Android privacy

Permissions and information on your phone

Accessibility: with your permission, the app identifies the foreground app and shows the blocking screen when a chosen app is blocked. When Record activity is on, it also records time intervals and switches between apps. This works while you use other apps, even when The Experiment is not on screen.

A separate website-blocking choice allows reading Chrome’s visible, unfocused address bar to compare its domain with your block list. The app does not inspect messages, passwords or page contents, and it does not save or upload visited URLs. Hidden address bars and other browsers are not covered by this website check.

Usage Access: the app reads recent usage events supplied by Android to show Screen Time, app names and durations, suggest apps to block, and add observed intervals to your attention history. Missing observations stay unknown. App names, per-app history and your selected Android app list stay on this phone. The app also reads the names and icons of available apps for its block-list picker.

Camera: used only to scan your computer’s connection QR code. The scanner does not save or upload camera pictures. The Android app does not request access to your contacts, microphone or GPS location.

Storage and protection

Credentials, settings and activity bodies are encrypted on the phone using keys protected by Android Keystore. Database indexes and sync receipts still contain readable account and device identifiers, interval times, platform and revision metadata inside the app’s private storage. Android cloud backup and device transfer are disabled for this data.

The app’s activity database keeps 30 days. An encrypted upload awaiting successful sync can remain in protected local storage longer, until sync completes, device sync is disconnected, or you delete Experiment activity history. Android’s own system usage records are separate from this storage.

These protections do not secure information displayed on an unlocked or compromised phone. The app reports secure-storage failures rather than silently replacing your saved history with an empty or unencrypted copy.

Optional account and private device sync

Signing in sends your login to our server over HTTPS. Scanning your computer’s QR authorizes sign-in and private activity sync. Keep that QR private: it contains temporary sign-in and pairing secrets. Password sign-in alone does not enable private activity sync.

Private activity intervals, their distraction or unknown classification, and switching counts are end-to-end encrypted for your connected devices. They contain no app or website names. The server cannot decrypt this timeline; it can see account and device identifiers, platform, dates, revisions, timestamps and encrypted record sizes.

The history key is held by your connected devices, protected by Android Keystore or macOS Keychain. We cannot recover encrypted history if every device holding its key is lost. Disconnecting cannot erase a key already delivered to an offline device.

Account, settings and community

Our server can read your account information, including username and any account email or display name, your group membership and who you follow. It also reads the shared Fasting Schedule: hours, time zone, website block-list domains and streak start. Passwords and session credentials are stored as hashes. This account and policy data is separate from end-to-end encrypted private history.

Signed-in Android devices periodically request schedule and community updates and, when enabled, exchange private history. The service uses Heroku and PostgreSQL; hosting infrastructure processes connection metadata such as IP addresses. Opening this policy in a browser also makes a normal request to our website hosting provider, Vercel.

The community screen uses your account’s existing group and sharing settings. A saved community location may be used to sort nearby people; Android does not track your GPS position. Map visibility is on by default. Eligible people in your signed-in community can see your shared display name, approximate location, block hours, streak and latest shared attention battery. Existing optional sharing choices on other clients remain separate.

Scanning a QR does not give friends access to your private device timeline. You can hide your community profile or stop previously enabled activity sharing in the Mac app’s Settings → Privacy & security. The Mac and Chrome privacy guide explains those community controls. The Android app includes no advertising or analytics SDK.

Pause, disconnect or delete

• Pause collection: in The Experiment, open Settings → Privacy & security and turn off Record activity. Pausing collection does not stop blocking or delete existing history.
• Delete Experiment history: use Delete activity history in the same panel. This deletes the current account’s Experiment history on this phone and disconnects its private device sync. If sync is on, a successful server connection is required first. It does not delete your computer’s own history, Android’s system usage records or your account.
• Disconnect sync: open Settings → Account → Disconnect this phone. This requires a server connection and removes this phone’s encrypted server history while retaining its local history. Other devices remove cached copies at their next successful sync; retained private intervals expire after 30 days. An offline device may still hold a prior copy.
• Revoke permissions: Android Settings lets you turn off Accessibility, Usage Access and Camera access. Revoking Accessibility stops the app’s blocking service; it does not itself erase stored history.

Sign out under Settings → Account. An active fasting session must be ended first. Offline sign-out removes local account access and queues server session revocation for reconnection. If remote history cleanup fails, encrypted records may remain until retention expiry. Signing out does not delete your account or its saved local history.

Account deletion and privacy questions

Account and shared-policy data are retained while your account exists. To request account deletion or ask about your data, email alexander.chisler@gmail.com and identify your Experiment account. Do not send your password, session credentials or a connection QR.

Account deletion is separate from the phone’s Delete activity history control. Uninstalling the app removes its local data but does not request account deletion or confirm deletion of server data.