The short version. PhonePact helps you use your phone less with support from circles you choose. We deliberately keep server collection narrow and never sell personal information. A shared check-in contains a coarse duration (for example, “reached 2h today”), the member and phone that recorded it, its time, and any short note the member deliberately adds. PhonePact does not automatically share your app list, exact per-app activity, selected websites, browsing history, private Insights reports, or owner-only daily history with circles; members can read details you choose to write in shared text. In updated iPhone/Android versions, an owner-only yearly history in your account can restore saved daily totals after a reinstall or on a new phone: dates and minutes, without app details. You can ask us to access or delete data we control.

This Privacy Policy explains how PhonePact LLC (“PhonePact,” “we,” “us,” or “our”) handles information when you use the PhonePact mobile application, the getphonepact.com website, and related services (together, the “Service”). Where applicable privacy law uses those terms, PhonePact LLC is the controller or business responsible for the processing described here.

What “private” means here. Some information stays only on your phone; other information is stored in an owner-only part of our Firebase backend or is visible only to the people you choose. Server-hosted information must still be processed by PhonePact and its service providers to operate the Service. “Private” does not mean end-to-end encrypted or inaccessible to authorized operators unless we expressly say it stays on-device.

1. Information we handle

Account, profile, and authentication

  • Name, email address, and authentication data — Firebase Authentication handles email/password sign-in and provider sign-in. If you use or link Google or Apple, we receive the provider identifier and any name or email the provider makes available. We store verification status, linked sign-in methods, and a limited verification-grace timestamp used to secure sharing. PhonePact does not store your plaintext password in its own databases. Linking another method requires your action and does not automatically merge two separate PhonePact accounts merely because their emails match.
  • Sign-in provider security data — Google Sign-In can process technical identifiers, device/app information, and IP-derived approximate location for sign-in, security, and abuse prevention. This is separate from phone-location permission; PhonePact does not request precise location to measure screen usage. Provider handling is also subject to that provider’s privacy policy.
  • Profile and circle appearance — your optional avatar, profile details, and a circle photo you choose to contribute are shown to the relevant circle members.
  • Hand-drawn pact signature — stroke-path data used to render your Phone Pact and, when you sign a pact in a circle’s room, shown to that circle’s members on that pact. It is not analyzed for identity, used as a legal signature, or used for biometric recognition or authentication.
  • Onboarding answers, goals, and settings — the intentions, pact point, notice choices, and other settings you enter to configure the Service.
  • Account and device identifiers — a Firebase account ID and a random per-installation ID. The installation ID is not a hardware serial number, advertising ID, or device fingerprint. A short label such as “iPhone A1B2” helps distinguish phones on the same account.

Circles, pact activity, and content

  • Circle and membership data — circle names, appearance, invitations, membership, blocks, and the people involved.
  • Pact and change-request data — pact points, which eligible circle members you ask, reasons or notes you provide, responses, timestamps, and request status. App-selection identities are not included in a what-counts request.
  • What Counts changes — in updated iPhone/Android versions, when you remove items from what counts toward your pact, your member-written reason (20 to 280 characters after safety filtering), your name, the phone’s short label, and the selected-item counts before and after are posted to every circle you belong to when the server records the change, up to ten circles. The counts can stay the same or increase when a removal is combined with additions. These new removals do not require approval; older versions and already-pending requests can still use the approval flow. The room row expires after 24 hours, with physical deletion on a later successful server sweep as described in Section 4. PhonePact also attempts to send the reason and the same context to eligible members by push; delivery is best effort and can fail. No app, category, website, or selection identity is automatically included; the reason is free text, so any details you type into it are shared too.
  • Pacts in rooms — when you start or sign a pact in a circle’s room: its terms (kind, title, rule, length, start, and consequence), your name, the goal you set, the signature you sign it with, when you signed, the days you are held to it, any day you left, the breaks recorded for you with any note you add, and whether a break is marked paid. For a screen time pact, it also keeps which of your phones the pact set and that phone’s earlier pact point, so you can go back to it afterwards. Screen time breaks come from your shared check-ins; no app or website identity is involved.
  • Room messages and interactions — short notes, replies, reactions, and visible Keep attribution. Ordinary rows expire after 24 hours. A current circle member may visibly keep a member-written message for everyone until no later than 30 days after it was sent.
  • Private conversation messages — one-to-one text and pact context shared with a current member of a circle you share. Ordinary messages expire after 24 hours; either participant may visibly keep a message for up to 30 days.
  • Reports, blocks, feedback, and support — report reason, reported content and context, reporter/subject identifiers, moderation status, blocks, and messages or screenshots you deliberately send to PhonePact for feedback or support.
  • Deterministic safety screening — limited server rules inspect text entered as profile or display names, circle names, phone labels, Room/private messages, optional check-in notes, and reasons for pact or What Counts requests for blocked safety terms or patterns. This is rule-based processing, not AI analysis or advertising profiling, and it can make mistakes. Depending on the field, blocked required text is rejected or sanitized; blocked optional notes or reasons can be omitted while the underlying action continues. For new What Counts removal announcements, a blocked or too-short required reason must be corrected before the announcement can be recorded.

