Boring

Privacy policy

Last updated 26 October 2026.

Boring is an inbox of new videos from the creators you follow. It is built to know as little about you as it can. There is no Boring account and no Boring server: the app reads feeds straight from the places that publish them, and keeps what you do on your own devices and in your own iCloud.

This page covers the Boring app for iPhone and iPad and this website. It is written to match what the app's code actually does, and the code is checked against it every time it changes.

The short version

• We don't collect your name, email address, contacts, location or anything else that identifies you.
• What you follow and what you've watched stay in your own private iCloud database. We can't see it.
• We don't sell or share data, show ads, or track you across other apps and websites.
• Everything the app sends or receives is encrypted with HTTPS, and your Google sign-in is locked in your device's Keychain.
• Crash reports go to a server we run ourselves and carry no personal data.
• The app counts which screens and buttons get used, anonymously, with PostHog. You can turn that off in Settings.
• This website counts visits with PostHog and with our own counter, and sets no cookies.

What stays on your devices

Your follows and the state of each video (new, seen, watch later, archived) are stored on your device. If you're signed in to iCloud, Apple syncs them between your devices through your private iCloud database, which only you can read. The developer has no access to it. Apple's handling of iCloud data is covered by Apple's privacy policy.

The video list itself, including titles, thumbnails and descriptions, is rebuilt on each device from the feeds and never syncs. Your filter and sort choices and the Super Boring setting are remembered on that device only.

The Picked sort learns from what you do in Boring: which videos you queued, watched (and how far through), opened in YouTube, or archived unwatched, and which channel each was from. That record syncs like your video states, through your private iCloud database, and nowhere else. The Picked order and its reasons are worked out on your device and never leave it. You can reset what Picked has learned in Settings.

Summaries of video descriptions are made on your device by Apple Intelligence. The description never leaves your device to be summarised, and summaries are kept on the device.

To keep your devices in step, iCloud may send the app silent background notifications when something changes. Boring never shows you notifications and never asks to.

Who the app talks to

Boring fetches what it needs directly from these services. Like any internet request, each one sees your device's IP address and the request itself. None of them receives your iCloud data.

Beyond those, the app also contacts:

• The feeds you follow. If you follow an RSS or Atom feed, the app reads it from the website that publishes it, and loads its images from wherever the feed says.
• YouTube's image servers for channel icons, at the address YouTube gives for each channel.
• YouTube's player. Videos play in YouTube's official embedded player, which loads from YouTube and works as it does on any website, including the cookies and measurement YouTube uses. Google's privacy policy covers it.
• Apple, for iCloud sync, Apple Intelligence availability, and App Store or TestFlight services.

Connecting your YouTube account

This is optional. If you connect your account, you sign in with Google in a secure Apple sign-in window and give Boring read-only access to your YouTube account (the youtube.readonly permission). Boring uses it for one thing: reading the list of channels you subscribe to, so it can follow them for you.

The sign-in is stored in your device's Keychain, on that device only. It never syncs and never reaches the developer. Disconnecting deletes it from the device and asks Google to revoke it. You can also remove Boring's access at any time from your Google account.

Boring's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Boring uses YouTube API Services, and by using that feature you agree to the YouTube Terms of Service.

How your data is protected

Boring is designed so that your data, and anything it gets from your Google account, stays with you. These are the protections in place.

• Encrypted in transit. Every request the app makes uses HTTPS (TLS). The app keeps iOS's App Transport Security on with no exceptions, so iOS refuses any unencrypted connection, including to a feed added with an http:// address.
• Your Google password never reaches Boring. You sign in on Google's own page, inside Apple's secure sign-in window, using OAuth with PKCE. Boring only receives a token for the read-only permission you grant.
• Tokens locked in the Keychain. The long-lived Google token is stored in the iOS Keychain, encrypted by iOS, readable only by Boring, only on that device, and only after the device has been unlocked since it started. It is never synced, backed up to another device, sent to the developer, or included in crash reports. The short-lived access token is only held in memory and is never written to disk.
• YouTube data stays on your devices. The list of channels you subscribe to is read straight from Google to your device. Boring keeps the channel IDs it needs in the app's own storage on that device, which iOS encrypts. The channels Boring follows for you sync only through your private iCloud database, which Apple encrypts in transit and at rest and which only your Apple Account can read.
• No servers of ours. No data from your Google account ever goes to the developer or to any server other than Google's and your own iCloud. Nobody but you can read it, and the developer has no way to.
• Crash reports carry none of it. Reports are stripped of tokens, keys, codes, cookies and query strings before they leave the device, and never include your subscriptions or what you follow.
• Deleting it. Disconnecting your YouTube account in Boring deletes the token and the saved subscription list from the device and asks Google to revoke Boring's access. Unfollowing a channel removes it from iCloud. Deleting the app removes everything on that device.

