in the items you select, and in Export for AI or advisor, are left out until you turn on Include compensation, which is off until you turn it on. Export my data builds a zip on your device, and it leaves only where you send it. Compensation is left out unless you switch it on. The switch covers the compensation fields. Attached documents, saved emails, notes and transcripts are exported as they are, so check them if they mention pay.

Apple Intelligence (optional, Premium)

Three optional features use Apple Intelligence: a follow-up email draft, the weekly summary and a transcript summary. Each one is off until you turn it on. They run on your device only, using Apple's on-device model, and make no network request. Nothing is sent to us or to any AI service. Before any text reaches the model, the app removes pay, equity, immigration, family and home address details, email addresses, phone numbers and lines you marked private. The email draft and the weekly summary never use your notes, overviews, pay, documents or contact details. A transcript summary uses only the one transcript you pick, after those removals. They need a device that supports Apple Intelligence, with Apple Intelligence turned on.

Automatic updates from your AI assistant (optional)

Two-way link with my AI assistant is off by default. When you turn it on, Principal Seat imports update files that you or your own assistant save to iCloud Drive, in the folder Principal Seat, Imports, and accepts updates from the Principal Seat actions in the Shortcuts app. Files are read on your device. You review and confirm them before records change. A backup is saved first, every time. Each file then moves to Imports, Done, or to Imports, Failed with a short note that says why. That folder is in your own iCloud Drive, and we have no access to it. Automatic updates never delete an opportunity or a person, and you can undo the last import. The app never sends anything to the assistant. When it is on, you choose what your assistant can see: Share all, Include contact details, Include addresses, and Include pay, rates and prices. All are off by default. Company figures like revenue or budgets are always included. Every change shows in Recent imports, where you can view or undo it.

Sun times and the drone checklist (optional)

Show sun times is off by default. With Show sun times on, the shoot's address is sent to Apple to find where it is. Turn sun times off for a shoot and its address is not looked up. Sun times are worked out on your device. The position found is kept with the shoot, so the address is not looked up again until it changes. It is not included in Export my data and is never sent to your AI assistant. Opening the drone checklist also sends the address to Apple to find the country, each time you open it, and no position is saved. For some countries the official drone map link opens at the shoot's position, so that map site receives it only when you tap the link. Demo mode never looks up an address. Apple handles these lookups under its own privacy policy.

Opening an address in Maps. When you tap Open in Maps on a person's address, Principal Seat hands that address to Apple Maps. Nothing is sent until you tap, and Apple Maps handles the address under Apple's own privacy policy.

Business, clients and shoots

Clients, quotes, invoices, contracts and shoots are stored like the rest of your data, on your device and in your own iCloud. With Require Face ID or Touch ID on, quote and invoice amounts, line items, deposits and payment links stay hidden until you unlock. Bank details are hidden on screen until you unlock, and print only on invoices. A quote, invoice or contract PDF is not made while the app is locked. Parking, team, gear, kit lists and call sheets are never sent to your AI assistant or in snapshots. The current state in Send to AI assistant, and Get current state for AI, include your shoots (title, client, dates, location, country, call time and shot list) and your quotes, invoices and contracts (number, title, status, dates and line titles), never their prices, totals, deposits or payment links. Shoot addresses and gallery links are added only with Include contact details on, and a shoot's position is never sent. Client and contact postal addresses are never sent. Export my data puts your Business records in a Business folder, with amounts, payment links and terms left out unless you switch compensation on. Principal Seat does not process payments.

Deleting your data

The app has no Principal Seat server, so there is no copy of your app data for us to delete. Your data is on your devices and in your own iCloud. To delete it: first, delete the opportunities and people you no longer want in the app. A deletion syncs to your other devices. Second, to remove the iCloud copy, open Settings, your name, iCloud, then Manage Account Storage (or Manage Storage), choose Principal Seat if it is listed, and delete its data. Deleting the app alone does not delete your iCloud data. Third, delete backup files: automatic and Back up now files are in the Files app, On My iPhone (or On My iPad), Principal Seat, Backups, and any copy you saved elsewhere stays there until you delete it. Exports and prompts you shared, events the app added to your calendar, and events and snapshots already sent to your own webhook address are held by those places and must be deleted there. Import files in iCloud Drive, Principal Seat, Imports (and its Done and Failed folders) stay until you delete them. Deleting data is separate from cancelling a subscription, which you do in your Apple Account settings.

Analytics and ads

The app contains no analytics, no advertising and no third-party trackers.

This website

This website is a set of static pages hosted on Cloudflare. It has no accounts, no analytics, no advertising and no trackers, and we do not set cookies of our own. Cloudflare may add a small script of its own that hides email addresses on the page from spam bots. We do not add any third party scripts. Like any host, Cloudflare may process standard technical request data, such as your IP address, to deliver the pages and protect the site. The website no longer includes a waitlist form. Earlier waitlist entries, if any, are described below.