Screen-usage and check-in information

With your permission, PhonePact uses the screen-usage system on your phone. On iPhone, Apple’s Screen Time, Family Controls, and Device Activity features count the scope you select, which may include the whole device or selected apps, categories, and websites. On Android, Usage Access lets you choose the whole phone or individual launchable apps in an on-device picker. Home can show a private “Where it went” summary of up to ten selected apps used for at least one minute that day.

PhonePact does not upload automatically collected app/package identities, selection tokens, exact per-app activity, website identities, or raw usage events to its servers or your circles. This does not prevent you from including app or other personal details in a reason, note, or message you choose to share. PhonePact sends owner-only aggregate totals and coarse events needed to keep and back up your daily history and operate shared check-ins. A qualifying shared check-in contains the account and circle identifiers, the measuring phone’s ID and short label, the event time, a duration threshold, and an optional note. Subject to synchronization and stale/replay suppression, a phone can create one at its pact point and at later 30-minute crossings through 1,410 minutes (23h 30m) of measured use. At the smallest 30-minute pact point, that is as many as 47 potential shared check-ins in a day. The private pre-check-in Moment/Talk First prompt is limited to the pact point and six later crossings; that prompt limit does not limit the shared check-in ladder. Each registered phone has its own pact and an owner-only Firebase device record: the apps normally save seven recent recorded dates of aggregate totals there, while the iPhone relay can retain up to 14. Some older accounts may also retain a legacy owner-only copy of recent totals until account deletion.

Yearly history (iPhone and Android). In updated iPhone/Android versions, each phone can back up its recorded daily totals to an owner-only yearly history record in your Firebase account. The uploaded record contains dates and whole-minute totals plus the writing phone’s installation ID; it is linked by the phone’s first-registration time so a reinstalled App can keep the same history. The year view covers up to 366 calendar dates; storage and cleanup limits are described in Section 4. On iPhone, each total is the highest 15- or 30-minute step that PhonePact’s own measurement reached that day, a floor rather than Apple’s exact figure. Android saves measured whole-minute totals, not that iPhone step ladder. The record contains no app, category, website, or circle information. Phones back up finished days when the App runs, excluding the current day; Android can keep accumulating local days during existing background measurement wakes. Available recorded dates seed the history, which grows from there; it does not reconstruct a missing year from before installation. The same account can restore available saved totals after reinstalling or moving to a new phone; earlier phones fill dates before this phone’s own history, without adding overlapping phone totals together. No new totals are backed up until you answer the one-time note to keep backup on. On both platforms, declining the first notice or turning off history backup in You → Profile first saves the off decision, then requests deletion of every saved yearly record on the account, including another phone’s records. Days kept on the phone stay there. If deletion fails after off is saved, backup stays off and deletion is retried when you next open or return to the App. The updated App must finish outstanding deletion before it can turn backup back on. Android also has a Try again button for a failed off attempt. Circle members cannot read any of these owner-only histories.

Pending iPhone relay outbox. A protected App Group file can temporarily hold an unsent relay item containing account and phone identifiers, event kind and identifier, timestamps, minutes, local day and time-zone context, Activity binding, and, where applicable, circle context or a deliberately added note. The backend rejects relay events more than 14 days old. Delivered, invalid, stale, or over-age items are removed on later outbox processing, so an inactive local file can physically remain until that cleanup path or account teardown runs. It does not contain app, package, category, or website identities.

Optional live status

Android can display aggregate time and pact progress locally in a widget or supported live-status surface. On supported iPhones, an optional Live Activity can continue updating while the App is not open. To route it, PhonePact sends its backend account/device IDs, ActivityKit and push routing tokens, an activity ID and state, local day, whole-minute aggregate elapsed-time floors, observation/start/dismissal times, time-zone offset, pact point, and delivery/retry metadata. This routing state is owner-only and is sent through Firebase Cloud Messaging and Apple Push Notification service. It contains no app, category, website, or browsing identity and is never shown to a circle. You can disable or dismiss the surface; an already accepted in-flight push cannot be recalled.

