iPhone privacy

Screen Time and your choices

With your individual Screen Time authorization, Apple’s picker lets you choose apps, categories and websites to shield. Apple represents those choices using private tokens. Those tokens and your blocking schedule are saved on this iPhone in protected storage, separately for each account, so the blocking extensions can use them.

Apple’s private Screen Time report displays available iPhone app and website activity. Its contents, app identities and usage are not exported to the main app, other devices, friends or our server.

The iPhone app does not turn that report into an Attention or switching score. Those product estimates appear only when supported activity from connected devices is available; they are not medical measurements. Missing observations remain unknown.

You can revoke the app’s access in iPhone Settings → Screen Time. Turning off Show iPhone activity in the app hides the report; it does not stop Apple’s own Screen Time recording.

Time back and challenge days

“Hours saved” is an estimate based on observed active time while protection is in place. It is not a measurement of how long you would otherwise have scrolled. The app can use short periods observed while it is open with protection confirmed, and supported private activity received from your connected devices. It cannot measure all activity in other iPhone apps or count every hour while running in the background.

Missing observations do not become saved hours. Overlapping device observations are combined locally where available; the shared account total uses a conservative daily maximum across devices, so separate periods on different devices may be undercounted. Previously accepted estimates may not be revised downward when a later device observation conflicts. Weeks and shared daily summaries use UTC.

Challenge days use separate local records of confirmed protection checkpoints and evidence that a device was used. Three continuous protected hours can qualify a day without adding those hours to the saved-time estimate. Leaving a schedule enabled, declaring an offline break or receiving a background callback alone does not earn saved hours. Apple’s private Screen Time report is not used or exported for either calculation.

Missing days do not earn challenge credit. After 30 days without new device evidence, the current streak becomes inactive and resets; saved-time totals and invitations already earned remain. An optional offline declaration records an expected return date, but does not extend that limit or create activity. You can ask support to review a missed streak. A restoration requires review and fresh device evidence; it does not invent missing hours or issue the same invitation reward again.

What stays on your phone

Account credentials, settings, imported private activity and local progress are encrypted in app storage with a key protected by the iOS Keychain. Blocking choices, policy and local protection checkpoints shared with the enforcement extensions use iOS Data Protection. This shared extension storage contains no login credentials, imported activity history or private Screen Time report data.

If protected storage cannot be opened, the app reports the problem and preserves existing data instead of saving plaintext or silently resetting it. These protections do not secure information already visible on an unlocked or compromised phone.

Imported private history and detailed progress evidence cover up to 30 days. Expired records are removed during successful app loads, refreshes or protection updates; a closed or offline phone may retain an older cached copy until then. Older local daily progress is reduced to accumulated totals and streak bookkeeping, which remain until you delete local history. Saved blocking choices, settings and setup drafts are separate and remain until changed or removed. Apple’s own Screen Time records are managed separately by iOS.

Optional computer connection

Camera permission is used to scan a connection QR displayed by your computer. The scanner does not save or upload camera pictures. You can also paste a connection link. The iPhone shows what will be connected and asks you to agree before redeeming the code.

A connection QR contains temporary sign-in and pairing secrets. Keep it private. Signing in with a password alone does not enable private device-history sync.

Private activity intervals and switching information exchanged by paired devices are end-to-end encrypted for those devices, without app or website names. Our server cannot decrypt that timeline. It still receives account and device identifiers, platform, dates, revisions, timestamps and encrypted record sizes to store and deliver it.

The iPhone receives supported history from connected devices. It does not upload Apple’s native Screen Time report through this connection. Connecting devices does not give friends access to that private timeline.

Only paired devices hold the history keys. We cannot recover encrypted history if every device holding a key is lost. A captured QR and its corresponding encrypted exchange could expose that exchange; expiry cannot retract a key already obtained.

Account and shared settings

If you sign in, login requests travel over HTTPS. Our server can read your account information, shared blocking schedule, time zone, streak information and explicitly entered website block-list domains. Passwords and random session credentials are stored as hashes on the server. Account and policy records are separate from end-to-end encrypted private history.

The server also processes account and device identifiers, platform, connection and revision information, timestamps and network metadata such as IP addresses.

Community features on other Experiment devices follow your account’s existing visibility and sharing settings. Signing into this iPhone does not change that consent. The Mac and Chrome privacy guide explains existing community visibility and the controls for hiding a profile or stopping previously enabled activity sharing.

The iPhone app includes no advertising or analytics SDKs. Optional account connections still send the data described above to our server.

Optional progress sharing and encouragement

In Settings → Sharing & encouragement, you can choose to share progress and agree to the community guidelines. Signing in, connecting a computer, or previously sharing an attention estimate does not make this choice for you. When you opt in, the iPhone sends your account and installation identifiers, UTC dates, observed protected-time totals, longest confirmed protection durations and a device-used indicator. The service also records receipt times and challenge eligibility. No app names, visited websites, private activity intervals or Screen Time report contents are included in these progress requests.

Other participants in your existing community can see your reviewed profile name, weekly saved-time estimate, streak, approved update and encouragement count. Your consented aggregate totals also contribute to the total for all sharing participants across communities and to the invitation impact total of the person whose code you used. Invitation impact is an attributed total, not proof that an invitation caused someone to save time. People outside your community do not receive your profile or update through this feature.

