Legal — 02

Privacy policy

Last updated · AUSFUELLEN · VON LUKAS ZU FÜLLEN — Datum der Veröffentlichung

This is the privacy policy for Unplug, an iOS app that helps you cut down your screen time. It is written to be read, not to be survived. If something here is unclear, write to us and we will fix the wording.

The short version

01Who is responsible

Lukas Brehmer
Kelterweg 3
55545 Bad Kreuznach

Email: support.unplug@gmail.com

Under the GDPR, this person is the "controller" for the data described here.

02What stays on your phone

This section matters more than the rest, so it comes first.

Screen Time data

Unplug uses Apple's Screen Time API (Family Controls) to block apps and to show you how long you spent in them. That includes:

• —which apps and categories you chose to block
• —how long you spent in those apps
• —how often a shield appeared

None of it ever leaves your iPhone. It is not sent to us, it is not stored on our server, and it never appears in a shared image or a leaderboard.

That is not us being generous. Apple's Developer Program License Agreement (§ 3.3.3(P)) forbids sending Screen Time data anywhere, and the data is technically sealed off as well: the part of Unplug that can read per-app minutes runs in a separate, sandboxed process that Apple does not allow to make network requests. So even if we wanted to, we could not.

We think that is a feature. An app that fights your phone habit should not be the thing collecting the evidence.

Health and motion data

If you turn on Apple Health as your step source, Unplug reads your daily step count. Your steps are used on your device to work out how many bonus minutes you earned, and the step count itself is never uploaded. Only the bonus minutes you earned end up on our server, as part of your progress.

The same goes for the iPhone's built-in motion sensor if you use that instead.

We only ever read step data. We never write anything to Apple Health.

Your date of birth

Onboarding asks for your date of birth. It is used for exactly one thing: the Reality Check screen works out how many years you have left at your current usage. It is stored on your phone and is never uploaded.

A few other things that stay local

• —Whether the adult content filter is on, and the websites you add as exceptions to it. Neither leaves your phone: they are not in your profile, not in anything a friend can see, and not in anything sent to an AI. We are naming the switch itself and not just the exception list, because in an app with a pornography Recovery Coach the switch says something about you.
• —Your conversations with the coaches, as a chat history (but see section 5 — the messages themselves are sent to a model to get an answer)
• —Plans the Recovery Coach wrote for you. Plans from Lumis are stored on our server (section 3); these are not.
• —Your clean-day counter in the Recovery tab

03What we store, and why

When you create an account, the following is stored on our server.

If you use the corresponding features, we also store:

• —Habits and goals you created, with their streaks and progress
• —Journal entries, including the text you wrote and the mood you picked
• —Calendar events and to-dos you added, including their reminder times
• —Plans from Lumis, the general coach — the title and the list of steps. Plans from the Recovery Coach are not included. They stay on your phone and are never uploaded, for the same reason your coach conversations are not: a plan about pornography recovery says something about your sex life, and that is a special category of data under the GDPR. The trade-off is real and we would rather name it than hide it — a recovery plan does not follow you to a new phone, and logging out removes it.
• —Focus sessions (how many minutes, and when)
• —Friend requests, friendships, and your friend code
• —Messages you send friends — we store the ID of the pre-written message you picked, not free text, because there is no free text to send
• —Challenges you started or accepted, and their points
• —Milestone events (a streak or rank you reached) so a friend gets told once and only once
• —Reports you send about another user — who you reported and which of four reasons you picked, never free text. The person you report is not told, and cannot see the report.
• —Accounts you block — we store that you blocked them, so they cannot send you a friend request again. They are not told either.

Your journal is personal. We store it so that it is still there after a reinstall. It is never shown to anyone else and never sent to an AI model.

04What other people can see

Some of Unplug is social, and it would be dishonest to hide what that means.

Visible to everyone using the app, on the global leaderboard: your username, profile picture, level, rank, streak and XP. The leaderboard shows the top 100.

