The On-Device Manifest

What Core ML is — and why it matters for privacy

Core ML is Apple's on-device machine-learning runtime. In ordinary terms, it is the part of iOS that takes a trained model — a file full of numbers describing how a network of small mathematical functions should respond to input — and runs that model directly on the iPhone you are holding. The model ships inside the app bundle. When the app asks it a question, the phone's own silicon answers. No server is contacted. No request leaves the device.

Contrast this with the more familiar cloud-ML pattern. In that pattern, the app you are using gathers your input — your text, your voice, your photo — packages it, and sends it across the internet to a data centre. A larger model runs there, returns an answer, and the company operating the data centre is, by construction, in possession of your input. Logs exist. Backups exist. Subpoenas reach servers. The privacy story of any cloud-ML feature is, ultimately, a story about who you are trusting with the raw text of your private life.

Hymalayas is built around Core ML because the entire privacy posture of a Sadhana (spiritual practice) app collapses if your journal is legible to anyone but you. On-device inference is the only honest architectural answer. It is not a policy promise, not a terms-of-service clause, not a pinky-swear in a settings screen — it is a property of where the computation physically happens. Your journal is read by your phone. Nothing else.

What on-device NLP means in plain language

NLP — natural language processing — is the family of techniques that let software make sense of written text. For a Sadhana app, the useful kinds are narrow and well-understood: classifying the sentiment of a sentence, extracting the small set of themes a paragraph is circling, recognising whether a mood note reads as tender, restless, grateful, or grieving. None of this requires a large language model. None of it requires the cloud.

On-device NLP means each of those small jobs is performed by a compact Core ML model that lives inside the Hymalayas app. The model reads your text inside the app's sandbox. It produces an output — typically a small numeric vector, a handful of floating-point numbers describing how the model classified the input — and that vector is what gets saved. The original sentence is also saved locally so you can read it back later, but only the vector is what the digest and the long-arc analyses operate on. Neither the sentence nor the vector is ever transmitted by Hymalayas.

This is a deliberately modest use of machine learning. We are not interpreting your words back to you, not generating advice, not summarising your inner life into a paragraph that pretends to know you. The Bodh (insight) of the practice is yours; the model's job is only to count gently, so that the monthly digest can show you the shape of what already happened.

What happens when you write a journal entry

Here is the precise sequence, with no abbreviation, of what occurs when you tap into the journal field and write a sentence.

1. You write into the journal field. The keystrokes go into a text buffer that exists only in the app's working memory.
2. While you are writing, the text is held only in app memory. It is not auto-uploaded, not backed up to a Hymalayas server, not mirrored anywhere off-device.
3. When you finish the entry, a Core ML sentiment model scores the text on-device. The scoring runs on the Neural Engine, the GPU, or the CPU — Apple's runtime chooses based on the device generation and current load.
4. The score — a small set of numbers describing sentiment, theme weights, and a coarse mood classification — is saved into the device's encrypted local store, protected by the iOS Data Protection class tied to your device passcode.
5. The original text of the entry is also saved locally, in the same encrypted store, so you can re-read it. It is never transmitted off the phone by Hymalayas.

A few qualifications are honest to add. If you have iCloud backup enabled at the OS level, Apple may include the app's local store in your encrypted device backup; that is a setting under your control in iOS, governed by Apple's end-to-end encryption policies, not by Hymalayas. If you uninstall the app, the local store is removed by iOS along with it. If you want to export your journal, the export is generated on-device and handed to the iOS share sheet — where it goes from there is your choice.

The shape of the guarantee is simple: the only path your words take is from your fingertips to a piece of silicon a few millimetres away, and from there to an encrypted file on the same device. That is the entire route.

What happens with mood data

The daily mood check-in follows the same shape as the journal, with smaller inputs. When you tap a mood — a single word, sometimes with an optional one-line note — the selection is captured into app memory. If you have written a note, a Core ML classifier scores it on-device into the same small numeric space the journal uses, so that mood text and journal text can be aggregated coherently in the digest. The mood label and the score are written to the encrypted local store. Nothing is uploaded.

Over weeks, the mood log becomes the spine of what the digest can show: a quiet record of which days were tender, which were restless, which carried Shanti (peace). The digest reads from the local store; it does not call out for help. If you turn off mobile data and disable Wi-Fi, the mood feature continues to work in exactly the same way it did with the network on. There is no degraded mode, because there was never a network round-trip to degrade.

One detail worth naming: the mood vocabulary itself ships inside the app. We do not pull a remote list of moods, and we do not report back which mood you picked. The app has no telemetry channel for mood selections.

What happens with breathing session data

A breathing session — a Pranayama (breath discipline) practice — is recorded as three things: the chosen pattern (for example, four-in, seven-hold, eight-out), the session length, and a timestamp. Those three are always captured locally and written to the encrypted store. They are sufficient on their own for the digest to count your practice and for the in-app history to render.

If you have connected Apple Health and granted Hymalayas permission to read heart-rate and heart-rate-variability samples, the session will additionally annotate itself with the relevant samples drawn from Health for the window of the session. That data flows through Apple's HealthKit permission system directly into the app sandbox. It does not transit any Hymalayas server. We never aggregate it across users, because we never see it across users; we do not see it across one user.

Apple Health permission is granular and revocable. You can grant read access for heart rate but not for HRV, or revoke both at any time from the iOS Health app. If permission is absent or revoked, the breath session simply records pattern, length, and timestamp, and the digest reflects what is available. No feature is gated behind Health access; the deeper signals are an enrichment, not a requirement.

