Restrainify Privacy Policy

1Who we are and how to contact us

we and us mean the Restrainify team. You means the person using Restrainify.

This policy covers the Restrainify Android app (package com.restrainify) and the website restrainify.com. Privacy contact: restrainify@gmail.com. Support: restrainify@gmail.com.

3What Restrainify is and who it is for

Restrainify helps adults reduce compulsive pornography use and short-form-video scrolling. It is a self-restriction tool: you install it, you choose the rules, and you can turn them off. It does not hide itself, and a notification is shown while protection is running.

It is not a tool for watching other people. It cannot send your activity to anyone else, and nobody else can see your activity or notes.

Restrainify is for adults (18 and over). It is not a medical device and is not a substitute for professional help. If you are in crisis or need medical advice, please contact a qualified professional or local emergency services.

4Information we collect and how we use it

All traffic between the app and our servers uses HTTPS. We use your information only to run the app: sign you in, sync your data between sessions and devices, apply your protection rules, and keep the service secure. We do not use it for advertising or analytics.

Sensitive information. Your recovery entries (urges, relapses, Burst sessions), tracker entries and the notes you type describe your health and sexual-content habits. We treat this as sensitive data. We use it only to show your history back to you and to keep it in sync.

Information sent to us or to others

Not sent anywhere: usage statistics, per-app screen time, your installed-app list, app rules, browser web addresses, screenshots or frames, AI model scores, contacts, location, photos, files, messages, and microphone or camera data.

We do not store your browsing history. The app reads the web address in supported browsers in memory only, to apply your block list.

Information that stays on your device

• Local database, encrypted with SQLCipher. Its key is protected by the Android Keystore. It holds your app configuration and rules, recovery, urge, relapse, Burst and tracker entries (with notes), per-day coin and blocked-count totals, and per-day screen-time totals.
• Sign-in tokens and your cached profile, in secure storage.
• Sync queue and cursor, until sent.
• Installed-app list (names and package names of apps with a launcher icon). The app reads it when you pick apps to control. Only the apps you choose are kept, as package names in your rules. App rules are not synced.
• Screen time. We store one total per day. Per-app figures are worked out when you view them. Usage data is never part of sync.
• Consents. Your Agree choices are stored on your device only.
• Web addresses, screen text and screen images read for blocking are used in memory and not stored (see section 5).
• DNS cache in memory only (up to 1,024 entries, each kept no longer than its time-to-live and at most one hour). We do not log DNS lookups. We store only a count of blocked lookups per day.

App data is excluded from Android cloud backup and device-to-device transfer. Delete local data in Settings wipes this on-device data. It does not delete your account.

Our website

If you use the contact form or the waitlist form on restrainify.com, the details you type (such as your name, email and message) are sent through Web3Forms, a form service, to us by email. We use them only to reply or to tell you about launch. Ask us to delete them at restrainify@gmail.com.

5Sensitive permissions, explained

Before each of these, the app shows a full-screen explanation with Agree and Not now. Nothing is accessed until you agree. Each permission is separate. Saying no to one does not block the others. Every restriction is your own choice and you can turn it off.

Accessibility service

What it is: an Android feature that lets Restrainify see which screen is open and act on it. Restrainify is not an accessibility tool for people with disabilities. We use it only to enforce the rules you set. It works by fixed rules (lists of app and screen-element names). It does not use AI to decide what to do.

What it reads, in memory, to make an immediate block-or-allow decision:

• Which app is open (its package name), to apply your limits, schedules and Burst.
• Names and descriptions of screen elements inside Instagram, YouTube, Facebook and Snapchat (and TikTok where it applies), to recognise short-form feeds such as Reels, Shorts, Spotlight, Stories and Explore, and show a block screen.
• The address-bar web address of supported browsers (Chrome, Samsung Internet, Firefox, Edge, Brave, Opera, DuckDuckGo) to compare it with your block list.
• During a Burst with Uninstall Protection on: visible text on the Android installer and Settings screens, looking for the words "Restrainify", "uninstall", "force stop" and "deactivate device admin". This detects attempts to remove or disable the app. The app then shows a lock screen and returns you Home.
• Window screenshots, only on Android 14 or newer and only if you turned the Visual filter on (see below).

