Ordinalist Privacy Policy

Effective date: September 19, 2026

Ordinalist is referred to in this policy as the App. The App is developed and maintained by Andrew Mastracchio (the Developer). This policy explains what information the App handles, where it is stored, and the choices available to you.

Privacy at a glance

Rankings and ranking statistics are stored on your device by default.
iCloud Sync is optional and uses your private Apple iCloud account.
Calendar connection is optional. If you connect Calendar, the App creates a dedicated Ordinalist calendar and synchronizes active ranking-reminder dates through a calendar account on your device.
You choose where to export library backups; restoring a backup keeps iCloud Sync off and preserves a local recovery copy.
The Developer does not operate an Ordinalist account or data server.
There are no ads, third-party analytics, or cross-app tracking.
Ordinalist does not automatically upload its local diagnostic logs or locally stored MetricKit reports. Apple may separately provide the Developer with crash, performance, and usage information according to your Apple analytics choices or as part of TestFlight.

1. Information stored on your device

By default, the App stores its information locally on your device. This may include imported playlist or album details, song metadata needed for ranking, your ranking choices and results, prior results, decision-duration records used to calculate ranking statistics, reminder rules, recent searches, preferences, and technical state needed to resume your work. Ranking statistics, such as total active ranking time, average decision time, and match-up summaries, are calculated from that stored ranking data. The Developer does not automatically receive this information.

The App shares its local store with its bundled widget and extensions through an Apple App Group so those components can provide the features you request. That shared storage remains within the App’s Apple-managed container.

Ranking names and related details may appear in widgets, Spotlight, and Shortcuts on supported platforms. If you allow notifications, scheduled ranking reminders may display ranking or song names. You can manage notification visibility and permissions in your device settings.

When you choose Export Backup, the App creates a copy of its library database, including saved rankings, progress, history and statistics, song details, source links, reminders, and Recently Deleted items. Backups also contain technical database information, which may include internal iCloud synchronization metadata. App preferences and diagnostic logs are not included. You choose the destination through the system file interface. A destination such as iCloud Drive or another file provider may store or synchronize the file under that provider’s terms, independently of the App’s iCloud Sync setting. The Developer does not receive the backup unless you separately choose to send it.

Importing a backup creates a local working copy for review. Restoring it replaces this device’s active library, preserves the previous library and an automatic backup for recovery, and keeps iCloud Sync off. Restore does not modify Apple Music playlists. Using iCloud again requires the App’s separate confirmation to back up the restored library and return to the library from before the first restore, followed by turning on Sync with iCloud in Settings. The two libraries are not automatically merged.

2. Optional iCloud Sync

iCloud Sync is off by default. If you choose to enable it during onboarding or in Settings, the App stores and synchronizes the same ranking data, including decision-duration records and the information used to calculate ranking statistics, through your private Apple iCloud account so it can remain current across compatible devices. Ranking statistics are derived on your devices from this synchronized ranking data. The Developer does not operate the iCloud servers and does not have access to the data in your private CloudKit database.

You may stop that device from participating in iCloud Sync at any time by turning off Sync with iCloud in the App’s Settings. Turning sync off does not necessarily delete copies that were previously stored in iCloud. You can manage iCloud app data through your Apple account and device settings, subject to Apple’s services and retention practices.

3. Optional Calendar connection

Calendar connection is off until you choose Connect Calendar in the App’s Settings. To provide two-way synchronization, the App requests full access to calendar events through Apple’s EventKit permission system. Full access allows the App to read and write calendar data, but the App’s Calendar feature is designed to use that access to find or create a writable calendar named Ordinalist, manage the App’s events in that calendar, and detect date changes made to those events. It does not use the contents of events in your other calendars.

For each active ranking reminder, the App creates an all-day event in the Ordinalist calendar. The event includes the ranking name, its next due date, a note identifying it as managed by Ordinalist, and an Ordinalist link containing internal reminder and ranking identifiers. Moving one of these events to another date in Calendar may update the corresponding reminder date in the App. Changes made to reminder dates in the App may update the corresponding Calendar events. Pausing or deleting a reminder removes its managed event during synchronization.