Earlier waitlist

The website no longer collects waitlist signups. If you joined before the app was on the App Store, we stored your email address, the level you chose if you chose one, and the date you joined. That is all. We do not store your IP address or browser details with it, and the form set no cookies. We use a remaining entry only to tell you the app is on the App Store. It is kept in Cloudflare storage under our own Cloudflare account, the same host that serves this website. It is not sent to a mailing list service or any other third party, and we never sell or share it. We keep it only as long as needed for that purpose. To be removed and have your entry deleted, email [email protected] or reply to any email we send you.

Email you send us

If you email us, we receive your email address and whatever you write. We use it only to reply to you. We do not sell it, share it for advertising or add you to any other list. We keep these emails only as long as needed to reply. To have your emails deleted, write to [email protected]. If you previously asked to be told when the app launched, ask and we will delete that request too.

Purchases

Premium and Premium Portfolio subscriptions and the six month pass are bought through Apple. Apple handles payment and billing and does not give us your card details. We may learn only whether a purchase is active, so the app can unlock Premium or Premium Portfolio on your device.

Contacts

Importing from Contacts is read-only and happens on your device. You approve each field one by one, and the app never writes to, changes or deletes your Contacts. If you choose to import, the app reads only the contacts you pick. It does not read your whole address book. What you approve is stored like the rest of your data, on your device and in your own iCloud.

Notifications

Reminders, the morning briefing, the Sunday summary and the optional alerts are local notifications created and delivered on your device. They are not sent through our servers. Reminders and alerts start off, except Shoot and payment reminders for photographers, and the app asks for notification permission only when you switch one on. The Live Activity for upcoming calls starts on. With Show names on Lock Screen off, the default, it shows only Upcoming call, a countdown and a Join button, with no company name. Apple Watch haptic cues use the same on-device reminders, mirrored by your iPhone to your watch. Reminder notifications follow Show names on Lock Screen, which is off by default. With it off, they show only generic text and times, with no call, company or client names. On a Mac, notifications carry full details, and System Settings, Notifications, Show previews decides what shows. To hide even the generic text on a locked iPhone, open iOS Settings, Notifications, Principal Seat, Show Previews, and choose When Unlocked.

Calendar (optional, Premium)

Calendar sync is off by default and is set up per device, and only Premium members can turn it on. You read a plain explanation and agree first, and only then does your device ask for calendar access. You pick one calendar. The app reads and writes events in that calendar for your meetings, calls and follow-up dates, and it only changes events it created. If you also choose to see your calendar in Principal Seat, it reads events in the calendars you choose, on your device, to show them to you under From your calendar and to spot invites from people and companies you already know. It never changes those events, does not read your email and does not share them. Events the app writes go to the calendar you pick, and that calendar's account (for example iCloud, Google or Exchange) syncs them the way it already does. If it is a work account, your employer may be able to see those events. A new calendar the app creates goes in iCloud or on your device, and the app asks you to choose when there is more than one place, so it never picks a work account on its own. Calendar data is never sent to us. You can turn sync off in Settings, or remove access in your device Settings under Privacy and Security, then Calendars.

Backups

Backup files are created on your device and stay where you save them. We never receive them. If you add a password, the backup is a password-protected copy. If you lose the password, nobody can recover that backup. Backups are protected with a password unless you turn that off. If you choose to remember the password, it is kept in this device's Keychain only and does not sync. Automatic and Back up now files are kept in the app's Backups folder, which you can see in the Files app. Without a password a backup is a plain file that includes your compensation. Backups can include attachments and transcripts, and you can switch each of those off. Before an import or restore, the app keeps a safety copy privately inside the app, out of the Files app. When your backups use a password, the safety copy is protected with it. If you copy your current state for an AI assistant, it holds your opportunities, their next steps and follow up dates, and people's names and roles. It leaves out compensation and notes, and it leaves out contact details unless you turn on Include contact details. It goes only where you paste or share it. Import files an assistant sends you are read on your device.

Notify another app or service (optional, Premium)

If you turn on Notify another app or service, the events you choose are sent only to the web address you type, which is your own. Nothing goes through our servers. Each message holds the event type, the opportunity title and company, the stage and a time, and you can switch names off. Compensation, notes, documents and contact details are never sent. The address must be https. Private and local addresses, and redirects, are refused, and an address that cannot be looked up is not sent to. An optional secret signs each message with HMAC-SHA256 over a timestamp and the body. An optional Authorization header can be added for services that need one. The secret and the Authorization header are stored in your device Keychain only, are never sent anywhere else, and are never in settings, backups, exports or the AI state. A log of the last 20 deliveries is kept on your device, and an event that could not be delivered is kept on your device for 24 hours. You are responsible for who can read your own address.