Boring's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to follow the channels you subscribe to. It is never sold, used for advertising, used to train AI models, or shared with anyone, and no person reads it.

Crash and error reports

When the app crashes or hits an error, it sends a report to a Sentry server the developer runs at oops.nickjones.tech, so the problem can be fixed. Reports say what went wrong: the error, where in the code it happened, the device model and system version, and the app's version.

Reports never carry your IP address, an identity, screenshots, a recording of the screen, or the layout of what you were looking at. Web addresses in reports lose everything after the ?, and tokens and keys are removed. Only a small sample of performance timings is sent.

If you install Boring through TestFlight, Apple may also share crash logs and any feedback you choose to send with the developer, as described by Apple.

Usage analytics

To see which parts of the app get used and which don't, the app records what you do in it, anonymously, with PostHog, sending to PostHog's servers in the EU: which screens you open, and which buttons, swipes and settings you use. Each event's details are only choices from short fixed lists, such as which list an item was in, whether it was a video or a Short, or which sort you picked. The app also records when it opens, its version, whether it's a TestFlight or App Store build, and the device model and system version.

Events never include what you watch or follow: no video or channel titles, names or IDs, no links, nothing you type, and nothing from your Google account. Each install gets a random ID made on the device, so events from one install can be counted together, but it isn't linked to you: Boring never tells PostHog who you are, keeps no profile of you, and records no screens or session replays. Boring asks PostHog not to work out your location from your IP address, though PostHog sees the address as part of each request, as any server does.

To stop it, turn off Share usage analytics in Boring's Settings. From then on the app sends nothing to PostHog, and it remembers that choice on the device.

Code from others in the app

Boring includes two third-party libraries: sentry-cocoa, which sends the crash reports described above, and posthog-ios, which sends the usage analytics described above. Neither contains advertising code.

What the app asks Apple for

• iCloud (CloudKit), to sync your follows and video states through your private iCloud database.
• Background refresh, so iOS can let Boring check your follows for new videos now and then while it isn't open. It does what a refresh you start yourself does, with the same services listed above, and nothing more.
• Background notifications, the silent kind iCloud uses to tell the app something changed on another device. No notifications are shown and you're never asked to allow them.

Boring doesn't ask for your camera, microphone, photos, contacts, location or anything else.

This website

The home page of boring.nickjones.app uses PostHog, sending to PostHog's servers in the EU, to count visits and see how the page is used, such as which links are clicked. PostHog keeps its state in memory, so the site sets no cookies and doesn't recognise you on a later visit. PostHog sees your IP address and browser details as part of each request. Every page of the site also loads a page-view counter that we run ourselves at t.nickjones.app, which counts visits and the pages they view without cookies. Nothing else on the site loads from another company. The site is hosted by GitHub Pages, which keeps its own server logs, covered by GitHub's privacy statement.

Children

Boring isn't directed at children under 13 and doesn't knowingly collect anything from them.

Your choices

• Turn off iCloud for Boring in Settings to keep everything on one device.
• Disconnect your YouTube account in Boring's settings at any time.
• Turn off Share usage analytics in Boring's settings to stop the app sending usage analytics.
• Deleting the app deletes its data on that device. To delete what's in iCloud, go to Settings, then your name, then iCloud, and manage storage for Boring.
• To ask about or delete a crash report, get in touch below.

Changes

When what Boring does with data changes, this page changes with it, and the date at the top moves.

Contact

Boring is made by Nick Jones. Questions about privacy can go to nick@nickjones.tech.