It also draws block screens over other apps and presses Back or Home, only to show or leave a block screen. It does not record or send keystrokes, passwords, messages or contacts. Nothing read through it is stored or uploaded, except a counter of how many items were blocked.

If you decline: app and feed blocking does not work. Other features still do. To turn off: Android Settings → Accessibility → Restrainify.

Usage access

Restrainify reads how long each app is in the foreground, to enforce your time limits and show your screen-time stats. We keep one total per day on your phone. Per-app figures are worked out when you view them. None of it is uploaded. If you decline, time limits and stats do not work. To turn off: Android Settings → Apps → Special app access → Usage access → Restrainify.

Local DNS filter (VPN service)

Restrainify uses Android's VPN feature to filter website lookups. It is a local filter: there is no Restrainify VPN server and your ordinary web and app traffic does not pass through it. Only DNS lookups are routed to the filter: sent to Restrainify's own placeholder address and to eight well-known public DNS addresses (1.1.1.1, 1.0.0.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112 and two OpenDNS addresses), so apps that use those are filtered too.

For each lookup, the app applies your allow and block lists and a small built-in blocklist. Lookups that are not blocked are sent to Cloudflare: to 1.1.1.3 (Cloudflare for Families, which blocks malware and adult content) or, for sites you explicitly allowed, to 1.1.1.1. The connection is encrypted: DNS over TLS first, then DNS over HTTPS. The certificate's host name is checked. If neither works, the lookup fails. SafeSearch can rewrite a few search-engine host names. We do not log or store your lookups. The VPN cannot start until you agree.

In "Private DNS" mode, Restrainify only opens Android's Private DNS settings. It sees no lookups. If you decline: website protection is off. To turn off: switch off Safe Browsing in Restrainify, or Android Settings → Network → VPN.

Screen analysis (Visual filter)

This is optional and off by default. It needs Android 14 or newer and your Agree. When on, Restrainify takes a screenshot of the window in Instagram, TikTok, YouTube, Snapchat or Facebook and checks it with two AI models stored inside the app. Then the image is released. No image is written to storage, logged or uploaded. In memory the app keeps only a small 8×8 brightness fingerprint (it cannot be turned back into an image) to skip repeated frames, and the model's scores. The only lasting result is a "blocked" counter. The models are inside the app; nothing is downloaded.

If you decline: the Visual filter stays off. To turn off: switch it off in Restrainify at any time.

Device administrator (Burst Uninstall Protection)

If you start a Burst with Uninstall Protection, Restrainify asks you to turn on Android's device administrator for it. Android then asks you to switch it off before you can uninstall Restrainify. Restrainify uses no device-admin powers: it cannot wipe your phone, lock the screen, use the camera or set password rules. The administrator role is removed automatically when the Burst ends. This makes uninstalling harder until your Burst ends. You can still do it. If you decline: you can still use Burst without Uninstall Protection. To turn off: Android Settings → Security → Device admin apps.

Foreground services and notifications

Two foreground services keep protection running, each with a visible notification: DnsVpnService ("Local DNS filtering and parental content protection") and ProtectionForegroundService ("Real-time device usage and content protection"). Notifications on Android 13 or newer need your permission. They show protection status. We send no marketing or remote push notifications. After a restart, the app uses the boot signal only to end an expired Burst's device-admin lock.

Other permissions

Internet and network state: sign-in, sync, daily coins, DNS forwarding and a connectivity check. App list: to let you pick apps. We do not use the broad "query all packages" permission. Clipboard: the app copies text only when you tap a copy button.

6Who we share information with

We do not sell personal data. We do not use it for advertising. We do not share it for analytics. We share it only with:

• Google, for sign-in. Google handles your sign-in under Google's Privacy Policy.
• Our service providers, who act on our instructions to host and run the service: Supabase (database and sign-in). We use Supabase for authentication and our PostgreSQL database.
• Web3Forms, which delivers contact and waitlist form messages from our website to us.
• Cloudflare, an independent third party, for the DNS lookups described in section 5. Cloudflare's own terms apply: Cloudflare resolver privacy and Cloudflare Privacy Policy.
• Authorities or others, if the law requires it, or to protect people's safety or our rights. We will share only what is required.

