Privacy
Last updated 15 November 2026
The short version
Your paired content is end-to-end encrypted. Safety reports contain readable names and information you choose to include. Knock also stores limited account activity, app version and language data. No ads or cross-app tracking.
There is no third-party analytics, no crash reporting, no advertising, no tracking, and no third-party code of any kind in the app.
What is stored, and where
Each pairing has an encrypted record in Apple's CloudKit: your chosen name and face, status, time zone and quiet hours, activity days and totals, optional relationship date, latest knock time and a bounded rolling day of knock times, current backdrop or drawing, unexpired text or photo notes, and any FaceTime contact you choose. Photo metadata is removed before sharing. Voluntarily shared One place or Live positions, capture time, accuracy and fixed expiry travel in the same encrypted per-person profile, separately from note photos and push content.
Knock encrypts the content in these shared records on your device before upload. It uses a key generated when you pair and shared with the other person. Your device stores the key in Keychain, which can sync to your own devices through iCloud Keychain.
Knock also syncs a separate roster through your private iCloud database so your pairings can follow you to other devices. This copy can include names, faces, status and time zone, country, FaceTime contact details, backdrops and drawings, pairing activity and preferences. Apple’s iCloud account controls protect this copy. Knock’s relationship encryption applies to the shared records described above.
Country sharing is optional and separate from place sharing. For a paired person, choose One place or Live for 15 minutes or one hour, start sharing yourself or accept their request. Place coordinates are captured only after that choice and iOS location permission. Each direction has its own consent, mode, duration and fixed expiry from acceptance; sharing back is optional. One place captures a single fix. Live updates the latest place and can continue in the background or while locked, with the iOS background location indicator. Updates depend on iOS, GPS and connectivity. When you return to Knock, Live reconnects automatically if Location access is allowed; the original expiry does not change. Stop ends capture here; an offline partner can retain the last place until sync or original expiry. Only this paired person can read the encrypted place. Knock keeps no GPS route history. Apple handles map and geocoding requests separately from encrypted partner sharing. Distance and direction use only the two valid shared positions, with north as the reference. Unpairing or Erase everything does not delete already submitted safety reports or the separate account-activity/version records. Contact support about those records.
Account and pairing identifiers and record update times are readable in CloudKit. These are pseudonymous, not anonymous: account identifiers support blocking and can link activity to an account. They do not contain your Apple email address.
During use, Knock records limited first-party activity: an account-linked last-seen date, app version, language and region, including a daily version row keyed by a deterministic account hash. A hash does not make these records anonymous. This is used for app operations and basic version analytics, not advertising.
When you use Knock on your paired Apple Watch, your iPhone sends it the display names, pairing identifiers, emoji and available face thumbnails of your confirmed pairings. The watch uses them to show your people and ask the iPhone to send a knock. It does not receive notes, view-once photos, locations or encryption keys.
What we can see
Your paired content is end-to-end encrypted. Safety reports contain readable names and information you choose to include. Knock also stores limited account activity, app version and language data. No ads or cross-app tracking.
A safety report is readable by the developer. It includes both account identifiers, the displayed names, your chosen reason, comments, app version and submission time, plus up to three recent received notes only if you opt in. This is not encrypted partner content. Do not put information in a report that you do not want reviewed.
That is the complete list. Nothing else is attached to a report, and nothing else you or your person has written, drawn or shared is ever readable by us.
For administration, existing account-activity and app-version data may be read by a private, authenticated dashboard hosted on Vercel. It does not decrypt partner content or add advertising tracking.
What Knock does not do
Your paired content is end-to-end encrypted. Safety reports contain readable names and information you choose to include. Knock also stores limited account activity, app version and language data. No ads or cross-app tracking. Country sharing is optional and separate from place sharing. For a paired person, choose One place or Live for 15 minutes or one hour, start sharing yourself or accept their request. Place coordinates are captured only after that choice and iOS location permission. Each direction has its own consent, mode, duration and fixed expiry from acceptance; sharing back is optional. One place captures a single fix. Live updates the latest place and can continue in the background or while locked, with the iOS background location indicator. Updates depend on iOS, GPS and connectivity. When you return to Knock, Live reconnects automatically if Location access is allowed; the original expiry does not change. Stop ends capture here; an offline partner can retain the last place until sync or original expiry. Only this paired person can read the encrypted place. Knock keeps no GPS route history. Apple handles map and geocoding requests separately from encrypted partner sharing. Distance and direction use only the two valid shared positions, with north as the reference.
Camera
Knock uses the camera to scan pairing codes or to take a view-once photo at your request. Scanning a code does not upload a camera image. When you choose to send a photo, Knock removes camera metadata and end-to-end encrypts it for the person you send it to. You can decline camera access and still pair by entering a code or opening a link.
Your person can open the photo once. In the latest app it stays visible for up to seven seconds from the moment it appears. The viewing time can differ on older versions. You can withdraw an unopened photo when both versions support withdrawal. An unopened photo expires one hour after sending. Encrypted photos and open receipts can remain in CloudKit until a later successful profile update removes expired data. The recipient can still capture a copy outside Knock.
Notifications
Knock only notifies you about someone you are already paired with, or someone asking to pair: that they are thinking of you, that they want to talk, or that they want to be your person. No reminders, no announcements, no marketing, and nothing designed to pull you back into the app. An optional location-start alert may arrive once per sharing session on supported versions, subject to notification permission and delivery. Stop and live-position updates send no alerts. Quiet hours and mute settings apply. A view-once photo can trigger a notification without the image.
Deleting your data
Unpairing removes the local pairing and schedules deletion of your encrypted shared side. Erase everything also resets your identity, history and settings. Pending deletion is disclosed; Knock retains random identifiers needed to retry, and busy local files can remain until cleanup runs again. Expired notes, photos and pins are cleaned when the app or widget next processes them. A recipient may have kept a screenshot or another copy. Knock also keeps random local markers so delayed work cannot restore a removed pairing. They contain no names, photos, notes, coordinates or encryption keys. Unpairing or Erase everything does not delete already submitted safety reports or the separate account-activity/version records. Contact support about those records. Shared locations have a fixed expiry; offline partners may keep the last pin until expiry or until revocation reaches them. No route history is kept by Knock. Apple handles map and geocoding requests separately from the encrypted partner profile.
Children
Knock is not directed at children under 13 and does not knowingly hold data from them.
Changes
If this policy changes, the date above changes with it, and the app's App Store privacy details are updated in the same release.