What PhonePact Measures, and What We Refuse To

By Hank Yang. Harvard Divinity School, MTS '26 · Founder of PhonePact · Built internet businesses reaching millionsUpdated September 2026

Most posts on this blog mention our app once, at the end, and earn the rest with useful information. This one is different on purpose: it's the full disclosure document, written in plain language, because "trust us" is not an architecture. If you're evaluating any screen time app, including ours, these are the questions to ask, and here are our answers on the record.

What data does PhonePact actually collect?

Your measured activity and its duration. On iPhone, the app counts activity from the apps, categories, and websites you enroll through Apple’s picker. Selecting everything approximates a whole-device total; a smaller selection counts only that scope. On Android, Usage Access counts the whole phone or the individual launchable apps you select in PhonePact’s private picker. Home’s private “Where it went” summary shows up to five selected apps used for at least one minute today. Apple selection tokens and the app/site/category/package identities, raw events, and exact per-app durations used for measurement stay on the phone and are not uploaded. Private notices and Moment prompts are scheduled locally.

Your pact configuration and limited duration records. Your chosen daily point, circles, coarse shared check-in minutes, and room notes reach Firebase. Each registered phone has a random installation identifier, a short label such as “iPhone A1B2,” its own pact, and up to seven aggregate daily totals in a private device record so recent history survives signing out without being merged with another phone. The identifier is not a hardware serial, advertising ID, or fingerprint. Circle members can see the short label and pact point, but cannot read the daily totals. Ordinary room rows expire after 24 hours. A member-written message visibly kept by a current circle member expires no later than 30 days after it was sent. A reported message is also copied into its safety report for review.

Account basics. We store what is needed to run the service: login, profile, and purchase status. PhonePact’s core service is free, and optional Supporter purchases unlock private insights. No ads, no data sales, no "partnerships" that are data sales in a trench coat.

What about personal insights?

Monthly and one-time supporters unlock Deeper Insights: daily and weekly views, rhythms, private app details, and a pact journal. iPhone details stay inside Apple’s protected report. In the updated tester edition, Android’s optional private usage summaries can accumulate up to 365 days after a fresh choice in the app; earlier editions retain up to 28 days. Separately optional notification counts retain 28 days and never read message text or senders. These do not extend the server’s limited aggregate history. Missing days are not zero; room text and private messages are never analyzed, and no AI service is used. RevenueCat handles purchases, not screen-usage totals or insights. See the Privacy Policy for retention and controls.

What does my circle actually see?

One kind of event: "Alex's iPhone A1B2 reached 2h 30m today," at that phone's pact point and up to six later 30-minute milestones, with an optional short note if you chose to add one during your locally scheduled Moment. Circle members never see your app list, browsing, location, or owner-only seven-day totals. There are no leaderboards, streaks, or red badges of failure.

Pact raises are visible by design: once you have a real circle mate, you propose a longer goal and eligible people you select can answer it; the first yes or talk-first answer settles the request. Lowering remains yours alone, and only someone with no circle mates can self-raise. That's the one place we chose visibility over privacy, deliberately, because silent goal-abandonment is the failure mode the entire product exists to prevent, and an openly raised goal is the system working.

What will PhonePact never do?

No selling or sharing data with advertisers or brokers, ever. No location collection and no use of room content for advertising profiles. Room text is processed for safety filtering, and a reported message is retained with its report for review. Deleting your account removes the account, ordinary room notes and check-in rows attributed to you, and reports you filed. Reply excerpts and account-linked reactions or blocks are scrubbed. Reports about you may remain as anonymized safety records, with copied text attributed to you scrubbed. If any of this changes, it changes in the policy before it changes in the product.

We publish this because the screen time category has a trust problem it earned: apps positioned as digital wellness while harvesting granular behavioral data are surveillance with a lavender gradient. The bar you should hold any of them to, including us: what exactly is measured, who sees it, when is it deleted, and how does the company make money? Any app that can't answer all four in plain sentences has answered them.

If those answers are why you've hesitated to try accountability at all, the model built on them is here: getphonepact.com. And if you'd rather run a circle with no app and no company involved, genuinely, do it, the group-chat version works and we published the instructions.