privacy policy

who we are

ditchd ("ditchd", "we", "us") makes the ditchd app for android and the ditchd companion app for computers. for the personal data described here, we are the controller under the uk general data protection regulation (uk gdpr) and the data protection act 2018.

controller: [ditchd's owner: legal name to add]
address: [ditchd's owner: postal address to add]
ico registration number: [ico registration number, once the data protection fee is paid]
contact: hello@ditchd.app

we're a small, independent business, so we haven't appointed a data protection officer (the law doesn't require one for us). write to hello@ditchd.app about anything on this page and a person will answer.

what stays on your phone

ditchd needs access to a lot of your phone to do its job. almost all of it is used only on the phone, and none of the following is ever sent to us or anyone else.

accessibility service (blocking)

ditchd uses android's accessibility service to see which app or screen is in front, so it can cover a blocked app the moment it opens. it also reads:

• the web address in supported browsers' address bars, so websites follow the same rules as apps;
• the names (view ids) of parts of some apps' screens, to tell short videos (such as youtube shorts or instagram reels) and messages apart from the rest of the app;
• the text of the settings app's own pages, so it can protect its own settings: ditchd's accessibility page, its app info page and force stop, uninstalling it, device admin, developer options and changing the home app. if you've turned that protection on, these can't be used to switch ditchd off without the wait you chose.

it also acts for you: going back or home when a blocked app opens, clearing a blocked app from your recent apps, closing a blocked app's picture-in-picture window (a small floating video), and locking the screen when you double-tap the home screen. ditchd doesn't record your screen, doesn't read your messages, and keeps none of what it reads, except which apps you opened and for how long (on the phone, for your free minutes and limits) and a count of the times ditchd stepped in when you opened something it holds back (which app, its kind, the hour and the day), for "when you reach for it" in progress. that count stays on the phone, is never synced or sent, and is gone after 60 days.

other permissions

• display over other apps: to draw the block screen over a blocked app.
• notification access (optional): to hold back notifications from apps you choose and keep them in ditchd's inbox until the time you set. held notifications (app, title, text and time) are stored on the phone only.
• do not disturb access (optional): to keep held notifications silent, and for "quiet until morning" at bedtime. calls from the people you choose and alarms always ring.
• physical activity (step counter) and health connect (optional: steps, exercise sessions, wheelchair pushes): to turn movement into dinos. ditchd reads these; it never writes to health connect, and it keeps only daily totals. if you allow it, it also reads them in the background, on the phone, about every 15 minutes, so steps from a watch count without opening ditchd. steps typed in by hand don't earn.
• camera (optional): for push-ups, holds, the barcode wake-up alarm and "good habits" photos. each frame or photo is checked on the phone and thrown away at once; only the result (for example "20 push-ups, 07:12") is kept. for a chore's before-and-after photos, the phone holds a tiny blurred greyscale copy of the "before" (96 × 96 pixels) in memory for up to 3 hours, so it can line up the "after". it's never saved, synced or sent.
• motion and light sensors: "phone away for the night" uses the motion sensors, and "lights down" reads the light sensor for about a second. only the result and the times are kept, on the phone.
• location (optional): for gym check-ins and "time outside". your location is read when you check in or out, or, if you switch on automatic check-in or time outside, android tells ditchd when you arrive at or leave a place you've saved ("all the time" location). nothing is tracked in between. the gym place you save syncs with your rules (below). your home place for "time outside" stays on the phone and is never synced or sent. your live location never leaves the phone.
• vpn (optional, "browser filter"): a vpn that runs entirely on your phone and carries only website name lookups (dns), so blocked sites don't load. your browsing traffic doesn't pass through it and isn't sent to us. names it refuses are noted only in the phone's own system log. names it allows are looked up encrypted (dns-over-tls) with cloudflare's public dns (1.1.1.1), or quad9's (9.9.9.9) if cloudflare can't be reached, which then act as your phone's dns; on a network that blocks that, and for names on your own network (like a router's), they go to the network's usual dns, as they would without the filter.
• device admin (optional, "uninstall guard"): used only so ditchd can't simply be uninstalled while the guard is on. with the guard on, uninstalling means asking in ditchd and waiting 7 days. ditchd uses no other admin powers.
• app list: ditchd sees the apps on your phone that have a home-screen icon, so it can be your launcher and apply rules to them.
• contacts: ditchd has no contacts permission. if you pick a person to call in quitting, android's own picker hands over just that name and number.

your phone's own usage record

if you allow usage access in setup, ditchd reads android's own record of which apps were in front, and for how long, over up to the last 28 days. it does this once, on the phone, to work out where your free minutes start, and keeps only averages (a day overall, per kind of app, and how often you open things). the only figure that ever leaves the phone is your average time on the phone a day, as part of the weekly totals below.

quitting

anything you track in quitting (what you're stopping, slips, cravings, your reasons, the person to call) stays in one file on the phone. it isn't synced, isn't in your account or the weekly totals, and we never see it.

