Privacy Policy

This is the current privacy policy for version 1.1, available on the App Store. Version 1.0 privacy policy is kept for that version.

In short: your information stays on your devices and in your own iCloud unless you choose to send it somewhere. The full policy below is what counts.

Effective 31 October 2026

Principal Seat is a private app with spaces for Career, Household, Business and Caregiving. Your information stays on your devices and in your own iCloud unless you choose to send it somewhere. This page explains, in plain language, what the app and this website do with your information. The publisher is Principal Seat. Contact: [email protected].

The short version

The app keeps your data on your device and in your own iCloud. Nothing leaves your device unless you export or share it, or turn on one of these features. They are company news, calendar sync, sun times, the drone checklist, and Get updates from a web address. Notify another app or service is one too, including a snapshot of where things stand. Get updates from a web address only requests the address you set, and sends none of your data. The optional Apple Intelligence features run on your device only. We do not receive the roles, recruiters, people, companies, clients, quotes, invoices, shoots, notes or other content you enter. Emails you send to us are used only to reply to you.

If you pick what brings you here on this website, that choice is saved in this browser only and never sent to us. Forget my choice removes it.

Where your data lives

Your data is stored on your device. When iCloud sync is on, it is also stored in your own iCloud account using Apple's CloudKit. It syncs across your own devices the same way. It is stored in your own iCloud account, under Apple's iCloud terms. If sync is off, your data stays only on that device. Your iCloud data is governed by your Apple Account and Apple's terms. We have no access to it.

Shared spaces

When you share a space in Principal Seat 1.1, the shared content is also stored in the iCloud accounts of the people you share with. This happens through Apple's iCloud services. We never store your content on Principal Seat servers. People you share with can see, copy and keep what you share. Removing someone or deleting content does not remove copies they already have. Please share only with people you trust. You decide what to enter, including health, financial and personal details, and who can see it. You can lock pay and amounts with Face ID or Touch ID on your device. Say you share a password-protected copy (PDF) with a professional. Anyone who has the file and the password can open it, so send the password separately. Send to your AI assistant, Export my data and notifications follow the space you are in.

Your current role, role tracker and check-ins

Like everything else you enter, some details are stored on your device and, with sync on, in your own private iCloud account. These are My current role, your target roles, your wish list, your role tracker expectations, your offer details and your post decision check-ins. We have no access to them. Require Face ID or Require Touch ID can lock compensation screens, and the prices and fees in Business, on your device. The switch is named for your device, and reads Lock prices and fees in business mode. It is on unless you turn it off. It is free. Lock again sets when the app locks after you leave it: Immediately, after 1 minute or after 5 minutes. Never keeps it open until you quit the app or tap Lock now. Choosing a longer time, or turning the lock off, asks for Face ID or Touch ID first. Compensation is always locked when the app starts. The lock needs a device passcode. If your device has none, these screens cannot be locked until you set one. Face ID or Touch ID is handled by Apple on your device; the app never sees your face data.

Inbox and attachments

You can share or paste an email, PDF or text file into the Inbox. The app reads it on your device so you can File it into any space. It is stored with the rest of your data and is not sent to us.

Prompts and exports

Apart from the optional features described below, the app does no scanning of the web or of your accounts. When you copy or export a prompt, it goes only where you paste it. That is an advisor you choose, or your own AI assistant, like ChatGPT, Gemini, Claude or Grok. Nothing is sent to us, and the app does not send anything to an AI service by itself. Send to AI assistant builds a text you share or copy yourself. It has up to three parts: the setup instructions, your current state, and the items you select. The current state holds your opportunities with their ids, stages, next steps and follow-up dates. It also holds timeline summaries, call prep, commitments, your boards and clients, and people's names and roles. If you use Business, it holds your quotes, invoices, contracts and shoots without their amounts (see Business, clients and shoots). It never includes pay or notes. Contact details (email, phone, LinkedIn and website) and shoot addresses are added only if you turn on Include contact details, which is off by default. Pay figures are left out until you turn on Include pay, rates and prices. That covers the items you select and Export for AI or advisor. The switch is off until you turn it on. Export my data builds a zip on your device, and it leaves only where you send it. Compensation is left out unless you switch it on. The switch covers the compensation fields. Attached documents, saved emails, notes and transcripts are exported as they are, so check them if they mention pay.