The App creates the Ordinalist calendar in an available writable CalDAV or Exchange calendar account on your device, which may include iCloud or another calendar provider. The calendar and its events may be stored and synchronized by that provider under its own terms and privacy practices. Calendar access is granted separately on each device, although the calendar provider may make the Ordinalist calendar and its events available on your other connected devices. Calendar data is processed by the App, Apple’s EventKit framework, and the calendar provider you use; it is not transmitted to a server operated by the Developer.

Disconnect Calendar stops the App from synchronizing but leaves the Ordinalist calendar and its existing events in Calendar. Remove Ordinalist Calendar asks EventKit to delete that calendar and its events while leaving your reminder rules saved in the App. You can revoke the App’s Calendar access in your device’s Privacy & Security settings. Revoking access stops the App from reading or changing Calendar data but does not itself delete calendar data already stored by your calendar provider.

4. Apple Music access

The App asks for permission to access Apple Music so you can search and browse your library and the Apple Music catalog, and import playlists and albums for ranking. For an imported playlist, the App may check its current contents when you open the associated ranking or request an update. The App compares those contents with its stored ranking and updates its own data to reflect songs added to or removed from the playlist. This check does not modify the playlist in Apple Music.

When you search Apple Music, the App sends your search text to Apple to retrieve catalog results and suggestions, including suggestions while you type. These requests are handled by Apple’s Music services, not a Developer-operated search service.

On supported platforms, the App can also open Apple Music and, only when you deliberately choose an action that applies your ranking to Apple Music, edit an eligible playlist or create a new playlist that reflects your ranking.

Apple Music library data is processed by the App and Apple’s Music services for these requested features. It is not transmitted to a server operated by the Developer. You can revoke Apple Music access in your device’s Privacy & Security settings, although features that require your music library will then be unavailable.

5. Diagnostic logs and support

The App keeps a limited diagnostic log locally for troubleshooting. The log records structured technical events such as the App version and build, operating-system version, hardware model, operation outcomes and durations, aggregate counts, recovery or fallback results, and error types or numeric codes. Repetitive successful iCloud activity is combined into periodic summaries instead of recording every callback. The log is designed not to record song, artist, album, playlist, discography, project, ranking, reminder, or calendar event names; ranking choices or ordering; search queries; file paths; URLs; account details; stable or unique device identifiers; user-provided text; credentials; or detailed localized error contents.

On supported Apple devices, the operating system also delivers MetricKit diagnostic reports to the App for crashes, hangs, excessive CPU use, disk writes, and launch problems. The App stores only bounded call-stack diagnostics and excludes free-form exception reasons. These locally stored reports remain within the App’s storage and are included only when you deliberately export diagnostic information.

The App does not automatically upload its local diagnostic logs or locally stored MetricKit reports. They leave the App’s storage only when you deliberately use the system share interface and choose a recipient. You may share one log session or a combined diagnostic history. You can use the App without sharing this locally stored diagnostic information.

Separately, Apple may provide the Developer with crash, performance, and usage information through App Store Connect or Xcode. For App Store versions, this generally depends on whether you have chosen to share diagnostics and usage information with app developers in your device’s Analytics & Improvements settings. TestFlight users automatically share crash reports with the Developer under Apple’s TestFlight practices, regardless of that device setting. This Apple-operated reporting is separate from the App’s local diagnostic-log feature and is governed by Apple’s terms and privacy practices.

If diagnostic information is provided to the Developer by you or Apple, it will be used only to investigate issues, provide support, fix crashes, improve the App’s performance and reliability, maintain necessary development records, or comply with law.

6. Analytics, tracking, advertising, and sharing

The App does not use developer-operated analytics, advertising trackers, or data brokers. It does not track you across apps or websites and does not sell or rent personal information. The Developer does not maintain Ordinalist user accounts, advertising profiles, or a database of your App activity. Apple may independently collect and provide limited App analytics according to your Apple analytics choices and Apple’s privacy practices.

Information you voluntarily provide for support may be shared only when reasonably necessary to provide that support, operate or secure the App, comply with applicable law, or protect legal rights.