Supporter Insights

Optional monthly and one-time PhonePact Supporter purchases unlock Deeper Insights in You → Insights in builds where the feature is available. Views can include daily, weekly, monthly, time-of-day, app-level, trend, comparison, research-context, and pact-journal cards. Measurements vary by phone, operating-system version, permission, selection, and available history. Missing days are not treated as zero, and the metrics do not establish intent, focus, sleep, diagnosis, or why usage changed.

iPhone. Apple supplies the selected Screen Time data directly to a protected report extension. That report may transiently process daily/hourly aggregate time, app identities and durations, pickups, notification counts, first pickup, and longest activity when Apple supplies them. Selected category or website activity may contribute to aggregate totals, but the current PhonePact report does not list, export, or store visited domain names. Detailed report values are rendered inside Apple’s protected extension and are not copied into the main App, PhonePact servers, or RevenueCat. For dates Apple no longer supplies, Insights can show PhonePact’s own daily totals from the yearly history above, without any app detail. An opaque selection token stays on-device; it may survive sign-out so the same account can restore its selection and is cleared by account deletion.

Android. If you affirmatively choose to save private history, PhonePact reads local Android usage events, including which app/package was used and when. It stores private no-backup summaries containing daily/hourly totals, app labels and categories, pseudonymous package keys, per-app duration, visit/session and quick-return estimates, unlocks, app switches, first/last activity, and screen-off break estimates. Raw Android usage history remains controlled by Android. PhonePact’s summary files remain on that phone, are excluded from Android backup/device transfer, and are not uploaded.

A separate Android notification option, where offered or previously enabled, requires both an in-app choice and Android Notification Access. PhonePact counts eligible arrivals by app, using a deduplication key and post time, without reading or storing notification text, title, sender, actions, icons, conversation content, or extras. Ongoing notifications and group summaries are excluded. Permission gaps and platform behavior can make counts incomplete.

A small on-device pact journal is maintained for signed-in accounts so recent pact settings and crossings recorded on that phone are ready if Insights is unlocked. It stores event kind, time, and minutes, not message text. In the updated iPhone version, it also records confirmed pact changes, previous and new pact points, approval status, the approving member’s account identifier and name when known, and separate approval and local record times. For What counts changes, it can keep opaque before-and-after selection tokens on that phone so Apple can display added or removed apps, categories, and websites privately. These are selection changes, not evidence of which apps or websites you used. The journal is not a complete approval/delivery history, does not reconstruct earlier unsaved changes, and is not synchronized between phones. These local records and selection tokens are not sent to our servers or other members; shared pact-change approvals, older What Counts approval requests, and the new removal announcements described above are separate. Insights calculations are deterministic and on-device: PhonePact does not use an AI service to analyze them, analyze messages, rank members, or send detailed Insights, app identities, or reports to circles, RevenueCat, or advertising/behavioral analytics services.

Technical, diagnostic, push, and update information

  • Push and routing tokens — Firebase Cloud Messaging and, where used, Apple push and ActivityKit addresses let us send remote circle, pact-request, private-conversation, shared-check-in, and Live Activity updates. Private-conversation pushes identify the sender but omit message text. Private notices and Moment prompts are scheduled locally.
  • Crash and diagnostic reports — release builds use Firebase Crashlytics. Reports are linked to the Firebase account ID and may include fatal/nonfatal errors, native or JavaScript stack traces, error messages, limited component-stack or developer log context, timestamps, app/build identifiers, Crashlytics/Firebase installation and session IDs, device model/specifications, operating system, and whether the App was in the foreground. We do not intentionally add message bodies or app-selection details to crash reports, but unexpected error context can contain information involved in the failing operation.
  • Service and security logs — IP address, user agent, request time, app version, device/OS type, response/error information, and security or integrity signals can be processed by PhonePact, Firebase, Apple, Google, or Expo when you authenticate, call the backend, receive a push, or check for an app update. PhonePact’s backend operational lines can also contain account and random device/installation IDs; circle, request, message, push-token/claim, relay, or delivery-job IDs; and failure or retry details needed to diagnose integrity and delivery problems. We do not intentionally put message bodies, app/site selections, or Insights content in those operational lines. Our default Cloud Logging bucket retains entries for 30 days; Google Cloud’s required audit-log bucket retains its audit entries for 400 days. These log copies are not individually found and scrubbed by in-app account deletion, even after the underlying PhonePact records are removed.
  • Safety-alert logs — a filed report creates a Cloud Logging alert so a human can act. Since 27 September 2026, the report-alert line sends only a one-way lookup code, report type, and filing revision to that log; the report content stays in the access-controlled report record. Earlier backend revisions copied report reasons, content, names, and raw account/circle identifiers into the alert log. Any legacy entries remain subject to the default bucket’s 30-day retention and are not individually scrubbed by the in-app account-deletion flow. Copies already delivered to an alert recipient follow that recipient’s notification-service retention; deleting the account does not recall a delivered alert.
  • Over-the-air update data — Expo/EAS Update receives ordinary network and app/runtime/platform metadata needed to determine and deliver a compatible over-the-air update.