the computer app

the ditchd companion for linux and windows looks at which programs are installed and running, so it can apply your rules. that list stays on the computer.

it also notes when the computer is in use: a key pressed or the mouse moved in the last two minutes, kept as stretches of time like "in use 14:02 to 15:40". never what you typed, what's on screen or which programs were open. those stretches go to your account so time away on your phone doesn't count while you're at the computer, and they're deleted after 30 days. to work out the same free minutes and daily limits on every device, each device also shares how long it spent on each kind of app today (for example "social: 25 minutes"), never which apps.

what we collect, and why

ditchd needs an account: your trial and subscription belong to it, and it keeps your rules, dinos and how you earned them the same on every device. you can't use ditchd without one. if you're signed out (say, on another device), your rules keep working and ditchd asks you to sign in again. you sign in with a link we email you (no passwords), or with google, in which case google tells us your email address and name. we need your email address to give you an account; without it we can't provide ditchd. everything else below comes from using the app.

synced data is private to your account: our database only lets each signed-in account read and change its own rows. it's encrypted in transit (https) and at rest by our hosting provider. it isn't end-to-end encrypted, which means we could technically access it. the few people who run ditchd can see account details (your email, your plan, dino and meteor totals, claims) to give support, post merch and stop abuse, and every look at a person is written to an audit log. we don't read your journal, unless you ask us to help with it or the law requires it. the sign-in token on each device is encrypted with a key held by the device (the android keystore).

never collected: a record of every app you open and for how long, what's on your screen, your notifications, your browsing, camera images, audio, your live location, raw health data, your contacts, or anything you track in quitting.

health

your activity history (what earned each dino: a walk, a workout, a gym visit, wheelchair pushes, camera exercise, and when) can say something about your health. the law treats health information more carefully, so we do too: we keep only the earning itself (its type, time and number of dinos), never your raw steps or health connect data, which stay on your phone.

keeping that history on your account is part of how ditchd works: it's how you see how you earned your dinos on every device, including your computer. so setup asks for your explicit consent to it, in a box of its own, separate from agreeing to these policies and never ticked for you. you need to tick it to use ditchd. we keep your answer, when you gave it and the version of this policy.

withdrawing it: in the app, settings → earning → health data → withdraw my consent, or email us. it's as easy as giving it. we then delete what earned each dino from your account straight away (your dinos stay; your account just no longer says what earned them), and your phone stops sending it. your phone keeps its own record. because ditchd needs that history to work across your devices, the app then offers to delete your account too, with the usual 7-day wait. you don't have to: you can keep your account without the history. withdrawing doesn't affect what we did before.

"wrong kind" reports

if you tell the app that an app is in the wrong kind, it sends three things: that app's package name (for example com.example.app), the kind ditchd had it in and the kind you suggested. nothing else: not your account, not your phone, and it's sent signed out. we keep a count per app and suggested kind (and a daily count for a week, to stop floods), and use it to sort apps better for everyone. like any request, our hosting provider sees the connection's ip address; we don't keep it with the report. lawful basis: legitimate interests (sorting apps correctly).

subscriptions and the free trial

subscriptions are not on sale yet. when they are:

• you pay through google play. google processes the payment under its own privacy policy; we never see your card details. we receive a purchase record (product, dates, price, currency, country, status and an order id) and keep it with your account, for support and our accounts.
• revenuecat, inc. keeps track of who is subscribed across devices. it receives your account id and the purchase records from google play, and nothing about how you use ditchd.
• to stop the free trial being restarted with a new email on the same phone, we store a one-way hash of the phone's android id for ditchd (a number android gives ditchd on that phone, which changes after a factory reset) with your trial record. a hash can't be turned back into the id. it's kept if you delete your account (without the account), or deleting and signing up again would restart the trial. lawful basis: legitimate interests (preventing trial abuse).
• against the same hash, we keep how strict each kind of app has got on that phone: its year and its daily limit (for example "social: 2015, 40 minutes"). that's so reinstalling ditchd on the same phone can't quietly start you off looser. nothing about which apps you use or for how long is kept with it, and it's kept whether or not you're signed in. lawful basis: legitimate interests (keeping the strictness you chose).

downloads that send nothing about you

like any internet request, these reveal your ip address to the server they come from, but nothing else about you:

• website category lists (for the browser filter), downloaded weekly from github (ut1 blacklists, hagezi dns blocklists).
• map tiles from openstreetmap, only while you're choosing your gym or home on the map.
• this website, hosted by cloudflare, which keeps standard request logs. the website sets no tracking cookies and has no analytics.

google ml kit

the camera checks use google's ml kit, with its models built into the app, so images never leave your phone. ml kit sends google diagnostic and usage information: the device type, app and feature versions, performance, the sizes of what went in and out, error codes, and an id for that install of the app that isn't meant to identify you or your phone. never images, and never the results. google says it uses this for diagnostics and usage analytics and doesn't pass it on. see google's ml kit data disclosure.