Visible to your friends, in addition: your quests this week, your focus sessions, your weekly XP, your badges and trophies, and your lifetime stats.

Visible to nobody but you: your email address, your journal, your goals, your habits, your calendar, your Screen Time, your steps, your date of birth, your clean-day counter, and your coach conversations.

Your profile picture is stored in a public bucket — anyone who has the exact link can open it, even without an account. Don't use a photo you would not want to be publicly reachable.

You can turn friend notifications off in Settings. That switch works in both directions: you stop getting them, and you stop sending them.

05When something is sent to an AI model

Four things in Unplug send data to Anthropic (the company behind Claude) to get an answer back. All four are listed here, and there are no others.

Quest photo check

When a daily quest asks you to photograph something, the photo is sent through our server to Anthropic's API together with the one-line task description. The model answers with a single word — approved or rejected — and that is all we get back.

The photo is not stored. Not by us, not in our database, not in a bucket. It exists in the request and is gone afterwards. What Anthropic does with it on their side is governed by their own terms; see section 6.

Lumis, the coach

When you write to the coach, your message and the recent conversation are sent to Anthropic, along with a block of your numbers: your name, level, streak, best streak, total XP, days active, focus sessions and minutes, habits completed, journal entry count and goals completed.

Your actual screen time is not in that block — we do not have it (see section 2), and the coach is explicitly told it cannot see it.

Recovery Coach

The Recovery Coach is for pornography recovery. When you write to it, your message and your clean-day counter are sent to Anthropic in the same way.

Please read this twice. Under the GDPR, information about your sex life is a special category of personal data. Using this feature means you are sending that kind of information to a third party outside the EU. If that is not what you want, do not use the Recovery Coach — every other part of Unplug works without it. AUSFUELLEN · VON LUKAS ZU FÜLLEN — juristisch prüfen lassen: ob hier eine ausdrückliche Einwilligung nach Art. 9 Abs. 2 lit. a DSGVO eingeholt werden muss, bevor der Recovery Coach zum ersten Mal benutzt wird

Weekly analysis

The Weekly Report can generate a written analysis. It sends your streak, best streak, focus minutes, habits completed, days you stayed within your daily limit, and the daily limit you set. The "time reclaimed" number is included and marked as your own estimate — because that is what it is: it comes from what you told us in onboarding, not from a measurement.

Your coach conversations are not stored on our server. They live on your phone. So do the plans the Recovery Coach writes. A plan you save from Lumis is the one thing from a coach that reaches our server — see section 3.

06Who processes data for us

Some of these are outside the EU. AUSFUELLEN · VON LUKAS ZU FÜLLEN — juristisch prüfen lassen: Auftragsverarbeitungsverträge (Art. 28 DSGVO) mit Supabase, Anthropic, RevenueCat und Expo, und die Rechtsgrundlage für die Übermittlung in die USA (Standardvertragsklauseln / EU-US Data Privacy Framework). Seit die Supabase-Region feststeht, gehört die SCHWEIZ mit in diese Prüfung: sie ist Drittland und hat einen Angemessenheitsbeschluss, der Satz oben nennt aber nur die USA.

There is no advertising network, no tracking, and no analytics tool in Unplug. We checked the code, not just our memory: there is no Firebase, no Sentry, no Amplitude, no Mixpanel, nothing of that kind. The app never asks for tracking permission because it has nothing to track you with.

07Why we are allowed to do this (legal bases)

• —Your account, your progress, the social features, your subscription — Art. 6(1)(b) GDPR: we need this to give you the app you signed up for.
• —Apple Health, notifications, camera and photo library — Art. 6(1)(a): your consent, given in the iOS permission dialog. You can withdraw it at any time in iOS Settings, and the rest of the app keeps working.
• —Keeping the service working and stopping abuse (for example the daily cap on AI photo checks) — Art. 6(1)(f): our legitimate interest in not having the service broken or run up a bill.