Supporter purchases and RevenueCat

The core experience is currently available without a Supporter purchase. Apple or Google Play sells optional Supporter purchases and handles payment credentials; PhonePact does not receive or store your card or bank details. PhonePact uses RevenueCat as its purchase processor. When RevenueCat is enabled in a build, the SDK identifies each signed-in user with the raw Firebase account ID so it can check access, even if that user has not purchased. RevenueCat may process that account ID; app, SDK, device/OS, locale/currency, last-seen, network/approximate-country, and permitted device-identifier information; and, when applicable, product/offer, Apple receipt or Google purchase token, transaction, purchase date, renewal/expiration, subscription, and entitlement information.

PhonePact uses this information to show localized offerings, validate purchases, prevent purchase fraud, restore and synchronize access, provide billing support, and produce purchase/subscription analytics. Our own Firebase profile mirrors only whether purchases are available and whether Supporter access is active; it does not receive the store receipt. PhonePact app code does not set RevenueCat customer attributes for your name, email, phone number, screen usage, pact, messages, selection, or Insights. RevenueCat does not receive those details from PhonePact. We do not use purchase data for cross-app advertising or tracking.

2. How we use information

  • Provide, personalize, maintain, and secure the Service, accounts, pacts, devices, and circles.
  • Measure the scope you chose, keep and back up up to a year of private daily totals, operate private notices and optional live status, and create the shared check-ins you agreed to send.
  • Operate rooms, private conversations, change requests, reports, blocks, and content-safety review.
  • Authenticate you, verify email ownership, link sign-in methods you request, and prevent account abuse.
  • Show Supporter offerings; validate, restore, and synchronize entitlements; provide billing support; and understand aggregate purchase and subscription performance.
  • Deliver app updates, investigate errors, improve reliability, respond to support, enforce our Terms of Use, and comply with law.

PhonePact’s policy forbids selling personal information, sharing it for cross-context behavioral advertising, or using it for targeted advertising. PhonePact does not show ads or use measured activity for advertising or cross-context behavioral tracking. If our processing practices materially change, we will update this Policy and provide notice and obtain consent where the law requires it before the change begins.

Legal bases for EU/UK users

  • Contract — to provide the account and the features you use: circles, rooms, private conversations, pacts, the shared check-ins you set up, your yearly history and its backup, Insights, and Supporter purchases.
  • Consent — for screen-usage access, optional local history/notification counting, push permissions, live status, and device permissions you choose. You can withdraw consent at any time in the App or your device settings, although doing so does not affect processing already completed.
  • Legitimate interests — to keep the Service and its members secure, investigate reports and prevent abuse (including the rule-based safety screening), diagnose crashes and errors, understand aggregate purchase performance, and establish or defend legal claims, in each case without overriding your rights. You can object to processing based on legitimate interests.
  • Legal obligations — where law requires retention, disclosure, tax/accounting, or response to valid legal process.

To use PhonePact you need an account (a sign-in method and a name). Screen Time or Usage Access is needed for check-ins, pacts measured by screen time, and Insights; everything else you share is optional. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The rule-based safety screening only blocks or trims text; you can ask a person to review its effect on you.

3. When information is disclosed

  • People you choose. Circle members see your name/avatar, circle membership, each registered phone’s short label and pact point, relevant pact-change requests/responses, duration-only shared check-ins and their time, and room content/interactions you send. In updated iPhone/Android versions, every circle you belong to when the server records a What Counts removal also receives your reason and its context as described in Section 1. A private-conversation participant sees the message and pact context you send to that conversation. Other members cannot read it. Members of a circle also see the pacts started or signed in its room, including each signer’s name, goal, signature, the days they are held to it, and the breaks, notes, and payments recorded for them. No circle receives a live presence signal or your owner-only usage history.
  • Processors and platform providers. Google/Firebase provides authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, and Crashlytics; Apple and Google provide sign-in, operating-system measurement/push services, app distribution, and store billing; RevenueCat processes the purchase data above on PhonePact’s behalf; and Expo provides compatible over-the-air update delivery. Depending on the activity and law, an app store or sign-in/platform provider may act under its own terms as an independent controller. See Firebase privacy and security, Apple’s Privacy Policy, Google’s Privacy Policy, RevenueCat’s Privacy Policy, and Expo’s Privacy Policy.
  • Safety and legal needs. Authorized reviewers and service operators may access reported content and operational records as needed to investigate abuse, respond to support, comply with valid legal process, or protect users, PhonePact, or others. As United States law requires, we report apparent child sexual exploitation to the National Center for Missing & Exploited Children.
  • Business transfers. Information may transfer in a merger, financing, reorganization, acquisition, bankruptcy, or sale of assets, subject to this Policy and applicable law.