How the monthly digest is generated on-device

At the close of each month, Hymalayas assembles a digest — a one-screen reflection of the practice that has accumulated. The assembly is performed by a small Core ML pipeline running on the phone. It reads the local store: the sentiment vectors from journal entries, the mood log, the breath session records, the Wisdom Cards earned along the way. It aggregates these into a handful of summary statistics and short qualitative notes — for example, the dominant theme of the month, the count of practice days, the rough arc of mood across the four weeks.

The digest renders inside the app. Generation is best-effort and depends on the hardware generation: on recent devices the pipeline completes in seconds; on older devices it may take longer and may fall back to CPU execution. None of the inputs and none of the outputs are transmitted. The digest is not stored on a server, not mirrored to a web dashboard, not emailed. If you want to keep a copy, the iOS share sheet can hand the rendered digest to wherever you choose.

We chose this design because the monthly digest is the most temptingly cloud-shaped feature in the app. It is the moment when a conventional product would say: "upload everything, run the big model, send the answer back." Doing it on-device costs us engineering time and constrains the size of the models we can use. We accept those costs. The Dharma (right way) of the feature is that it stays on the phone.

What Apple's Neural Engine is

The Neural Engine is a piece of custom silicon Apple has shipped on every iPhone since the A11 chip in 2017. It is a coprocessor designed specifically for the kinds of arithmetic that machine- learning inference performs — large numbers of small multiplications and additions, executed in parallel, at low power. It sits next to the CPU and GPU on the same die, and Core ML can dispatch work to whichever of the three is most appropriate for a given model.

Why this matters for an app like Hymalayas: before purpose-built on-device ML silicon existed, it was genuinely difficult to run even modest models on a phone without draining the battery or stalling the interface. The honest engineering excuse for cloud ML — "the phone cannot do this" — was often true. Since 2017 that excuse has steadily eroded. For the model sizes Hymalayas uses, the Neural Engine answers in milliseconds and costs a negligible fraction of battery. The architectural argument for shipping your text to a server has become, for our use cases, a choice rather than a necessity.

We will not overclaim. The Neural Engine cannot run arbitrarily large models, and the gap between on-device and large server-side models is real for tasks like long-form generation. For the narrow, well-defined work Hymalayas asks of ML — sentiment, theme, aggregation — the gap is small or nil, and the privacy gain is total.

Why on-device is harder to build — and why Hymalayas chose it

Cloud-side ML is, plainly, faster to ship. A team can iterate on server-side models without releasing a new app version, observe aggregate behaviour to find what is working, and roll out improvements continuously. On-device ML demands that every model improvement ride along with an App Store release, that the model fit within the bundle size and the device's memory budget, and that the team forgo the kind of usage telemetry that ordinarily guides product decisions. We do not see what people write. We do not see which features they use. We have to design more carefully because we will learn less afterwards.

Hymalayas chose on-device anyway because the journal is a sacred space. A practitioner sits down with the app at the end of the day and offers it the kind of sentence they might not say to a friend. That moment cannot be conditional on a server's good behaviour, on a vendor's retention policy, on the quiet hope that no one subpoenas the data centre. "The temple is yours alone" is not a marketing line; it is an architecture commitment. It costs us engineering time, it constrains what we can build, and it is exactly the right cost to pay.

This is also the first principle of the brand. Karma (action) in this context is what the system actually does, not what its marketing claims. An app that promises privacy and ships a network call has lied. An app whose architecture makes the network call impossible has told the truth in the only language a computer understands. The On-Device Manifest is a record of that truth, in plain language, so that any practitioner — engineer or not — can read it and know what is happening to their words.

Questions

Where does my journal entry go after I write it?

It is held briefly in the app's working memory, scored by a Core ML sentiment model running on your iPhone, and then written to the device's encrypted local store. The original text and the resulting numeric score never leave the phone. There is no server upload, no analytics ping, no shadow copy. If your device is offline forever, the journal still works.

Does Hymalayas use Apple's Neural Engine?

Yes, where the hardware supports it. On any iPhone with an A11 chip or newer (2017 onward) the Core ML runtime can dispatch inference to the Neural Engine, the GPU, or the CPU depending on the model and the device's current state. We do not control that scheduling — Apple's runtime decides. On older devices the same models still run, just on the CPU or GPU, with slightly higher battery cost.

What is Core ML?

Core ML is Apple's on-device machine-learning runtime. It loads a model file that ships inside the app and runs predictions locally using the device's silicon. The phone does the work; no server is contacted. For Hymalayas, Core ML is the reason we can do sentiment scoring, theme extraction, and the monthly digest aggregation without ever sending your words anywhere.

Why don't you use cloud ML — is on-device worse?

Cloud ML is faster to ship and easier to update. It is not worse for accuracy on most tasks Hymalayas performs; modern on-device models for sentiment and short-text classification are competitive. The trade-off we accepted is engineering time and slower iteration in exchange for an architectural guarantee that your journal never leaves your device. We believe a private journal needs that guarantee at the architecture layer, not at the policy layer.

Can the app function without Apple Health connected?

Yes, fully. Apple Health is optional. If you connect it and grant permission, breath sessions can read heart rate and heart-rate variability so the digest reflects more of what your body did. If you do not connect it, breath sessions still record session length and the practice still counts. Nothing is gated behind Health access.

What signals are stored about a breath session?

Session length, the chosen Pranayama pattern, and — only if you have connected Apple Health and granted permission — heart rate and heart-rate variability sampled during the session. All of it lives in the device's encrypted local store. Apple Health data flows through Apple's permission system directly into the app sandbox; it does not pass through any Hymalayas server.