You may submit one short update about what you made time for. Names and updates are reviewed before appearing to other participants; a changed update goes back into review. A 💪 tap records the sender, recipient and UTC day, with at most one reaction per pair per day. There are no direct messages or photo uploads in this feature.

Reports record the reporting account, reported account, reason and a copy of the submitted update for staff review. The person reported does not receive the reporter’s identity or reason. Blocking hides your profiles from each other, prevents new encouragement and removes existing mutual reactions. Moderators can hide content and restrict accounts. You can also contact alexander.chisler@gmail.com.

Shared daily summaries, invitation attribution, reward records, reactions, sharing preferences and any submitted offline or restoration information are readable by the server. Update, review and support text use the service’s encryption at rest; these community records are not end-to-end encrypted. They are separate from the encrypted private device-history connection.

Shared daily summaries remain while the account exists unless you delete shared progress; the 30-day local-detail limit does not automatically delete them. Stopping sharing removes your profile, update and contributions from community and invitation-impact displays, while retaining your saved records privately for your account. Deleting shared progress removes its daily summaries, reviewed name, update and reactions. New shared counting resumes on the next UTC day so delayed devices cannot restore the deleted days. Existing invitation and reward records are retained to prevent repeat rewards, and safety blocks and moderation reports remain for safety review. Contact support about account deletion and any retained records.

Service providers and operational records

Heroku (Salesforce) hosts our account and sync services, including the PostgreSQL database. Its service terms and incorporated data-processing addendum require processing under our instructions, confidentiality, security safeguards and equivalent obligations for subcontracted processors. We require providers processing this app’s user data on our behalf to provide at least the privacy protection described here and required by applicable rules.

Our server and Heroku use request and connection records to operate the service, prevent abuse and diagnose failures and performance problems. These records can include IP addresses, timestamps, requested paths, response status and request durations. Some request URLs include your account identifier.

Heroku’s runtime log buffer available to us holds up to 1,500 recent lines. Entries expire after one week and may be replaced sooner by newer entries. We have no external log drains configured. Hashed abuse-prevention counters older than an hour are removed during later authentication checks.

Opening this policy or our support page sends a normal browser request to Vercel, our website host. Vercel handles browser connection data under its terms and privacy policy. Function runtime logs available to us on our current website plan are kept for one hour.

These runtime-log limits describe the logs available to us. Providers may retain separate infrastructure and security records under their own policies; we do not control those retention periods.

Your controls

• Hide the iPhone report: open Settings → Privacy & security and turn off Show iPhone activity. This controls report display; it does not stop Apple’s recording, blocking or imported device-history sync.
• Delete local history: use Delete activity history in the same panel. It clears local imported Experiment history, local progress totals and protection evidence, and disconnects private device sync. When sync is enabled, a successful server connection is required first. It does not delete Apple’s report, another device’s original history, your shared server progress or your account.
• Manage shared progress: open Settings → Sharing & encouragement. Stop sharing hides your profile and removes your contributions from shared totals. Delete shared progress removes the server records described above while preserving private totals on this iPhone. Use both local and shared deletion controls if you want to clear both copies.
• Manage updates and interactions: delete your update in its editor, or use the menu beside another participant to report content or block them. Support can review an inactive streak from Offline & streaks when the service is available.
• Delete your account: open Settings → Account & devices and choose Delete account when available. After confirmation, the app stops protection on this iPhone, requests permanent server deletion and removes this account’s saved data from this phone. A server connection is required, and a failure is shown rather than reported as a completed deletion. If your app or server does not offer this option, contact support.
• Disconnect this iPhone: open Settings → Account & devices. Disconnecting requires a server connection, removes this phone’s encrypted server history and clears its downloaded peer-history cache. Other connected devices update their imported caches during a later successful sync; their original local history remains separate. An offline device may still hold a prior copy and its encryption key.
• Sign out: use Settings → Account & devices. The app first stops protection on this iPhone; if it cannot do that safely, it shows an error and keeps you signed in. Other devices keep their shared routine. Sign-out revokes the phone’s session and device connection; offline revocation retries after reconnection, and failed remote cleanup may leave encrypted device records until retention expiry. Saved per-account settings and history remain encrypted on this phone. Signing out does not delete your account, turn off your account’s sharing preference or erase local or shared progress.
• Revoke permissions: use iPhone Settings to change Screen Time or Camera access. This does not itself erase saved Experiment data.

Account deletion removes the account, its sessions, server blocking policy, device connections and encrypted history, shared progress and profile content. Other people’s accounts and memberships remain. Spent invitation allocation records retain their used status without your account reference, so deletion does not reopen used invitations. Safety reports you made about another account may remain for moderation with your account reference removed; reports and submitted text associated with your deleted profile are removed.

A hashed deletion confirmation, containing no readable account identifier, email or credential, permits the same request to be retried after a lost response. It expires after 30 days; expired confirmations are removed during later deletion requests. Other devices may retain previously downloaded local history while offline, and a server deletion cannot remotely erase those copies. Provider operational records follow the separate retention described above.

Account and shared-policy data otherwise remain while the account exists. Deleting local activity, deleting shared progress, disconnecting a device and signing out are separate from account deletion.

Privacy questions and account deletion

For privacy questions, help with in-app account deletion or a deletion request when that control is unavailable, email alexander.chisler@gmail.com and identify your Experiment account. Do not send your password, session credentials or a connection QR.

For setup and troubleshooting, visit iPhone support.