Apple Intelligence (optional, Premium)

Three optional features use Apple Intelligence: a follow-up email draft, the weekly summary and a transcript summary. Each one is off until you turn it on. Apple Intelligence features run on your device. Principal Seat doesn't send that information to us or to any server. Before any text reaches the model, the app removes some details. These are pay, equity, immigration, family and home address details, email addresses, phone numbers and lines you marked private. The email draft and the weekly summary never use your notes, overviews, pay, documents or contact details. A transcript summary uses only the one transcript you pick, after those removals. They need a device that supports Apple Intelligence, with Apple Intelligence turned on.

Automatic updates from your AI assistant (optional)

Two-way link with my AI assistant is off by default. When you turn it on, your assistant prepares an update. You review the preview and choose Allow before records change. Always allow is optional, for one connection. A change that pays, changes an amount, deletes, or closes still asks. A new connection uses an 8-digit approval code. Review pending updates shows what is waiting. Send a test update checks the path. ChatGPT and Gemini work by copying and pasting. Grok has been tested on Grok Ultra only. Other Grok plans are not verified here. Update files saved in your own iCloud Drive, in the folder Principal Seat, Imports, and updates from the Principal Seat actions in the Shortcuts app, are read on your device and still wait for that review. A backup is saved first, every time. Each file then moves to Imports, Done, or to Imports, Failed with a short note that says why. That folder is in your own iCloud Drive, and we have no access to it. These updates do not delete an opportunity or a person unless you allow that change, and you can undo the last import. The app never sends anything to the assistant.

Sun times and the drone checklist (optional)

Show sun times is off by default. With Show sun times on, the shoot's address is sent to Apple to find where it is. Turn sun times off for a shoot and its address is not looked up. Sun times are worked out on your device. The position found is kept with the shoot, so the address is not looked up again until it changes. It is not included in Export my data and is never sent to your AI assistant. Opening the drone checklist also sends the address to Apple to find the country, each time you open it. No position is saved. For some countries, the official drone map link opens at the shoot's position. That map site receives the position only when you tap the link. Demo mode never looks up an address. Apple handles these lookups under its own privacy policy.

Opening an address in Maps. When you tap Open in Maps on a person's address, Principal Seat hands that address to Apple Maps. Nothing is sent until you tap, and Apple Maps handles the address under Apple's own privacy policy.

Business, clients and shoots

Clients, quotes, invoices, contracts and shoots are stored like the rest of your data, on your device and in your own iCloud. With Require Face ID or Touch ID on, quote and invoice amounts, line items, deposits and payment links stay hidden until you unlock. Bank details are hidden on screen until you unlock, and print only on invoices. A quote, invoice or contract PDF is not made while the app is locked. Parking, team, gear, kit lists and call sheets are never sent to your AI assistant or in snapshots. The current state in Send to AI assistant, and Get current state for AI, include your shoots. That means title, client, dates, location, country, call time and shot list. They also include your quotes, invoices and contracts: number, title, status, dates and line titles. They never include their prices, totals, deposits or payment links. Shoot addresses and gallery links are added only with Include contact details on. A shoot's position is never sent. Client and contact postal addresses are never sent. Export my data puts your Business items in a Business folder. Amounts, payment links and terms are left out unless you switch compensation on. Principal Seat does not process payments.

Deleting your data

The app has no Principal Seat server, so there is no copy of your app data for us to delete. Your data is on your devices and in your own iCloud. To delete it: first, delete the opportunities and people you no longer want in the app. A deletion syncs to your other devices. Second, remove the iCloud copy. Open Settings, your name, iCloud, then Manage Account Storage (or Manage Storage). Choose Principal Seat if it is listed, and delete its data. Deleting the app alone does not delete your iCloud data. Third, delete backup files. Automatic and Back up now files are in the Files app, On My iPhone (or On My iPad), Principal Seat, Backups. Any copy you saved somewhere else stays there until you delete it. Some copies are held in other places and must be deleted there. These are exports and prompts you shared, events the app added to your calendar, and events and snapshots already sent to your own webhook address. Import files in iCloud Drive, Principal Seat, Imports (and its Done and Failed folders) stay until you delete them. Deleting data is separate from cancelling a subscription, which you do in your Apple Account settings.

Analytics and ads

The app contains no analytics, no advertising and no third-party trackers.

This website

This website is a set of static pages hosted on Cloudflare. It has no accounts, no analytics, no advertising and no trackers, and we do not set cookies of our own. Earlier waitlist entries, if we still have them, are described in the App Store privacy policy. Cloudflare may add a small script of its own that hides email addresses on the page from spam bots. We do not add any third party scripts. Like any host, Cloudflare may process standard technical request data, such as your IP address. It does this to deliver the pages and protect the site.

Email you send us

If you email us, we receive your email address and whatever you write. We use it only to reply to you. We do not sell it, share it for advertising or add you to any list. We keep these emails only as long as needed to reply. To have your emails deleted, write to [email protected].