State snapshot (optional, Premium)

The state snapshot is part of Notify another app or service. It is off by default. When you turn it on, the app sends a copy of your current state to the web address you set in Notify another app or service, at the times you pick, when you open the app and, if iOS allows it, in the background, and whenever you tap Send snapshot now. An automatic snapshot is sent only when something changed since the last one. It holds your opportunities with their stages, next steps and follow-up dates, timeline summaries, call prep talking points and questions, commitments, and people's names and roles. Contact details (email, phone, website and LinkedIn) are added only if you turn on Include contact details in snapshots. With Premium Portfolio, your seats and clients are included (organization, role, status, dates, renewals, conflicts and meetings), never their pay or notes. Quotes, invoices, contracts and shoots are never in a snapshot. Pay, opportunity notes, people's background notes and call prep notes are included only if you also turn on Include compensation and notes in snapshots, which is off by default. Photos, the contents of your documents (only their file names), the signing secret and the Authorization header are never sent. Snapshots are plain JSON with the metadata first. A snapshot bigger than the Largest event size setting (2, 4, 8, 16 or 64 KB, or Unlimited, with 8 KB the default), under Advanced in Notify another app or service, is sent as numbered parts. Call prep is a short summary unless you turn on Include full call prep. Each one is signed the same way as event messages when you set a secret. Demo mode never sends. A snapshot goes only to your address, never through our servers, and you are responsible for who can read it there.

Get updates from a web address (optional, Premium)

Get updates from a web address is off until you turn it on. When it is on, the app requests the https address you set when it opens or comes back to the front, at the times set in Send snapshots automatically, in the background on iPhone and iPad if iOS allows it, about once an hour on the Mac while it is open, and whenever you tap Check now. The request sends none of your data. It carries only standard request headers, including ones that ask whether the file changed since last time, and the optional Authorization header you entered. The Authorization header is kept in this device's Keychain only, and is never in logs, backups, exports or snapshots. The address must be https. A user name or password in the address, and a redirect to another server, are refused. Addresses on your home or office network are refused unless you turn on Allow local network. What it downloads, up to 5 MB, is imported on your device with the same checks as a file import, with a backup first, and you can Undo it in Recent imports. A file is imported whole or not at all, a file already imported is skipped, and if you changed a field in the app after the file was written, your value stays. A log of the last 20 checks is kept on your device with only the result and the host. Demo mode never checks. Principal Seat has no server in between and receives nothing, and you are responsible for who can write to your own address.

Widgets, Siri, Shortcuts and Focus

For widgets, a small summary of titles, times and counts is saved in an App Group container on your device. It does not leave your device except to your own Apple Watch. Names show on the Lock Screen only if you turn on Show names on Lock Screen, which is off by default. Home Screen widgets show the next call's name unless you turn off Show names on Home Screen widgets. Compensation and notes are never in that summary. Siri and Shortcuts actions run on your device and use titles and counts. While a Focus filter or Hide my job search hides your job search, Siri and Shortcuts show no names. The AI assistant actions (Import into Principal Seat, Add timeline entry, Set follow-up and Get current state for AI) need your device to be unlocked. Get current state for AI returns the same current state as text, without pay, notes or contact details, and it goes only where your shortcut sends it. Import into Principal Seat works only while Two-way link with my AI assistant is on. The Focus filter can hide your Principal Seat screens while a Focus is on, apart from Settings and Help, or show only Today. It stores the mode you choose on your device.

News button

Each company has a News button that opens a news search in your browser. Only the company name goes into that search, and your browser handles it. Principal Seat does not fetch news itself.

Meeting links and transcripts

A Join button appears when a meeting holds a Zoom, Google Meet, Teams or Webex link. Finding the link is done on your device, nothing is fetched, and the link opens only when you tap Join. A transcript is text you paste or import. It is stored with its meeting on your device and in your own iCloud sync, and in your backups while Include transcripts is on. Nothing sends it anywhere. If you turn on transcript summaries and tap Summarize, Apple Intelligence reads that one transcript on your device, after pay, immigration, family and address details and anything you marked private are removed. No transcript is sent to us or to any AI service.

Email button, attachments and LinkedIn share

The Email button opens a draft in your own mail app. It never sends anything for you. Documents you attach come from the system file picker, which can reach Files, iCloud Drive, Dropbox, Google Drive and OneDrive, and they are stored with your other data. When you share a LinkedIn profile or job link into the app, only the link and the text you shared are used. Principal Seat does not open LinkedIn, does not scrape it and needs no LinkedIn login.

Feedback

If you choose Send feedback in the app, it opens an email to [email protected] in your own mail app; nothing is sent until you press Send, and the email contains only what you write plus, if you leave the option on, your app version, build, OS version and device model, never your opportunities, people, pay or documents.

Children

Principal Seat is built for working professionals and is not directed at children.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new effective date. See also the Terms of Use.

Questions

Contact Principal Seat at [email protected].