4. Retention and deletion

  • Owner-only server usage. The apps normally save the newest seven recorded dates of aggregate totals per phone, not a seven-calendar-day time-to-live; the iPhone relay can retain up to 14, and server access rules allow up to 14 entries in that device record. Updated iPhone/Android versions also back up each phone’s yearly history. The view covers up to 366 calendar dates, but saved records may hold additional dates for travel, clock uncertainty, or delayed cleanup, with a maximum of 400 entries per phone record. Updated apps trim older dates during sync or history reads when clock checks permit, allowing two extra calendar days; an unavailable or inconsistent clock reference can defer age cleanup. Dates can remain longer until cleanup succeeds, you turn off backup and deletion completes, the phone is removed and its history deletion completes, or the account is deleted. Removing a phone under You → Profile requests deletion of its yearly history; deleting the account deletes all of it through account cleanup. Intermediate iPhone relay/Live Activity state can include additional current-day whole-minute floors needed for synchronization and delivery. Relay receipts expire after about 15 days; relay credentials expire after no more than 180 days; completed/invalid delivery jobs and superseded token claims are removed. The current device routing state otherwise remains with the device record until replaced, the device is revoked, or the account is deleted. A legacy owner-only total copy may remain until deletion. None of this contains app or website identities.
  • Android on-device Insights. After fresh consent in expanded builds, usage summaries can accumulate up to 365 recorded days. Day entries outside that window are pruned when the archive refreshes; an abandoned/inactive file can physically remain until the cleanup path runs. Notification-count buckets cover up to 28 recorded days and prune when another eligible notification is saved. Turning off and clearing private history deletes usage summaries and notification counts but not the pact journal. Ordinary sign-out pauses measurement and clears the extended Insights summaries, notification counts, and pact journal, but preserves an account-scoped native resume checkpoint containing the selected package list, pact/progress settings, and up to 14 recorded dates of aggregate history for restoration to that same account on that installation. Revoking an OS permission stops new access but does not by itself erase prior summaries. Account deletion, clearing app data, or uninstalling removes the local checkpoint.
  • Supporter expiry. Expiration closes paid reports but does not delete history or revoke OS permissions. On Android, previously enabled private-history refresh and notification counting can continue after paid access expires. The always-available You → Profile → Private Insights data control stops that collection and deletes PhonePact’s saved usage summaries and notification counts without unlocking paid reports. You can also stop new access by revoking the relevant permission, signing out, clearing app data, deleting the account, or uninstalling.
  • Local aggregate resume data. While measurement is active, native Android stores can keep up to 14 recorded dates of aggregate duration as rollover/offline slack for the seven-date ledger. Updated iPhone/Android versions also keep a separate local aggregate year history, with extra dates possible for travel or clock uncertainty and a 400-entry storage ceiling. The backup off switch leaves those local dates on the phone. In updated Android versions, account deletion also attempts to remove the separate local year files; a file deletion failure can leave them on the phone. Both apps also keep an account-and-installation-scoped cache of up to seven aggregate dates across ordinary sign-out so the same account can resume without losing recent totals. These caches contain duration and date, not app identities, and clear for that account during account deletion.
  • iPhone on-device data. Detailed Screen Time history is supplied and retained by Apple; it is not copied to a PhonePact detailed-history store. Revoking access stops PhonePact from reading new reports but does not delete Apple’s OS-held history. Ordinary sign-out clears the active PhonePact App Group aggregate history, while the seven-date account cache and opaque selection token may survive for same-account restoration; both clear on account deletion. Signing back in to the same account can restore any yearly history still saved in the account.
  • Pact journal. The local journal keeps pact point settings (a time and a number of minutes) for up to a year, at most 120 of them, and everything else for no more than 28 recent days and 300 entries. It prunes on read/write, and clears at sign-out or account teardown. On supported iPhone versions, exact before-and-after selection tokens are limited further to the latest 20 completed selection changes plus one pending change, within the same journal limits. Older entries may retain change and approval metadata without exact selection details. Changes in Screen Time authorization can also make Apple’s older app labels unavailable.