7Legal bases (EEA and UK)

If you are in the EEA or UK: we use contract (to run your account and sync); your explicit consent for sensitive recovery data (data about health and sex life is special-category data) and for device permissions, which you can withdraw at any time; and legitimate interests only for narrowly security-related processing, such as preventing abuse.

8How long we keep information

If you turn cloud sync off, new changes are no longer queued for upload. Data you already synced stays on our servers until you delete your account.

When you delete your account, we permanently remove the data listed in section 10 from our systems immediately. This is a real deletion, not a deactivation. We keep nothing except what is shown below:

9Your choices and rights

• Turn off cloud sync in Settings.
• Change or take back any permission in Android Settings (see section 5). Each permission is separate. Declining one does not block the rest.
• Delete local data in Settings.
• Delete your account in the app, or on our account deletion page.
• Access, correct, export, object to or restrict the use of your data, where the law gives you that right (for example under GDPR, UK GDPR or CCPA/CPRA). Email restrainify@gmail.com. We reply without undue delay. If you disagree with our answer, tell us and we will review it. You can also complain to your data protection authority.
• We do not sell or share personal data for advertising, so there is nothing to opt out of.

10Account and data deletion

Delete your account in the app

1. Open Restrainify and tap the Settings tab.
2. Tap Delete account. (It is shown when you are signed in.)
3. Read the notice, type DELETE in the box, then tap Permanently delete account.
4. Confirm in the pop-up by tapping Delete Account.
5. When the app shows Account Deleted, your account is gone and you are signed out. If the app shows an error instead, your account was not deleted. Check your connection and try again.

Can't open the app?

If you cannot open the app (for example, you uninstalled it or lost your phone), email restrainify@gmail.com from the email address of the Google account you used for Restrainify. Use the subject "Delete my Restrainify account". We check that the request came from the account owner, delete the account and its data immediately after that check, and confirm by email.

What is deleted

• Your account profile: sign-in ID, email, name and profile-picture link.
• Your account settings and the app settings you synced.
• Your synced recovery data: urge, relapse and Burst entries, and any notes you wrote.
• The website rules (allow and block lists) you added.
• Your focus-coin claims.
• Your sign-in sessions (the sign-in account is removed, so every session stops working).
• Our records of which sync updates were already applied.

Deleting your account does not delete your Google account. To remove Restrainify's access to it, visit myaccount.google.com/permissions. Full details, including what may be kept, are on the account deletion page.

Delete account, Delete local data and Log out are different

• Delete account removes your account and server data. It does not remove data on your phone.
• Delete local data wipes the data on your phone. It does not delete your account.
• Log out signs you out and clears your session. It deletes no data.

11Security

• Traffic to our servers uses HTTPS.
• Website lookups are sent to Cloudflare over an encrypted connection (DNS over TLS, with DNS over HTTPS as a fallback).
• The database on your phone is encrypted with SQLCipher. Its key is protected by the Android Keystore.
• Sign-in tokens are kept in secure storage.
• App data is excluded from Android backup.

No system is perfectly secure. If you find a security problem, please tell us at restrainify@gmail.com.

12Children

Restrainify is not for children and is not directed at them. We do not knowingly collect data from anyone under 18. If you think a child has used it, email restrainify@gmail.com and we will remove the data.

13International transfers

Our providers (Supabase, Google and Cloudflare) may process data in countries other than your own. They publish their own data-protection terms, which apply to their handling of your data.

14Google user data (Limited Use)

Restrainify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request only the profile and email scopes.

15Cookies and the website

The Restrainify app uses no cookies. The website restrainify.com does not currently use analytics or advertising tools. If that changes, we will update this policy first. Forms on the site are delivered by Web3Forms (section 6).

16Changes to this policy

If we make a material change, we will tell you in the app before it applies. The date and version at the top always show the current version.

Changelog

17Contact and complaints

Email restrainify@gmail.com. You have the right to complain to your local data protection supervisory authority.