7. Retention, deletion, and your choices

Local App data: Retained on your device until you permanently delete it in the App or remove the App and its data, subject to Apple device backups. Rankings moved to Recently Deleted are normally eligible for automatic removal after 30 days, or you can delete them permanently sooner. Recently Deleted items recovered from a library backup receive a new 30-day grace period before automatic removal.
Backups and recovery copies: Deleting an item from the active library does not remove it from earlier backups or preserved recovery libraries. You can export recovery copies and remove older copies in Library Backups; the latest recovery copy is protected. Delete All Ordinalist Data includes App-managed recovery data, and interrupted cleanup may require a retry or reopening the App. Files you exported elsewhere remain until you delete them from their destination, subject to that provider’s retention practices. Temporary working copies are reclaimed when the App can safely remove them.
iCloud data: If sync is enabled, ranking deletions can synchronize to your other devices. Deleting local data with sync off does not delete data already stored in iCloud, which may return if you enable sync later. You can also manage iCloud app data through your Apple account controls, subject to Apple’s practices.
iCloud consent: Revoke future synchronization on a device by turning off Sync with iCloud in the App’s Settings.
Calendar data: Disconnecting Calendar leaves the Ordinalist calendar and its events with your calendar provider. Use Remove Ordinalist Calendar in the App before revoking access if you want the App to request their deletion, or delete them through Calendar or your provider. Removing the App or deleting its local data does not necessarily delete calendar data already held by the provider.
Calendar permission: Revoke access through the device’s Privacy & Security settings. Calendar access is controlled separately on each device.
Apple Music permission: Revoke access through the device’s Privacy & Security settings.
Local diagnostic information: Log sessions are automatically limited to ten sessions, 128 KB per session, and seven days. MetricKit reports stored by the App are separately limited to five reports and 768 KB in total. You can delete the complete local diagnostic history from the App’s log viewer at any time.
Apple diagnostic sharing: Deleting the App’s local diagnostic history does not delete diagnostic information separately collected or previously provided by Apple. You can control future App Store diagnostic sharing in your device’s Analytics & Improvements settings. Apple applies separate reporting practices to TestFlight builds.
Diagnostic information received by the Developer: Retained only as long as reasonably necessary for the purposes described above. You may request deletion using the contact method below, subject to legal or recordkeeping obligations and information retained independently by Apple.

8. Children’s privacy

The Developer does not knowingly collect personal information from children. The limited diagnostic information described above may be provided through Apple’s services or voluntarily sent for support. The App does not maintain user accounts or advertising profiles.

9. Security

The App is designed to minimize the information available to the Developer and relies on Apple’s platform security, sandboxing, App Group, iCloud, EventKit, Calendar permission, and other permission systems. No storage or transmission method can be guaranteed completely secure, but limiting collection and access reduces exposure.

Library backup files are not encrypted or password-protected by the App. Keep them in a private location and share them only with recipients you trust. The security of an exported copy also depends on the destination you choose.

Calendar events created by the App contain ranking names and dates and may synchronize through your selected calendar account. The visibility and security of that data depend on the calendar account, any calendars you share, and the devices connected to that account.

10. Apple and calendar-provider services

Features may rely on Apple services and frameworks including Apple Music, Calendar and EventKit, iCloud and CloudKit, MetricKit, Spotlight, Shortcuts, notifications, system file and sharing interfaces, App Store Connect, and TestFlight. Calendar connection may also rely on the CalDAV or Exchange provider configured on your device. Information processed independently by Apple or another calendar provider is governed by that provider’s terms and privacy practices. See Apple’s Privacy Policy and Apple Music & Privacy, and Share analytics, diagnostics, and usage information with Apple.

11. Changes to this policy

This policy may be updated when the App’s features, legal obligations, or privacy practices change. Material changes will be reflected in the policy, and the effective date at the top identifies the latest revision.

12. Contact

For questions about this policy, the App’s privacy practices, or a request concerning diagnostic information previously provided to the Developer, use the contact form at www.andrewmastracchio.com/ordinalist#support or email support@andrewmastracchio.com.