automated decisions

we don't make decisions about you by computer alone that have legal or similarly significant effects. two things are automatic: a phone that has already had a free trial doesn't get another, and reward claims are marked "looks normal" or "check this" for a person on our team, who makes the call. if you think either got it wrong, email us and a person will look.

who we share it with

we don't sell, rent or share your data for advertising. we use these service providers (processors), who handle data only on our instructions, under contracts that say so:

google play isn't our processor: it's an independent controller for downloading ditchd and paying for it, under google's privacy policy. the same goes for google when you sign in with google.

transfers outside the uk. where a provider handles data outside the uk, we rely on the uk's adequacy regulations (for the eu, and for us companies certified under the uk extension to the eu-us data privacy framework), or otherwise on the ico's international data transfer addendum to the eu standard contractual clauses in the provider's data processing agreement. email us for a copy of the relevant safeguards.

we may disclose data if the law requires it, or to a buyer if the business is ever sold (we'd tell you first, and this policy would still cover your data).

how long we keep it

• account and synced data: for as long as you have an account. when you delete it, it goes after a 7-day wait (see below), is then removed from the live database straight away and drops out of our provider's backups within 30 days.
• inactive accounts: if no device has used your account for 2 years and you have no subscription, we'll email you, and delete the account 30 days later unless you tell us not to.
• merch postal address: only until the parcel is sent, then deleted. the claim itself (what, when, how many meteors) stays with your account. the scrambled address mark is kept for 12 months after the claim, as long as the merch limits need it.
• purchase records: with your account while you have it. google play and revenuecat keep their own records, and we keep what tax law needs for our accounts (in the uk, 6 years).
• trial record (the android id hash): 3 years after the trial started, about the life of a phone.
• strictness per kind of app (with the android id hash): 12 months after that phone last updated it.
• when your computer was in use, running ditchd, started up, shut down or slept: 30 days. a device's time per kind of app today: replaced each day, and gone 30 days after that device last shared it. a device we haven't heard from for 12 months is taken off your account's list of devices.
• sign-in records: up to 90 days. our audit log of who on our team looked at an account: 2 years, holding only a masked email once the account is deleted.
• emails you send us: 2 years after the conversation ends.
• on your phone: whatever ditchd keeps on the phone is removed when you uninstall it. if you're ever signed out, your rules stay on that phone and keep running. ditchd's data isn't included in android's cloud backups.

deleting your account

in the app: settings → account → delete my account. like uninstalling ditchd, it waits 7 days first (longer if you've chosen a longer wait for easing rules), and you can keep your account any time before then. everything carries on meanwhile. then your account and everything synced to it are deleted, and ditchd takes a break on your devices, like when a subscription ends, until you sign in again. that phone keeps its own rules and dinos. the wait is there because ditchd is built to be hard to switch off on impulse; it never stops you deleting. or email hello@ditchd.app from the address you signed in with, with the subject "delete my account", and we'll do it within 30 days and confirm by email.

deleting your account doesn't cancel a google play subscription: cancel that in the play store (see the terms).

your rights

under uk gdpr you have the right to:

• be told how we use your data (this page);
• get a copy of your data (access), and have it in a machine-readable form to take elsewhere (portability);
• have it corrected if it's wrong;
• have it deleted;
• restrict how we use it, or object to it, including anything we do on the basis of legitimate interests;
• withdraw your consent at any time, where we rely on it (this doesn't affect what we did before);
• not be subject to decisions made by computer alone with legal or similarly significant effects (see above).

email hello@ditchd.app. it's free, and we'll reply within one month (up to two more months for complicated requests, and we'll tell you if so). we may ask you to confirm it's you, usually by replying from your account's email.

if you're unhappy with how we've handled your data, tell us first and we'll put it right if we can. you also have the right to complain to the information commissioner's office (ico), the uk's data protection regulator: ico.org.uk/make-a-complaint, 0303 123 1113, or information commissioner's office, wycliffe house, water lane, wilmslow, cheshire sk9 5af. if you live in the eu, you can also complain to your local data protection authority.

children and teenagers

ditchd isn't made for children under 13, and you must be at least 13 to create an account. if you're under 18, use ditchd with a parent's or guardian's knowledge. for everyone, and teenagers especially: the private stuff stays on the phone by default, we never profile anyone for advertising, your location is never shared, and nothing nudges you to give up more data. if you believe a child under 13 has given us their data, email us and we'll delete it.

security

data is sent over https, the sign-in token is encrypted on each device, sign-in uses one-time emailed links instead of passwords, the database restricts each account to its own data, and our team's admin access needs two-factor sign-in. no system is perfectly secure; if a breach puts your data at risk, we'll tell you, and tell the ico within 72 hours where the law requires it.

changes

if we change this policy, we'll update the date at the top. if a change matters (for example, a new kind of data leaving your phone), we'll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

contact

hello@ditchd.app
[ditchd's owner: legal name to add], [ditchd's owner: postal address to add]