Privacy Policy

Last updated: October 17, 2026

Pre-launch draft, not yet in force. Text in [brackets] and the marked pre-launch notes are completed, and the whole policy is legally reviewed, before Frank is available on the App Store.

Who we are

Frank (a working name) is an iPhone app that comments on your phone habits in a tone you choose. The controller responsible for your data is [LEGAL ENTITY NAME], [POSTAL ADDRESS]. Contact us about anything in this policy at support@replace-me.invalid.

The short version

• Your Screen Time data never leaves your iPhone: not to us, not to our analytics, not to anyone.
• To use Frank you sign in with Apple or Google; we create your account from that sign-in and store your email address so you can restore your setup. With Google, your name and profile-picture link are stored too, because Google always shares them.
• We store your settings, your consent choices and, unless you turn syncing off, the numbers you type into check-ins.
• Product analytics are on by default and you can turn them off at any time in Settings → Privacy & data. They never contain Screen Time data or the numbers you type.
• No ads. No tracking across other companies’ apps or websites. We don’t sell or share your data.
• You can delete your account, and everything we store about it, inside the app.

Screen Time data stays on your iPhone

Automatic tracking is optional and needs iOS 18 or later. When you allow it, Frank uses Apple’s Screen Time frameworks (FamilyControls and DeviceActivity). Apple gives the app opaque tokens for the apps you pick, not their names, and tells it when your use passes time thresholds the app sets up (for example 15 or 30 minutes on your problem apps).

Everything that comes from or is calculated from Screen Time is processed and stored only on your device:

• the apps and categories you pick, and how many you picked;
• when you pass a limit, estimated minutes, pickups, your first pickup of the day and late-night use;
• verdicts, scores, streaks and weekly report cards calculated from that data;
• which Screen Time alerts you received, opened or reacted to, and your ratings of those lines.

We never send any of this to our servers, to our analytics provider or to anyone else, and we can’t see it. It is kept in the app’s storage on your iPhone and in a container shared only with the app’s own Screen Time extensions. What our servers do know is which tracking mode you use (automatic, check-in or preview) and a consent record saying whether you granted Screen Time access (yes or no, and when), never the data itself.

If you share a roast yourself through the iOS share sheet, the text you share goes wherever you send it. The app never sends Screen Time data anywhere on its own.

What we store on our servers

To use Frank you sign in with Apple or Google; we create your account from that sign-in. Without a connection the app works offline and keeps everything on your phone until it can sync. Account data is stored with Supabase in the European Union (Frankfurt, Germany):

• Account: a random user ID, how you signed in (Apple or Google) and your email address. With Sign in with Apple we only ask for your email, not your name, and Apple may give us a private relay address instead. With Sign in with Google, Google always shares your name, email address and a link to your profile picture, and our authentication provider stores them with your account; we don’t use the name or picture for anything else. For security, our authentication provider logs the IP address and device information of sign-in requests.
• Profile: time zone, language, platform, app version, tracking mode and when you finished onboarding.
• Your onboarding answers: the answers you give Frank during onboarding (your reason for being here, the apps you admit to, your guess of your daily phone time, and the name you sign with) are stored with your account so a new phone keeps them. They are deleted with your account and included in your data export. They are your words, not Screen Time data, which never leaves your phone.
• Preferences: tone, profanity switches, daily limit, mercy mode, your sync and analytics choices, and notification settings (quiet hours, daily cap, which reminders you get and when).
• Consent records: what you opted into or out of (harsh mode, the 18+ confirmation, profanity, check-in sync, analytics, notifications, Screen Time access), with the consent text version, the time, platform and app version, so we can honour and prove your choices.
• Check-ins: the numbers you type in yourself (total and problem-app minutes, pickups, whether your phone came first thing, your daily limit) and the score calculated from them. Syncing is on by default and can be turned off in Settings → Privacy & data (“Sync my check-ins”).
• Feedback on roasts: your rating of a line (for example “too harsh”), the tone, a coarse category, whether it contained profanity, and the line’s ID and copy pack version. Only for lines that are not based on Screen Time data; ratings of Screen Time lines stay on your phone.
• Subscription status, only if you buy something: whether your purchase is active, the product, store, renewal and expiry dates, received from RevenueCat.

Reminders and roasts are local notifications created on your iPhone. We don’t send push notifications and don’t collect push tokens.

Analytics

To understand which parts of the app work, we collect product analytics with PostHog. Analytics are on by default. You can switch them off at any time in Settings → Privacy & data; from then on no new events are sent.

