What PhonePact Measures, and What We Refuse To

By Hank Yang. Harvard Divinity School, MTS '26 · Founder of PhonePact · Built internet businesses reaching millionsUpdated October 2026

Most posts on this blog mention our app once, at the end, and earn the rest with useful information. This one is different on purpose: it's the full disclosure document, written in plain language, because "trust us" is not an architecture. If you're evaluating any screen time app, including ours, these are the questions to ask, and here are our answers on the record.

What data does PhonePact actually collect?

Your measured activity and its duration. On iPhone, the app counts activity from the apps, categories, and websites you enroll through Apple’s picker. Selecting everything approximates a whole-device total; a smaller selection counts only that scope. On Android, Usage Access counts the whole phone or individual launchable apps selected in PhonePact’s private picker. Home’s private “Where it went” summary shows up to ten selected apps used for at least one minute that day. Apple selection tokens and app/site/category/package identities, raw events, and exact per-app activity used for measurement stay on the phone and are not uploaded. Private notices and Moment prompts are scheduled locally. Native Android measurement stores may keep up to 14 aggregate dates while active; iPhone yearly-history storage is separate. Account-scoped seven-date caches can survive ordinary sign-out for same-account restoration. Android additionally preserves a private resume checkpoint with its selection, pact/progress, and up to 14 aggregate dates, while extended Insights summaries and notification counts clear at sign-out.

Your pact configuration and limited duration records. Your chosen daily point, circles, coarse shared check-in minutes/times, and Room notes reach Firebase. Each registered phone has a random installation identifier, a short label such as “iPhone A1B2,” its own pact, and an owner-only device record where the apps normally save seven recent recorded dates of aggregate totals while the iPhone relay can retain up to 14; a legacy owner-only copy may remain on some older accounts until deletion. The identifier is not a hardware serial, advertising ID, or fingerprint. Circle members can see the short label and pact point, but cannot read owner-only history. Ordinary Room rows expire after 24 hours. A member-written message visibly kept by a current circle member expires no later than 30 days after it was sent. Clients stop displaying expired rows; an hourly server sweep normally removes them on its next successful run, but backlog or job failure can delay physical removal. A reported message is copied into its safety report for review; after review closes, it becomes eligible for deletion at 90 days and a daily cleanup job normally removes it on its next successful run.

Private live status. Android’s widget/live status remains local. iPhone versions where Live Activity is available can use that optional surface while the app is closed. Its account/device routing tokens, activity state, local day/time-zone context, pact point, and whole-minute aggregate floors pass through Firebase and Apple push systems so the private card can start, update, and end. Those values are owner-only; no app identities or live presence go to a circle.

Account and operations. Firebase handles email/password and linked Google/Apple sign-in, verification, and provider identifiers. We store profile/circle/pact data and two boolean purchase-access flags. Release diagnostics use account-linked Crashlytics reports, which can contain error/stack/component context and device/app metadata. Expo receives ordinary app/runtime/network data to deliver compatible over-the-air updates. Separate backend delivery, integrity, and failure logs can contain raw account and random device/installation IDs plus circle, request, message, push-claim, relay, or job identifiers and error/retry context, but are not intended to contain message bodies, app selections, or Insights content. Our default Cloud Logging bucket retains entries for 30 days; the required audit-log bucket retains audit entries for 400 days. Account deletion does not individually scrub these logs. The full categories and retention periods are in the Privacy Policy.

What about personal insights?

Monthly and one-time Supporter purchases unlock Deeper Insights where available: daily, weekly, monthly, hourly, app-level, trend, comparison, research-context, and pact-journal views. Availability varies by installed version, platform, account, and staged store rollout. iPhone details are processed and rendered inside Apple’s protected report. Selected website activity may affect its aggregate total, but the current report does not list or store visited domain names. On Android, an affirmative choice can retain private no-backup usage summaries for up to 365 recorded days; the summaries can include app labels/categories, time, visits/session estimates, unlocks, switches, and break estimates. Separately enabled notification counts retain up to 28 recorded days and do not read text, title, or sender. Android collection that was already enabled can continue after paid access expires, but an unpaywalled You → Profile control remains available to stop it and clear saved summaries without unlocking reports. None of this extends server detailed history. Missing days are not zero. Insights do not read messages or use AI; limited deterministic safety rules separately inspect profile/circle/phone-label text, Room/private messages, optional check-in notes, and pact/What Counts reasons. Required text may be rejected or sanitized; blocked optional text can be omitted.

RevenueCat handles access, not Insights. When enabled in the build, its SDK receives the raw Firebase account ID for every signed-in user so it can check entitlement, even before a purchase. RevenueCat also receives app/device/last-seen technical data and, when applicable, store receipt/token, product, transaction, subscription, and entitlement data. Apple or Google handles card/bank credentials. PhonePact does not send RevenueCat names, emails, app usage, pact data, messages, selections, or Insights as customer attributes. We use purchase data for functionality, support, fraud prevention, and purchase/subscription analytics—not advertising or cross-app tracking.

What does my circle actually see?

A shared check-in can say: "Alex's iPhone A1B2 reached 2h 30m today," at that phone's pact point and later 30-minute crossings through 23h 30m of measured use, subject to synchronization and stale/replay suppression. At the smallest 30-minute pact point, this is as many as 47 potential shared check-ins in a day. A private Moment/Talk First prompt is limited to the pact point and six later crossings; that prompt cap does not cap the shared ladder. A check-in may carry an optional short note you deliberately add. The measurement payload does not include your app list, browsing or location, and circle members cannot read owner-only totals. Members can read details you deliberately add to shared notes or messages, as well as shared profile and pact activity. There are no leaderboards, streaks, or red badges of failure.

Pact raises are visible by design: once you have a real circle mate, you propose a longer goal and eligible people you select can answer it; the first yes settles the request; Talk first opens a private discussion and pauses other replies. Lowering remains yours alone, and only someone with no circle mates can self-raise. These proposed changes are visible to the people you ask, alongside the other circle content described above.

What will PhonePact never do?

PhonePact policy forbids selling or sharing data with advertisers or brokers. PhonePact does not show ads or use measured activity for advertising. There is no intentional precise-location collection or use of Room content for advertising profiles. Filed reports remain available for review; since 27 September 2026, the report-alert line sends Cloud Logging only a one-way lookup code, kind, and revision. Older full-detail alerts and separate operational logs follow the default bucket’s 30-day retention and are not individually scrubbed by account deletion. Delivered alert copies follow the recipient notification service’s retention. Deleting your account starts cleanup of the account’s PhonePact-hosted and local data; a shared circle and other members’ content continue, reports about you may remain pseudonymized, a content-free deletion guard remains seven days, and provider backups/store transactions follow separate rules. After PhonePact account cleanup, our backend requests asynchronous deletion of the matching RevenueCat customer and retries failed requests. Contact Support if you need confirmation or help matching the provider record. Neither provider deletion nor account deletion cancels a subscription or erases store transactions, and later signed-in use can create a new RevenueCat customer. If these practices change, the policy must change before the product does.

We publish this because the screen time category has a trust problem it earned: apps positioned as digital wellness while harvesting granular behavioral data are surveillance with a lavender gradient. The bar you should hold any of them to, including us: what exactly is measured, who sees it, when is it deleted, and how does the company make money? Any app that can't answer all four in plain sentences has answered them.

If those answers are why you've hesitated to try accountability at all, the model built on them is here: getphonepact.com. And if you'd rather run a circle with no app and no company involved, genuinely, do it, the group-chat version works and we published the instructions.