Purchases

Premium and Premium Portfolio subscriptions and the six-month pass are bought through Apple. Apple handles payment and billing and does not give us your card details. We may learn only whether a purchase is active, so the app can unlock Premium or Premium Portfolio on your device.

Contacts

Importing from Contacts is read-only and happens on your device. You approve each field one by one, and the app never writes to, changes or deletes your Contacts. If you choose to import, the app reads only the contacts you pick. It does not read your whole address book. What you approve is stored like the rest of your data, on your device and in your own iCloud.

Notifications

Reminders, the morning briefing, the Sunday summary and the optional alerts are local notifications created and delivered on your device. They are not sent through our servers. Reminders and alerts start off, except Shoot and payment reminders for photographers. The app asks for notification permission only when you switch one on. The Live Activity for upcoming calls starts on. Show names on Lock Screen is off by default. Then it shows only Upcoming call, a countdown and a Join button, with no company name. Apple Watch haptic cues use the same on-device reminders, mirrored by your iPhone to your watch. Reminder notifications follow Show names on Lock Screen, which is off by default. With it off, they show only generic text and times, with no call, company or client names. On a Mac, notifications carry full details, and System Settings, Notifications, Show previews decides what shows. To hide even that text on a locked iPhone, open iOS Settings, Notifications, Principal Seat, Show Previews. Then choose When Unlocked.

Calendar (optional, Premium)

Calendar sync is off by default and is set up per device, and only Premium members can turn it on. You read a plain explanation and agree first, and only then does your device ask for calendar access. You pick one calendar. The app reads and writes events in that calendar for your meetings, calls and follow-up dates, and it only changes events it created. You can also choose to see your calendar in Principal Seat. Then it reads events in the calendars you choose, on your device. It uses them to show them to you under From your calendar and to spot invites from people and companies you already know. It never changes those events, does not read your email and does not share them. Events the app writes go to the calendar you pick. That calendar's account, for example iCloud, Google or Exchange, syncs them the way it already does. If it is a work account, your employer may be able to see those events. A new calendar the app creates goes in iCloud or on your device. When there is more than one place, the app asks you to choose. So it never picks a work account on its own. Calendar data is never sent to us. You can turn sync off in Settings. Or remove access in your device Settings under Privacy and Security, then Calendars.

Backups

Backup files are created on your device and stay where you save them. We never receive them. If you add a password, the backup is a password-protected copy. If you lose the password, nobody can recover that backup. Backups are protected with a password unless you turn that off. If you choose to remember the password, it is kept in this device's Keychain only and does not sync. Automatic and Back up now files are kept in the app's Backups folder, which you can see in the Files app. Without a password a backup is a plain file that includes your compensation. Backups can include attachments and transcripts, and you can switch each of those off. Before an import or restore, the app keeps a safety copy privately inside the app, out of the Files app. When your backups use a password, the safety copy is protected with the same password. Say you copy your current state for an AI assistant. It holds your opportunities, their next steps and follow up dates, and people's names and roles. It leaves out compensation and notes, and it leaves out contact details unless you turn on Include contact details. It goes only where you paste or share it. Import files an assistant sends you are read on your device.

Notify another app or service (optional, Premium)

If you turn on Notify another app or service, the events you choose are sent only to the web address you type. That address is your own. Nothing goes through our servers. Each message holds the event type, the opportunity title and company, the stage and a time, and you can switch names off. Compensation, notes, documents and contact details are never sent. The address must be https. Private and local addresses, and redirects, are refused, and an address that cannot be looked up is not sent to. An optional secret signs each message with HMAC-SHA256 over a timestamp and the body. An optional Authorization header can be added for services that need one. The secret and the Authorization header are stored in your device Keychain only. They are never sent anywhere else, and are never in settings, backups, exports or the AI state. A log of the last 20 deliveries is kept on your device. An event that could not be delivered is kept on your device for 24 hours. You are responsible for who can read your own address.

