1. Who we are
The data controller for ScreenRehab is ONDU d.o.o., Lokovica 48, 3325 Šoštanj, Slovenia (“we”, “us”). You can reach us about anything in this policy at hello@screenrehab.app.
We have not appointed a data protection officer, because the law does not require one for an organisation of our size and type of processing. [CONFIRM]
2. What we collect and why
We process personal data under the EU General Data Protection Regulation (GDPR). The table shows each category, why we need it, and our legal basis.
| Data | Why | Legal basis |
|---|---|---|
| Account data: email address, display name, and a login credential managed by Firebase Authentication. If you sign in with Google, Google shares your name, email and account identifier with us. | To create your account, sign you in, and show your name to your buddy. | Contract (Art. 6(1)(b)) |
| Buddy relationship: your buddy’s user ID and name, invite codes you create or redeem, and unlink requests. | To connect you with your buddy and keep the connection working. | Contract |
| Blocking settings: the list of apps you chose to manage, their daily limits, temporary unlocks, and whether blocking is currently switched on. | To lock apps when you reach your limit, and to alert your buddy if blocking is switched off. | Contract |
| Unlock and limit requests: the app, the minutes requested, your written reason, your buddy’s answer, and timestamps. | To let your buddy approve or deny requests. This is the core feature. | Contract |
| Commitment answers: the reasons you chose during setup, your pledge and when you made it, and your own estimate of daily screen time. | To remind you of your “why” on the lock screen and personalise setup. | Contract |
| Daily tasks: tasks you create and whether you completed them. | To show your progress and notify your buddy when you finish. | Contract |
| Notifications: a push-notification token for your device, and in-app notification records. | To tell you about requests and answers from your buddy. | Contract |
| Subscription data: subscription status, trial dates, which member of the pair pays, and Google Play purchase identifiers. We never receive your card or bank details. | To give you and your buddy access to paid features and to verify purchases. | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| Support messages: what you send us by email. | To answer you. | Legitimate interest (Art. 6(1)(f)) |
We do not use advertising IDs, advertising networks or third-party analytics in the app, and we do not make automated decisions about you that have legal or similarly significant effects.
3. What stays on your device
To know when a limit is reached, the app reads screen-time statistics from Android. Detailed usage history is processed on your phone and is not uploaded to our servers. We only store the settings and requests described above. During setup, the app may show your heaviest apps from the last 7 days to suggest limits. That calculation also happens on your device.
4. Android permissions
- Usage access: to measure time spent in the apps you chose.
- Accessibility service: used only to detect which app has opened, so the app can show the lock screen when that app is over its limit. It does not read screen content, messages, passwords or what you type, and nothing it observes is stored or sent to us. You will see a clear explanation and must agree before it is enabled.
- Display over other apps: to show the lock screen on top of a blocked app.
- Notifications: to deliver messages from your buddy.
You can revoke any permission in Android settings. Blocking will stop working without them.
5. What your buddy sees
Pairing with a buddy means sharing some information with them: your display name, the requests you send (app, minutes and your reason), your task progress, and an alert if you switch blocking off. Your buddy never sees your messages, photos, browsing or detailed usage history. Please only pair with someone you trust.
6. Service providers
We use these providers to run ScreenRehab. They process data on our behalf under data-processing terms, or as independent controllers where noted.
- Google Firebase (Google Ireland Limited / Google LLC): Authentication, Cloud Firestore database, Cloud Functions, Cloud Messaging (push notifications) and Hosting (this website). Firebase privacy information.
- Google Play Billing (Google): processes subscription payments. Google acts as an independent controller for your payment data under the Google Privacy Policy. We only receive purchase status and identifiers.
- RevenueCat, Inc.: subscription management and server-side purchase verification. [CONFIRM: remove if not used at launch]
We do not sell or rent personal data, and we do not share it with advertisers or data brokers. We may disclose data if the law requires it.
7. Where data is stored
Our database and server functions run on Google Cloud infrastructure in the European Union. [CONFIRM: Firestore location, e.g. eur3 or europe-west1] Some Google services may process data outside the EU/EEA, for example push-notification delivery. Where that happens, transfers are protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
8. How long we keep data
- Account, buddy, blocking and commitment data: for as long as you have an account. It is deleted when you delete your account.
- Requests, temporary unlocks, tasks and notifications: while your account exists, or until they are removed. [CONFIRM: add automatic deletion after e.g. 90 days?]
- After account deletion: removed from our active database straight away, and from backups within 30 days. [CONFIRM: backup retention]
- Accounting records related to subscriptions: as long as Slovenian law requires. [CONFIRM: period]
- Support emails: up to 2 years after the conversation ends.
See how to delete your account.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify inaccurate data;
- erase your data. You can delete your account in the app under Settings → Delete Account, or by email;
- port your data: receive it in a structured, machine-readable format;
- restrict or object to certain processing;
- withdraw any consent you gave, without affecting earlier processing.
To use these rights, email hello@screenrehab.app from the address linked to your account. We answer within one month. You also have the right to complain to a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You can also complain to the authority in your own EU country.
10. Security
Data is encrypted in transit (TLS) and at rest on Google Cloud. Access to the database is restricted by security rules, so each user can only read their own data and the data their buddy has shared with them. Buddy links use atomic database transactions. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of any breach as the law requires.
11. Children
ScreenRehab is not intended for children under 15, and we do not knowingly collect their data. [CONFIRM: minimum age — Slovenia’s digital age of consent is 15] If you believe a child has created an account, contact us and we will delete it.
12. This website
screenrehab.app uses no cookies, no analytics and no tracking scripts, and it loads no third-party resources. Our hosting provider (Firebase Hosting) processes technical data such as your IP address and browser type to deliver the pages and protect against abuse, and keeps it only briefly in server logs.
13. Changes to this policy
If we change this policy in a meaningful way, we will tell you in the app before the change takes effect. The date at the top shows the latest version.
14. Contact
ONDU d.o.o.
Lokovica 48
3325 Šoštanj, Slovenia
hello@screenrehab.app