08How long we keep things

The short answer: as long as your account exists, and after that not at all.

• —Your account and everything attached to it — profile, progress, journal, habits, goals, calendar, focus sessions, friendships, challenges — stays for as long as the account does. Deleting the account deletes all of it (section 9). Nothing expires separately before that.
• —Quest photos are never stored. They exist inside the request that checks them and are gone afterwards.
• —Friend messages disappear from the app the next day, but the row stays in the database — hidden, not removed. It goes with the account.
• —Milestone events (a streak or rank your friends were told about) are kept for the life of the account on purpose: they are what stops the same milestone being announced a second time.
• —The daily counter for the AI features is one row per day and feature, holding a number. It goes with the account.
• —We hold no purchase records. Apple sells the subscription and Apple holds the receipt. What we store is a single row saying which plan you are on, which product it came from and when it runs out — and every update overwrites it, so there is no purchase history on our side at all.

09Deleting your account

Settings → Delete account. It asks once, and then it is done.

When you tap it, a server function deletes your rows from every table that holds them — friend_nudges, friend_activity_events, friend_requests, friends, challenges, calendar_events, focus_sessions, diary, habits, goals, plans, ai_usage_daily, entitlements, leaderboard and profiles — then removes your profile picture from the storage bucket, and finally deletes the login itself.

The list is written out in the function rather than left to the database's own cascade rules, so that it can be read and checked. Where a row belongs to two people — a friendship, a request, a challenge, a nudge — both sides are deleted, so nobody is left with a row pointing at an account that no longer exists. Anything that fails is reported back rather than swallowed.

Two things you should know either way:

• 1Deleting your account does not wipe your phone. Your streak, your journal and your settings stay in the app's local storage until you delete the app itself. If you want everything gone, delete the account and then delete the app.
• 2Your subscription is not cancelled by deleting your account. Apple runs the subscription, not us. Cancel it in iOS Settings → your name → Subscriptions.

10Your rights

Under the GDPR you can ask us to:

• —tell you what we have about you (Art. 15)
• —correct it if it is wrong (Art. 16)
• —delete it (Art. 17) — the fastest route is Settings → Delete account
• —restrict what we do with it (Art. 18)
• —hand it over in a machine-readable file so you can take it elsewhere (Art. 20)
• —object to processing based on legitimate interest (Art. 21)
• —withdraw consent at any time, without it affecting what happened before (Art. 7(3))

Write to support.unplug@gmail.com. We answer within one month.

You can also complain to a data protection authority. The one responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
poststelle@datenschutz.rlp.de

11Notifications

Unplug sends few notifications on purpose — an app about attention should not be the thing grabbing yours.

• —Reminders you set yourself (a to-do, an event) are scheduled on your phone. They never reach our server, and tapping them does not open anything.
• —Friend milestones ("your friend hit 30 days") are sent through our server. These do open the app, because the only useful reaction is to go and say something.
• —We never put a badge on the app icon for either kind.

All of it can be turned off in Settings, and none of it works at all unless you allowed notifications in the first place.

12Age

Unplug is not for children. AUSFUELLEN · VON LUKAS ZU FÜLLEN — Mindestalter festlegen und hier eintragen; siehe dazu der Hinweis in TERMS.md. Zu bedenken: die App enthält einen Recovery Coach für Pornosucht und einen Erwachseneninhalte-Filter, was für die App-Store-Altersfreigabe und für Art. 8 DSGVO (Einwilligungsalter in Deutschland: 16 Jahre) relevant ist.

We do not knowingly collect data from anyone below that age. If you believe a child has an account, write to us and we will delete it.

13Changes to this policy

If we change how the app handles your data, we change this page and update the date at the top. If the change is significant, we will say so in the app rather than hoping you re-read this page.

14Contact

Lukas Brehmer
Kelterweg 3
55545 Bad Kreuznach

Email: support.unplug@gmail.com