Snapshot of where things stand (optional, Premium)

A copy of what's in the app is part of Notify another app or service. It is off by default. When you turn it on, the app sends a copy of your current state to your web address. That is the address you set in Notify another app or service. It sends at the times you pick and when you open the app. It also sends in the background if iOS allows it, and whenever you tap Send snapshot now. An automatic snapshot is sent only when something changed since the last one. It holds your opportunities with their stages, next steps and follow-up dates. It also holds timeline summaries, call prep talking points and questions, commitments, and people's names and roles. Contact details (email, phone, website and LinkedIn) are added only if you turn on Include contact details in snapshots. With Premium Portfolio, your boards and clients are included, never their pay or notes. That means organization, role, status, dates, renewals, conflicts and meetings. Quotes, invoices, contracts and shoots are never in a snapshot. Pay, opportunity notes, people's background notes and call prep notes are included only if you also turn on a switch. The switch is Include pay, rates and prices and notes in snapshots, and it is off by default. Photos, the contents of your documents (only their file names), the signing secret and the Authorization header are never sent. Snapshots are plain JSON with the metadata first. A snapshot bigger than the Largest event size setting is sent as numbered parts. That setting is under Advanced in Notify another app or service: 2, 4, 8, 16 or 64 KB, or Unlimited, with 8 KB the default. Call prep is a short summary unless you turn on Include full call prep. Each one is signed the same way as event messages when you set a secret. Demo mode never sends. A snapshot goes only to your address, never through our servers. You are responsible for who can read it there.

Get updates from a web address (optional, Premium)

Get updates from a web address is off until you turn it on. When it is on, the app requests the https address you set. It does this when it opens or comes back to the front, and at the times set in Send snapshots automatically. It also checks in the background on iPhone and iPad if iOS allows it. On the Mac it checks about once an hour while it is open, and whenever you tap Check now. The request sends none of your data. It carries only standard request headers and the optional Authorization header you entered. The standard headers include ones that ask whether the file changed since last time. The Authorization header is kept in this device's Keychain only, and is never in logs, backups, exports or snapshots. The address must be https. A user name or password in the address, and a redirect to another server, are refused. Addresses on your home or office network are refused unless you turn on Allow local network. What it downloads, up to 5 MB, is imported on your device with the same checks as a file import. A backup is made first, and you can Undo it in Recent imports. A file is imported whole or not at all. A file already imported is skipped. If you changed a field in the app after the file was written, your value stays. A log of the last 20 checks is kept on your device with only the result and the host. Demo mode never checks. Principal Seat has no server in between and receives nothing. You are responsible for who can write to your own address.

Widgets, Siri, Shortcuts and Focus

For widgets, a small summary of titles, times and counts is saved in an App Group container on your device. It does not leave your device except to your own Apple Watch. Names show on the Lock Screen only if you turn on Show names on Lock Screen, which is off by default. Home Screen widgets show the next call's name unless you turn off Show names on Home Screen widgets. Compensation and notes are never in that summary. Siri and Shortcuts actions run on your device and use titles and counts. The AI assistant actions need your device to be unlocked. They are Import into Principal Seat, Add timeline entry, Set follow-up and Get current state for AI. Get current state for AI returns the same current state as text, without pay, notes or contact details. It goes only where your shortcut sends it. Import into Principal Seat works only while Two-way link with my AI assistant is on. The Focus filter can hide your Principal Seat screens while a Focus is on, apart from Settings and Help, or show only Today. It stores the mode you choose on your device.

Company news (optional)

Company news is off by default. You can switch on Refresh company news automatically, or confirm the one-time notice before a manual refresh. Then the company names you track are sent to Google News to get headlines. Only the company name goes in the request. It also carries the ordinary technical details of any web request, such as your IP address. Sample companies are never looked up, and Demo mode makes no request. The stories that come back are stored with the company and sync through your own iCloud. Alerts are local notifications.

Meeting links and transcripts

A Join button appears when a meeting holds a Zoom, Google Meet, Teams or Webex link. Finding the link is done on your device, nothing is fetched, and the link opens only when you tap Join. A transcript is text you paste or import. It is stored with its meeting on your device and in your own iCloud sync, and in your backups while Include transcripts is on. Nothing sends it anywhere. You can turn on transcript summaries and tap Summarize. The app first removes pay, immigration, family and address details and anything you marked private. Then Apple Intelligence reads that one transcript on your device. No transcript is sent to us or to any AI service.

Email button, attachments and LinkedIn share

The Email button opens a draft in your own mail app. It never sends anything for you. Documents you attach come from the system file picker, which can reach Files, iCloud Drive, Dropbox, Google Drive and OneDrive. They are stored with your other data. When you share a LinkedIn profile or job link into the app, only the link and the text you shared are used. Principal Seat does not open LinkedIn, does not scrape it and needs no LinkedIn login.

Feedback

If you choose Send feedback in the app, it opens an email to [email protected] in your own mail app. Nothing is sent until you press Send. The email contains only what you write. If you leave the option on, it also has your app version, build, OS version and device model. It never has your opportunities, people, pay or documents.

Children

Principal Seat is built for working professionals and is not directed at children.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new effective date. See also the Terms of Use.

Questions

Contact Principal Seat at [email protected].