No account, stored on the device: how to choose a goshuin record app

This article covers one thing: how to check where a goshuin record app keeps your records, and where it sends them. It does not compare named apps, so as not to assert what cannot be verified from outside.

Are there goshuin record apps you can use without signing in?

There are. But “no sign-in” and “your records never leave the phone” are not the same claim. Choose with those two run together and you end up with something other than what you thought you were getting.

A goshuin record is a list of when you went where, and for some people it is also a record of religious practice. It is natural that so many people care where that list is held, and plenty of apps say something reassuring about it. The trouble is that the words they use point at quite different things.

The four claims people run together are four different claims

“No account”, “stored on the device”, “no advertising” and “no network” can each be true on their own without making any of the other three true. Here is what each one actually says, and what can still be happening while it is true.

You do not need all four. What matters is deciding first which one you actually care about.

• You don’t want anyone else seeing what is in your records → look at whether they are stored on the device
• You don’t want the bother of registering → look at whether an account is required
• You don’t want to be interrupted while you work → look at whether there is advertising
• You want it to work with no signal → look at whether it needs a network

If one of them is your reason, there is only one thing to check.

The payment model changes it too

One-time or recurring, the first thing to check is whether you can get your records out after you stop paying. How you pay is not unrelated to how you hold the records.

A single payment is done once and nothing follows it, so the longer you use the app the less it has cost you. The other side of that is that the developer has no continuing income, and updates can thin out.

A recurring payment buys you a reason to expect updates for as long as you keep paying. The other side of that is that the app can stop working the moment you stop.

Where you cannot confirm that your records come out after you stop paying, the safer answer is to walk away, whatever the payment. Years of visits becoming unreadable the moment a payment stops is the one outcome worth choosing against.

The same fork arrives when you change phones. What to settle about getting your records out before you move to a new device is written up separately.

How much of the location do you keep?

In an app where you pick the shrine or temple from a built-in list, the location of the one you picked is attached to the record. If you want to decide record by record whether a location is kept at all, an app where you type the name yourself suits you better. This gets overlooked far more often than the question of where the records are held.

An app that lets you search and pick a place is carrying a list of shrines and temples with their locations. That is convenient for drawing a map, but it also means a list of when you went where, each entry with a location attached, is sitting on your phone.

A design with no built-in list is perfectly possible: you type the name of the shrine or temple, and only when you want a location do you tap the map to drop a pin. You lose the convenience of searching, and you gain a place that appears on no list, recorded by exactly the same steps.

Neither is the better design; they put different things first. What is worth looking at either way is whether an app that asks for location permission says what it needs the permission for.

What changes when a record is not built for sharing

In an app built around posting and publishing, keeping a record to yourself means finding the private setting — and where public is the default, you can end up visible to other people without ever noticing. A record in an app with no sharing mechanism cannot be published inside the app at all.

Some people want to show their goshuin records to others; some have no wish to at all. Neither is the right answer, but which one you are is worth settling before you choose. Even when you do want to show them, there are things to take out before anyone else sees them: your own notes to yourself, and anything that gives away where you live.

The checklist you can run yourself

Four things: where the privacy policy says records go, which kind of export there is, the reason for each permission, and how much works without a purchase. The store description will not answer any of them, so go through them one at a time.

1. Does the privacy policy say where records are sent? If nothing is sent, it should say that nothing is sent. Silence is not evidence that nothing is sent.
2. Is there an export? With one, your records stay in your hands even after you stop using the app. But an export comes in two kinds: a backup meant to go back into the same app, and a readable export — CSV, PDF — for a spreadsheet or for paper. If the backup opens in that app and nowhere else, the second kind is the only one that lets you read your records after you leave.
3. Can each permission it asks for be explained by a feature? Location and photos alike: there should be an answer to what it is for.
4. How much works without a purchase? Better to know that up front than to build a pile of records and then find out that a purchase is required.

How the app I make handles this

The app I develop, Goshuin Ledger, needs no sign-in and no account registration, and keeps records and photos on the device. In exchange, it does not sync records between devices. For reference, here it is in the order of the checklist above.

Records and photos are never sent out of the app, and no advertisements are shown. It is not the case that it never connects, though: it does when it draws the map, and when a purchase is made or restored through the App Store. What is sent and where it goes is set out in the privacy policy.

The records on the device are included in the standard iOS backup and transfer (iCloud Backup and Quick Start). Separately from that, you can export an encrypted file — the backup — with a passphrase, and import it on a new phone. Its contents cannot be read by opening it, and if you forget the passphrase, nothing can be brought back from that file. The form that makes your records readable outside the app is the PDF / CSV export.

It never asks for location permission and stores no addresses. Keeping a location is optional; when you keep one, you tap the map to drop a pin. It only receives the photos you chose in the iOS photo picker, and never asks for permission to read your whole photo library.

Without a purchase, the first book records as many entries as you like, and exporting and importing the backup work as well. A second book and beyond, adding two or more imported photos to a book in one action, and the PDF / CSV export come with the one-time Ledger Full. There is no subscription. What the purchase covers is set out on the pricing section, and the App Store shows the current price.

The run from importing the photos to seeing them settle into books and pages is in how to organise the goshuin photos piled up on your phone into a record afterwards.