Data Portability Contract
Current contract: backup format V4; restore support: V4 only.
A backup is a point-in-time JSON export, not a sync service. It contains your timeline visits (including times, precise coordinates, place names, activities, notes, route data when recorded, and related Health-derived timeline records), the people you've tagged "With" on a visit, Saved Places, corrections, retained diagnostics and location callbacks, activity definitions, your activity groups' order and colours (including an empty custom group with nothing recorded in it yet), and portable preferences. If you've turned on Calendar as corroborating evidence and separately enabled detailed diagnostics, a retained diagnostic entry can include a matched calendar event's title — the same way it can include a Maps place name. It does not carry iOS permission grants, your Apple account, or OwnDay server data — OwnDay has no server data.
OwnDay creates and restores V4 backups. It intentionally rejects backups older or newer than V4 before replacing any data. This avoids silently guessing at fields whose meaning has changed. If a backup is outside that format, use a compatible version of OwnDay or keep the JSON safely until a supported migration path is available.
OwnDay also rejects unreadable, incomplete, or invalid backups before changing the destination. Its manifest records a count and, on backups created since section digests were introduced, a digest for each section; restore checks both before touching the destination. These are corruption checks, not a signature, password, or encryption — they catch an accidentally truncated or altered file, not a deliberately tampered one. A backup made before section digests existed is still accepted for restore, with a preflight notice that integrity checking wasn't available when it was created. Either way, treat a shared JSON file as sensitive, readable data.
Restore is a full replacement, not a merge. Once a supported backup has passed validation, OwnDay replaces the device's visits, tagged people, Saved Places, corrections, diagnostics, location callbacks, activity definitions, activity group order and colours, and portable preferences with the backup's contents. A backup made before activity groups had their own section restores everything else as usual, leaving the device's existing group order and colours untouched — the preflight screen says so before you confirm. If validation or the final save fails, OwnDay rolls back the staged replacement so the existing archive remains intact. Create a fresh backup before restoring if you may need the device's current data later.
OwnDay does not automatically retain, upload, update, or delete a backup you have saved through the Share Sheet. A shared copy can be copied again, read as JSON, and retained by its recipient. Deleting OwnDay or erasing its local data does not delete copies you placed in Files, iCloud Drive, email, or another service. Before sharing, consider whether the recipient needs your location history, notes, the names of anyone you've tagged, routes, diagnostics, and activity information; share only with people and services you trust.