  • What Counts announcement receipts. In updated iPhone/Android versions, the server keeps an account-linked receipt to prevent retries from posting the same removal again. It stores a retry identifier, a digest binding the phone, before/after counts and reason, the room-row identifier, original audience circle IDs and circle count, creation and expiry times, the row lifetime, and a cleanup time; it does not store the reason text itself. The audience IDs and cleanup time become eligible for removal after seven days and are removed on a later successful hourly cleanup; failures or backlog can delay that step. The remaining receipt, including the digest and original result count, stays until account deletion, even after the 24-hour room row expires. These receipts are not readable by circle members.
  • Pact-change ordering. Updated server code keeps an account-linked revision counter and update timestamp to order competing pact changes. It contains no reason, signature, app, or usage detail, is not readable by circle members, and stays until account deletion.
  • Shared check-in source events. Account-linked coarse events, including their timestamp, phone/circle context, minutes, and optional note, are retained until account deletion separately from the short-lived Room row. They do not contain app identities or exact per-app usage and are not a complete daily history.
  • Pacts in rooms. A pact stays in its circle after it ends, so members can look back at it, and is deleted when the circle is deleted. If you leave a circle after a pact has started, your row (name, goal, signature, and breaks) stays in that pact, marked with the day you left; if you leave before it starts, your row and signature are removed. Account deletion starts removal of your row, signature, breaks, and notes from pacts, including pacts that have ended; malformed pact records can require support repair before that cleanup completes. A pact you created can keep your account’s random identifier as its creator, without your name after cleanup.
  • Messages. Ordinary Room and private messages expire after 24 hours. A visibly kept member-written Room message or private message expires no later than 30 days after sending. PhonePact clients stop displaying a row at its expiry time; scheduled server deletion runs hourly and normally removes it on the next successful sweep, but a backlog or failed job can delay physical removal. Releasing the last Room Keep restores ordinary expiry without reviving an expired message. Deleting an account deletes its room notes/check-in rows and its private conversations, and scrubs account-linked reply excerpts, reactions, Keep attribution, block references, and names.
  • Safety reports. A reported-message copy remains available while a report is open. It becomes eligible for deletion 90 days after review closes; a daily server sweep normally removes it on the next successful run, but a failed job can delay physical removal. Reports filed by a deleted account are deleted. Reports about a deleted account may remain as safety records with the account identifier replaced by an opaque value and copied name/text attributable to that user scrubbed. Those deletion actions apply to the Firestore report record. Legacy Cloud Logging alert copies described above follow the logging bucket’s separately configured retention and are not individually scrubbed by account deletion.
  • Account/profile data. We keep it while the account is active. In-app deletion starts deletion of PhonePact-hosted account, profile, device, membership, pact, private-conversation, feedback, entitlement-flag, and usage records, plus Room rows attributed to or about the deleted account. It also clears a current shared-circle photo while that photo is still attributed to the deleted account. A shared circle and content belonging to its remaining members continue; if nobody remains, the circle and invite-code mapping are queued for removal. A content-free deletion guard keyed to the former account ID remains for seven days to stop delayed devices from recreating deleted data. Google states that Firebase Authentication data can take up to 180 days to leave its live and backup systems after deletion is initiated.
  • Crash reports. Google states that Crashlytics keeps crash traces and associated installation identifiers for 90 days before beginning removal from live and backup systems.
  • Purchase records. PhonePact’s two Firebase entitlement flags delete with the account. After PhonePact account cleanup, our backend requests deletion of the matching RevenueCat customer and retries requests that fail. RevenueCat processes deletion asynchronously, so deletion is not immediate. If you need confirmation or the automatic request cannot be matched, contact us for a manual provider request. Deleting its customer record does not delete an app store’s transaction record or cancel a subscription. RevenueCat and the stores may retain records under their policies and as needed for entitlement, refund, fraud, accounting, tax, or law. If the PhonePact account is already gone and no automatic deletion can be confirmed, an exact production Google transaction ID or eligible Apple order ID may be needed to locate the record; PhonePact sends RevenueCat no email customer attribute, so email alone may not identify it. Any manual request depends on unambiguous record matching, provider availability, required retention, and law.
  • Website submissions. We keep testing/waitlist, SMS-consent, feedback, and support records only while needed for the requested communication, support, safety, or legal purpose, unless you ask us to delete them sooner and no exception applies.

