What's changed

BondBook · Every change to how we handle your data, newest first

Notes that mention sensitive details aren't read

Published 2026-11-13, in effect from 2026-11-13.

BondBook isn't meant for sensitive details about anyone: their health, religion or beliefs, politics, sex life, sexuality or gender, race or ethnicity, trade union membership, genetic or biometric data, or crimes. When a note mentions one, Bond keeps the note as you wrote it but doesn't read it: nothing from it is added to a profile, made into a reminder, or used to answer questions, prepare for a meeting or suggest gifts. Food allergies are the one exception, as before.
To know, Bond checks each note before reading it, when AI features are on. A note saved without Bond reading it first is sent on its own for the check, and one that mentions such a detail is never sent again.
In a chat, Bond leaves a detail like this out of anything it adds, and no longer offers to add it when you ask. The message that mentioned it, and Bond's reply, aren't sent to our AI provider again.
Money matters, such as someone's debts or salary, are still left out of profiles, but don't stop Bond reading a note.
Details like these already on a profile, and in Bond's suggestions, are being removed. Your notes and messages stay as you wrote them.

Published 2026-11-13, in effect from 2026-11-13.

Your answer when BondBook asks whether to turn on AI features, Not Now included, is now kept with your account rather than only on your phone, so another phone doesn't ask again.
A closeness BondBook didn't recognise, such as "Sister", is now kept as a tag on that person, who then has no closeness.

Published 2026-11-10, in effect from 2026-11-10.

A message to Bond is kept on your phone until Bond has answered it, or until you save it as a note or delete it. It's encrypted while the phone is locked, isn't backed up, and is deleted when you sign out.
Deleting a contact takes them off Bond's lists, and the rest of each list stays, unless a list held only them. A reply about them, that changed them, or whose words or question name them, by their name or a nickname, is still deleted with them, with the question it answered.
The copy kept so something Bond saved can be undone is kept for 30 days from when you saved it, not from when Bond prepared it.

Published 2026-11-10, in effect from 2026-11-10.

A note you save before Bond has read it, or while offline, is kept unread, with any corrections you made. Nothing from it reaches a profile until it's read: with Read Now on the note, where you check what will be filed and for whom before you save it, or from the Notes list, which reads your unread notes and files what it finds without showing each one.
Read Now on a note sends that note, your name and that contact's profile, without phone numbers or email addresses, as a preview of a new note does. To work out who the note is about and how you were in touch, it also sends the names of the contacts the note mentions, as writing a note does.
A note you're writing, or one still open when the app closes, can be kept as a draft on your phone. It's encrypted while the phone is locked, isn't backed up, and is deleted when you sign out.

Published 2026-11-10, in effect from 2026-11-10.

Opening a place from an event's details shows it in Apple Maps, which then gets that place's name or address.

Published 2026-11-09, in effect from 2026-11-09.

A reminder you tick off is kept for 30 days, then deleted. One that repeats moves on to its next date instead.
Deleting a contact also deletes the reminders about them that you've ticked off. Those still to do stay, without the contact.
One-off reminders whose day was more than a week before this change count as ticked off on that day, so those more than 30 days old are deleted.
A reminder can have notes of its own, kept with it.

Published 2026-11-09, in effect from 2026-11-09.

When you ask to delete your account, every device is signed out, and everything in it is deleted 30 days later. Until then you can sign in and keep it, or export your data.
We email you when you ask, and a receipt when it's done. Encrypted backups that hold the account are deleted within 14 days after that.
A record of each deletion, with no name, is kept for 12 months, so restoring a backup can't bring a deleted account back.

Published 2026-11-08, in effect from 2026-11-08.

Bond doesn't add a detail that looks sensitive, such as about someone's health, beliefs, politics, sexuality, ethnicity, union membership, crimes or money trouble, unless you keep it. It never works one out from a hint.
Gift ideas, questions to ask and suggested circles never draw on such details.
Food allergies and diets such as vegetarian are added as before.

Published 2026-11-08, in effect from 2026-11-08.

When you save a note, Bond adds only what it showed you before you saved. A note saved without that, or changed since, waits until you review your notes.
What Bond read in a note before you saved it is kept until you save it, and a day at most.
Ask Bond's list of your contacts now holds only their names, closeness and company. It never receives phone numbers, email addresses or street addresses.
Sign-ins now end 90 days after you last use them, and a year after signing in at the latest.

Published 2026-11-08, in effect from 2026-11-08.

Deleting a contact or note now also removes Bond's chat replies that showed it, review suggestions that named it, and saved copies of it.
Your chat with Bond is kept for 90 days, and copies kept so a change can be undone for 30 days.
Your export no longer includes undo copies or the fingerprints BondBook uses to notice changes, and lists photos by where to download them.

Published 2026-11-08, in effect from 2026-11-08.

The companies that handle your data, what each receives and how long it's kept are now listed from one record, which the app and our checks read.
Our server no longer has any way to read Gmail: those unused parts were removed.
Server logs no longer record network addresses and are deleted after 30 days.
Account emails no longer load fonts from Google, and Postmark's open and link tracking is off.