• What is sent: events such as “viewed onboarding step”, “selected a tone”, “opened the paywall” or “opened a reminder notification”, which tracking mode you use, whether you allowed notifications and Screen Time access, the screens you view, and when the app is opened, updated or sent to the background. The analytics SDK adds device and app details: device model, iOS version, app version and build, language and time zone. Events are linked to your random user ID, never to your email or name.
• What is never sent: anything from or calculated from Screen Time (including whether you opened or reacted to a Screen Time alert, and how many apps you picked), the numbers you type into check-ins, and your email address.
• Session recording is off. We don’t use advertising identifiers and don’t track you across other companies’ apps or websites.
• PostHog receives your IP address with each request. Pre-launch note: the FT1 PostHog project must be set to discard IP addresses and not to derive location; its region (EU or US) is chosen when the project is created and stated in the provider list below.

Purchases

If you buy a subscription or another in-app purchase, Apple processes the payment; we never see your payment details. We use RevenueCat to check what you bought. RevenueCat receives your random user ID, your purchase and receipt information, and the device and app details needed to validate it.

Website and waitlist

Our website uses no cookies and no analytics. Our hosting provider, Cloudflare, processes your IP address and browser details to deliver the pages and protect them from abuse. If you join the waitlist, we store your email address, where you came from (a short tag in the link) and the time, and use them only to email you about the launch. Pre-launch note: if bot protection (Cloudflare Turnstile) is switched on for the waitlist form, say here and in Cloudflare’s entry below that it checks the browser before the form is sent.

Service providers

These companies process data for us under data processing agreements:

• Supabase: database and sign-in. Data stored in the EU (Frankfurt, Germany).
• PostHog: product analytics. Region: [EU OR US].
• RevenueCat: purchase validation, only if you buy something. United States.
• Cloudflare: website hosting and delivery. United States, with a global edge network.

Apple provides Sign in with Apple, App Store payments and notification delivery under its own privacy policy. Google provides Sign in with Google under its own privacy policy. Where data is transferred outside the EU or UK, we rely on the EU–U.S. Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

Why we may process your data (GDPR and UK GDPR)

• Your account, preferences, check-in sync, restoring your setup and purchases: to provide the app you asked for (Art. 6(1)(b)).
• Harsh mode, profanity and the waitlist: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Product analytics and feedback on roasts: our legitimate interest in understanding and improving the app (Art. 6(1)(f)). You can object at any time by switching analytics off.
• Consent records and security logs: our legitimate interest in proving your choices and keeping the service secure (Art. 6(1)(f)).

How long we keep data

• Account data: until you delete your account.
• Backups kept by our database provider: overwritten within [BACKUP RETENTION DAYS] days.
• Analytics events: [ANALYTICS RETENTION], or until you delete your account.
• Waitlist entries: until we have announced the launch, or earlier if you ask us to remove yours.
• Data on your phone: until you delete the app. Your usage history can be cleared any time in Settings → Privacy & data.

Deleting your account and data

Settings → Account → Delete account permanently deletes your account and every row linked to it on our servers immediately, signs you out and resets the app on your phone. Deleting the app removes everything stored on your device, including all Screen Time data.

Account deletion also revokes your Sign in with Apple authorization, deletes your purchase record at RevenueCat and deletes your analytics profile and events at PostHog. If you signed in with Google on that phone, the app also tries to remove its access from your Google Account. You can always remove it yourself under Google Account → Security → Your connections to third-party apps & services. Pre-launch note: these three steps run in the account-deletion server function, which is deployed, but each step only runs once its server key is configured (Sign in with Apple key, RevenueCat secret key, PostHog personal API key). Configure all three before launch. Deleting your account does not cancel a subscription: cancel it in your App Store account settings.

Your rights

Depending on where you live (including under the GDPR and UK GDPR), you can access, correct, export or delete your data, restrict or object to its processing, and withdraw consent at any time. You can export your data in Settings → Privacy & data, or ask us by email; we answer within one month. You also have the right to complain to a data protection authority, for example the one where you live or work (in the UK, the ICO).

Children

Frank is not intended for children under 13, and we don’t knowingly collect data from them. Harsh mode is limited to adults (18+). If you believe a child under 13 has given us data, contact us and we will delete it.

Security

Data is encrypted in transit. Our database only lets each account read and change its own rows, and server keys never ship inside the app.

Changes

If we change this policy we update the date above. For material changes we tell you in the app or by email before they apply.

Contact

[LEGAL ENTITY NAME], [POSTAL ADDRESS]. Email: support@replace-me.invalid.