5. Your choices and privacy rights

  • Account controls. Correct profile details in the App and manage linked sign-in methods from the top-right account settings button under You. Delete the account at You → Profile → Delete account, or email us.
  • Device controls. Turn off Screen Time/Usage Access, push or notification access, Android Alarms & reminders, live status, or an optional Do Not Disturb exception in system settings. On Android, You → Profile → Private Insights data remains available after Supporter access ends and can stop private-history collection and clear local usage/notification summaries. In updated iPhone/Android versions, history backup under You → Profile stops new yearly-history saves and requests deletion of saved account years, leaving local days on the phone; see Sections 1 and 4 for account-wide deletion and retry details.
  • Billing controls. Cancel monthly support through the app store that billed you. Canceling stops future renewal under store terms but does not delete your account or history. Deleting the account or uninstalling the App does not cancel a subscription.

Depending on where you live and subject to legal exceptions, you may request access, correction, deletion, restriction, objection, or portability; withdraw consent; or appeal a denied request. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

Email support@getphonepact.com with “Privacy request” in the subject. We may verify your identity or an authorized agent’s authority before acting. If we deny a request, reply to appeal. We will respond within the period required by applicable law.

6. U.S. state privacy notice

In the preceding 12 months, PhonePact may have collected the following statutory categories, although not every example within a category: identifiers/contact/account data; commercial and purchase information; internet or electronic activity consisting of coarse screen-usage aggregates, check-in events, and technical service/diagnostic activity (not uploaded app-level Insights); approximate location derived from IP address; user-generated communications and photos; and support/safety records. Sources are you, your phone, people who interact with you in the Service, app stores, authentication/platform providers, and our processors. The business purposes and recipients are described in Sections 2 and 3.

PhonePact’s policy is not to sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. PhonePact does not show advertising. We do not offer a financial incentive in exchange for personal information; Supporter access is a digital feature purchased with money, not data. Because we do not conduct those opt-out activities, there is no sale/sharing opt-out necessary for us to apply. Where applicable, state law may provide rights to know, access, correct, delete, obtain a portable copy, limit certain sensitive-data uses, opt out of covered profiling, use an authorized agent, and appeal. Use the request process above.

Do Not Track and Global Privacy Control. PhonePact does not track you across other companies’ apps or websites and does not sell or share personal information for cross-context behavioral advertising, so these browser signals do not change how the Service works. Where the law treats a Global Privacy Control signal as an opt-out request, we honor it.

7. Children’s privacy

PhonePact is intended for people 13 and older (14 and older in South Korea and Spain) and is not directed to children below that age. We do not knowingly collect personal information from a child below that age. If you believe that occurred, contact us and we will investigate and delete it. People aged 13 to 17 may use PhonePact only with a parent’s or guardian’s permission. Where the law requires it, a parent or guardian must also agree to how a young person’s data is used (in some EU countries until the age of 16), and an app store may ask a parent or guardian to approve downloads, purchases, and significant changes to the App. A parent or guardian can contact us to review or delete their child’s information.

8. Security

We use reasonable technical and organizational safeguards, including encrypted transport, Firebase access rules, owner-only server paths, app/device authorization, and restricted operational access. On-device files are protected by the operating system; Android Insights files are excluded from Android backup. No transmission or storage method is completely secure, so we cannot guarantee absolute security.

9. International processing

PhonePact is based in the United States. We and our providers process information in the United States and other countries where they operate, whose laws may differ from yours. Where required, we rely on an adequacy decision (including the EU–U.S. Data Privacy Framework and its UK extension where a provider is certified), Standard Contractual Clauses (with the UK Addendum for UK data), or another lawful transfer safeguard. RevenueCat states that its service data is hosted in the United States and offers contractual transfer safeguards.

10. Website, forms, and network requests

This Policy also covers getphonepact.com. If you joined prior testing/a waitlist, opted into SMS, or submit website feedback, we process the name and email you provide, optional phone number and consent, message, form type, and submission time. Google Apps Script records the primary submission in Google Sheets. If JavaScript is unavailable or the primary result cannot be confirmed and you choose the displayed backup form, Formspree processes it instead.

The current site does not load an advertising or analytics tracker and does not set advertising cookies. GitHub Pages hosts the site, and Google Fonts plus Apple/Google store-badge or linked resources may receive ordinary HTTP data such as IP address, user agent, referrer subject to browser policy, and request time when your browser requests them. We use submitted contact details only for the communication requested, testing/launch administration, support, and safety — never targeted advertising or sale. Unsubscribe from email at any time, reply STOP to an SMS, or contact us to access or delete a website submission.

Pacts by PhonePact (getphonepact.com/pacts) is a separate web page with its own short privacy note, which this Policy supplements. It stores the pacts you make or sign (names, signatures, dates, terms, and each pact’s record) in a separate Firebase project in the United States, gives you a guest account the first time you sign, and keeps your name, sign-in, and a copy of your pacts in your browser. Anyone with a pact’s link can see everything on it. A pact stays until the person who made it deletes it; to remove your signature or anything else from someone else’s pact, email us. The rights, contact, and other sections of this Policy apply to it too.

Invite links are access capabilities. New links put the six-character invite after #. Browsers do not include that fragment in the HTTP request to GitHub Pages, and the page is designed to remove it from the visible address after reading it. Older ?c= links remain supported, but their full request URL, including the code, reaches GitHub Pages before page code can remove it and can remain in hosting/security logs under GitHub’s configured practices. The page’s no-referrer rule prevents the invite URL from being sent onward as a referrer to fonts, store badges, or followed links; it cannot hide a legacy query from the site host or erase a copy already made.

