‘Stored on your device’ is an important privacy statement, but it is not a complete recovery plan. Local-only storage changes who routinely receives the data and also changes what you need to do before deleting an app, changing devices or losing a phone.
Local is a data path, not a magic word
For Body Log, local means the app stores its journal and media in its private iOS container and does not send them to an app-operated backend. There is no Body Log account holding another copy.
This reduces routine sharing, but the physical device, operating system and any whole-device backup settings still matter.
Device backup is separate from app cloud
An app can avoid operating a cloud service while its local container remains eligible for an encrypted whole-device iCloud or computer backup. That backup is controlled through the device ecosystem, not through a Body Log account.
If you need a specific backup boundary, review your iPhone settings rather than assuming every use of the word local means ‘never present in any device backup’.
Deletion can be permanent
Deleting a local-only app normally removes its private container from that device. Without a usable whole-device backup or an exported archive, the journal may be gone.
That is why a privacy-first app needs an honest export and restore workflow rather than treating cloud sync as the only recovery option.
Exports inherit the sensitivity of the original
A portable archive gives you control over the destination, but it also creates a file you must protect. Body Log verifies archive integrity during restore; the current export is not encrypted.
Save it deliberately, confirm it exists and keep it somewhere appropriate for intimate photos.
The takeaway
Local-only reduces routine data sharing; it also makes deletion, device backup settings and deliberate exports part of your responsibility.
Body Log articles are general educational material about keeping a personal record. They are not medical advice or a substitute for professional care.