Knot Bow · Updated October 2026
Knot Bow has no account, no advertising and no analytics of any kind. Everything you create in the app stays on your device. The app does make a small number of network requests, and section 4 lists every one of them.
Nothing that identifies you. Knot Bow has no sign-in, no email capture, no advertising identifier, no analytics SDK and no third-party tracking libraries. We do not build a profile of you and we do not sell data to anyone.
Two identifiers exist, and only so that a notification can reach this device:
Neither is linked to any other information, neither is used for tracking or advertising, and neither is created unless this edition of the app offers notifications and you grant permission. The bundled PrivacyInfo.xcprivacy manifest declares NSPrivacyTracking = false, an empty tracking-domain list, and a single collected data type — Device ID, marked not linked to you and not used for tracking.
The camera is used in one place only: the Bench, where you photograph a knot you have tied so the target diagram can be laid over it. It is activated when you open the Bench and press the shutter, never in the background.
Photos you take or import are written to the app's private container on your device, downscaled to 1400 pixels and saved as JPEG. They are never uploaded, never sent to us and never backed up to any server of ours. Deleting a logbook entry deletes its photo; Reset everything in Settings deletes them all; deleting the app removes the container entirely.
Importing an existing image uses the system photo picker, which runs outside the app. Knot Bow receives only the single image you choose and never gains access to your photo library.
| What | Where | Why |
|---|---|---|
| Bookmarks | Application Support, favorites.json | The Shelf tab |
| Progress | Application Support, progress.json | Experience, streak, mastery, drill history, badges |
| Logbook | Application Support, logbook.json | Knot, note, rating and date of each comparison |
| Photos | App container, Media/ | The Bench comparison |
| Preferences | User defaults | Theme, sound, haptics, playback speed, reminder time |
| Field Notes | Caches directory | Offline reading of already-fetched summaries |
| Edition settings | User defaults | The answer from section 4a, so it is requested only once |
| Install identifier | Keychain | Notifications only; see section 1 |
None of this leaves the device, and none of it is readable by other apps.
There are three, and no others.
On the very first launch the app asks its own server for the settings of this edition:
GET https://knotbow.space/atlas-manifest
The answer decides which shelf leads the atlas, the text of the Field Dispatch card, how many questions a drill round runs, whether notifications are offered, and — where one applies — the address of a notice to show you. The request carries no identifier and no information about you beyond what any web request necessarily includes, such as your IP address. The answer is stored on the device and the request is never made again.
If a notice address comes back, that page is opened in an in-app web view. It is an ordinary web page: what it loads, and what it records about the visit, is governed by the privacy policy of the site it comes from, not by this one.
To show the short Field Note on an entry the app requests a public article summary from the Wikipedia REST API in your language:
GET https://<language>.wikipedia.org/api/rest_v1/page/summary/<title>
The request is read-only, needs no key and no account, and carries no identifier and no information about you beyond what any web request necessarily includes — such as your IP address, which the Wikimedia Foundation handles under its own privacy policy. Responses are cached on the device so the same note is not fetched twice. If you never open an entry, no request is ever made.
If this edition offers notifications and you grant permission, the install identifier and the push token from section 1 are sent to the same server so that a notification can be addressed to this device. Nothing else is sent with them. If you never grant permission, this request never happens.
At launch the app also checks whether any radio is powered on, and in airplane mode it skips the Field Note warm-up entirely rather than attempting requests that cannot succeed.
There are two kinds, and they work differently.
Reminders — the daily knot and the streak nudge — are local notifications scheduled by iOS on your device, up to a week in advance. Nothing about them leaves the device. Both are off until you turn them on in Settings › Reminders.
Notices from us are push notifications, delivered through Apple Push Notification service and Firebase Cloud Messaging. They are offered only when this edition of the app is set up for them, they require your permission, and they require the install identifier and push token described in section 1.
Either kind can be switched off in the app or in iOS Settings at any time. Turning notifications off in iOS Settings also stops the push token being refreshed.
Knot Bow is rated 4+ and suitable for all ages. It has no user-generated content feed, no chat, no social features, no purchases and no advertising. Because it collects no personal information, it collects none from children either.
We hold no name, address, email or account for you. The only thing that can exist on our side is the pairing of an install identifier with a push token, and only if you allowed notifications. Everything else the app stores is under your control on the device:
Field Notes are short excerpts from Wikipedia, shown under the Creative Commons Attribution-ShareAlike 4.0 licence with a link back to the source article. The optional background music consists of public-domain recordings of Erik Satie's Gymnopédies obtained from Wikimedia Commons. Neither party receives any information about you from us.
Notifications are delivered by Apple Push Notification service and by Firebase Cloud Messaging, a Google service. Firebase Cloud Messaging is the only third-party SDK in the app; no other part of the Firebase SDK — no Analytics, no Crashlytics, no Remote Config — is linked. It receives the push token it issued and the content of a notification we send; it is not given your name, your photos, your logbook or anything else from the app. Google processes that data under its own privacy policy.
If the app changes in a way that affects this policy, the policy is updated and shipped with that version of the app. The date at the top of this page reflects the current version.
Questions about privacy can be sent through the contact form on the app's support page.