Last updated: October 2026
This page covers two separate things: the Entire History of Us iOS app, and this website. They work differently, so they are described separately. The app comes first.
Entire History of Us is an iOS app that lays out human history as a single timeline. Signing in is optional: everything in the app works without an account. It contains no analytics, no advertising and no crash-reporting software, and it does not track you — not across apps, not across sessions, not at all.
Two things reach a server of ours, and only when you choose them: feedback you send about a historical record, and signing in, if you sign in. Nothing else in the app sends us anything. Both are described in full below.
We do not sell or share your data.
The app remembers a few things on your device, using iOS’s standard preferences storage:
That is the whole list. Apart from feedback you choose to send, and a file you choose to export (below), none of it is transmitted anywhere. We cannot see it. It stays on your device, and it is deleted when you delete the app. (iOS keeps Keychain items after an app is deleted; if you install the app again, it discards the old sign-in the first time it opens.)
You can export your saved items and notes. The app writes them to a single file and opens the iOS share sheet; where that file goes (Files, Mail, Notes, AirDrop, or nowhere) is your choice, made in the share sheet. The app deletes its own copy of the file when the share sheet closes (or, if the app is closed while the sheet is open, at your next export). Nothing is sent anywhere unless you choose a destination.
Every record in the app has a “Send feedback” link. It is there because the records are generated from historical sources and some of them are wrong, and a reader who spots it is the fastest way we find out.
If you send feedback, we receive exactly five things:
If you are not signed in, that is all: we do not receive an account, a name, an email address, a device identifier, an advertising identifier, or your location. We do not store the IP address the report arrived from. There is nothing in a report that identifies you, and nothing that lets us connect two reports to the same person.
If you are signed in, the report also carries your account, so that we can reply to you at the email address it has. The feedback screen says which before you send (“Sent as …”). It is the account that was signed in when you wrote the report: one written while you were signed out stays anonymous, even if you sign in before it is sent. We still do not receive a device identifier, an advertising identifier or your location, and we do not store the IP address.
The comment box is free text, so please do not type anything personal into it — we have no way of knowing what it contains, and no way of finding you to ask.
Reports are kept until we have acted on them and are used only to correct the data in the app. They are never shown to other readers. Nothing is sent until you tap send; if you are offline, the report waits on your device until the next time the app opens with a connection. If you withdraw a report before it has been sent, it is deleted and never leaves your device. If you withdraw one after it has been sent, it is removed from your device, but we will already have the copy you sent us — the app tells you so at the time.
The report is delivered to a Cloudflare service under our control, in the European Union.
You can sign in with Apple, in Settings. You do not have to: nothing in the app needs an account. Signing in lets us reply to your feedback, and lets a purchase be matched to you.
When you sign in, Apple gives us an identifier for you that is specific to this app (it means nothing to anyone else) and an email address. You choose, in Apple’s own sign-in sheet, whether that is your real address or Apple’s “Hide My Email” address, which forwards to you. We store:
If you buy something in the app while signed in, the app gives Apple your account’s identifier with the purchase, so that the purchase can be matched to your account. Payment itself is handled entirely by Apple; we never see your payment details.
We use your email address only to reply to you about feedback you sent, and about your account. We never sell or share it, and we never add it to a mailing list.
Signing out ends the sign-in on that device. Deleting your account (Settings, Delete account) deletes the account, its email address and every sign-in at once, and asks Apple to end your Apple sign-in for this app; if we cannot, the app tells you how to end it yourself in iOS Settings. Feedback you sent stays, with nothing linking it to you any more. Anything you bought stays with your Apple Account.
The account is stored with the same Cloudflare service as feedback, in the European Union.
Rarely. The timeline, the historical records, the map and a small version of every photo all ship inside the app — the map is drawn from vector data we bundle, with no tile server and no mapping API — so the core of the app works with no network connection at all.
The full-size photos of most records come in picture packs, one per civilisation, which the app downloads from Apple when you need them: when you open a record whose photo is in a pack, and for the civilisations you have showing. They are Apple-hosted asset packs, fetched by iOS’s own App Store download service, the same way the app itself is installed and updated. Nothing is sent to us; the download is between your device and Apple, under Apple’s own privacy policy. Packs are free and need no account. iOS keeps them with the app, and deleting the app deletes them. Until a pack arrives, or if it cannot, the app shows the small version of the photo.
Apart from the picture packs, feedback you choose to send and signing in, out or deleting your account, described above, the app does not reach the internet on its own, and no page fetches anything from us when you open it.
The map has a button that shows where you are, as a dot among the records. The app asks iOS for your location only when you tap it, and iOS asks your permission the first time. Your location is used on your device to draw the dot and move the map to it, and for nothing else: it is not stored, not sent to us or to anyone, and is forgotten when the app closes. You can turn the permission off at any time in the Settings app.
The About screen has a few links — flutter.dev and leodong.me, for example — and a record’s photo carries a credit line that links to its source page on Wikimedia Commons or Wikipedia. Where the app sells something, the purchase screen links Apple’s standard terms of use and this page. Nothing is sent unless you tap one. Tapping one opens that page in a web view, and from that point you are dealing with that site. The photos themselves come from the app or from its picture packs on your device; showing one sends nothing to anyone.
If you have allowed iOS to share analytics with developers, Apple may give us aggregate app analytics and crash reports through App Store Connect. That is Apple’s collection, under Apple’s own privacy policy, not ours. What reaches us is anonymous and aggregate: it does not identify you.
Apart from feedback you choose to send, and an account if you choose to sign in, the app collects nothing. Signing in needs an Apple Account, and Apple decides who can use one.
This section is about entirehistoryofus.com, the site you are reading now.
If you join the waitlist, your email address is stored with Kit, the service that runs our mailing list. We use double opt-in: nothing is stored on the list until you click the confirmation link we email you. We use your address only to write about Entire History of Us, we never sell or share it, and every email includes an unsubscribe link that works immediately.
This site uses Cloudflare Web Analytics, which is cookieless: it sets no cookies, stores nothing on your device, and doesn’t track you across sites. We see aggregate page views and referrers, not individuals.
This site sets no cookies.
Email [email protected]. If you are on the mailing list, replying to any of our emails reaches us too.