Either link form can also remain in the sender’s or recipient’s messages, link previews, clipboard, screenshots, and browser history or synchronization. PhonePact cannot set retention for or delete those outside copies, and in-app account deletion does not remove them. An invite code remains usable while its circle exists; it can remain usable after one member deletes their account if other members keep the circle, and the current App has no code-rotation or revocation control. For least exposure, send only the six-character code and enter it directly in the App, then delete message, clipboard, and browser-history/sync copies you control. Clearing those copies does not revoke the active code. GitHub’s handling is described in its Privacy Statement.

11. Additional information for people in South Korea

This section adds what Korea’s Personal Information Protection Act asks a privacy policy to state. For people in South Korea it applies alongside the rest of this Policy.

  • Age. You must be at least 14 to use PhonePact in South Korea. We do not knowingly process the personal information of a child under 14, and we delete it if we learn of it.
  • What we collect, why, and for how long. Section 1 lists each item, Section 2 its purpose, and Section 4 how long it is kept. In short: account, profile, circle, pact and check-in records are kept until you delete your account; ordinary room and private messages for 24 hours, or up to 30 days when kept; reported copies until 90 days after review; owner-only yearly totals with the clock and cleanup exceptions in Section 4; crash reports for 90 days; service logs for 30 days and audit logs for 400 days. In updated versions, What Counts room announcements expire after 24 hours, their receipt audience IDs become eligible for cleanup after seven days, and remaining receipt and pact-ordering records stay until account deletion, as described in Section 4.
  • How we destroy information. When a retention period ends or its purpose is met, electronic records are deleted in a way that cannot be reconstructed, and our providers then remove backup copies on the schedules described in Section 4. We keep no paper records. Where a law requires us to keep something longer, we keep it separately and use it only for that legal purpose.
  • Providing information to others. We do not give your personal information to third parties except as described in Section 3: to the people you choose in the App, and where the law requires it.
  • Processing entrusted to providers, and transfer outside Korea. Your information is sent over encrypted connections, when you use the Service, to these providers, which handle it on our behalf in the United States (and, for Google and Apple, other countries where they operate):
    • Google LLC (Firebase, Google Cloud) — account, profile, device, circle, pact, message, check-in, diagnostic and log data — hosting and operating the Service, sign-in, push delivery and crash diagnosis — until account deletion or the periods in Section 4.
    • Apple Inc. — sign-in identifiers, push and Live Activity routing, App Store purchase records — sign-in, notifications and billing — under Apple’s own retention.
    • RevenueCat, Inc. — Firebase account ID, purchase, entitlement and app/device data — validating purchases and access — until deletion completes after account deletion, or as the law requires.
    • 650 Industries, Inc. (Expo) — network and app/runtime data — delivering app updates — under Expo’s retention.
    • GitHub, Inc., Google LLC (Apps Script, Sheets) and Formspree, Inc. — website request data and website form submissions — hosting getphonepact.com and receiving forms — as described in Section 4 and Section 10.
    You can refuse these transfers by not using the Service or by deleting your account; the Service cannot run without them.
  • Your rights. You, or your legal representative, can ask to access, correct, delete or stop the processing of your personal information, and withdraw consent, by emailing us as described in Section 5. We respond within the period Korean law sets.
  • Safety measures. Administrative: access is limited to the people who need it. Technical: encrypted transport, access rules, owner-only storage paths and app/device authorization. Physical: data is held in our providers’ secured data centers. See Section 8.
  • Automatic collection. The App does not use cookies. The website sets no advertising or analytics cookies (Section 10); you can block cookies in your browser settings.
  • Privacy officer. Hank Yang, Founder — support@getphonepact.com.
  • Help from authorities. You can also contact the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Supreme Prosecutors’ Office cybercrime unit (1301, www.spo.go.kr), or the Korean National Police Agency cyber bureau (182, ecrm.police.go.kr).

12. Additional information for people in Japan

This section adds what Japan’s Act on the Protection of Personal Information asks us to make available.

  • Purposes of use. Section 2. We do not use personal data beyond those purposes without your consent, except as the law allows.
  • Providing data to others. We do not provide personal data to third parties without your consent except as the law allows. What other members see (Section 3) is shown because you choose to share it. We do not use personal data jointly with any other company.
  • Handling entrusted to providers in a foreign country. We entrust handling to the providers named in Section 3 and Section 11, which handle personal data in the United States and other countries where they operate. The United States has no single national privacy law equivalent to Japan’s; protection comes from federal laws for particular sectors and from state laws such as California’s. These providers are bound by contract terms requiring them to protect the data and use it only to provide their service to us, and some are certified under the EU–U.S. Data Privacy Framework. You can ask us for more about these measures.
  • Security control measures. We keep rules for how personal data is handled; the person responsible is Hank Yang. Access is limited to those who need it. Data is protected by encrypted transport, access rules, owner-only storage paths and app/device authorization, and is held in our providers’ secured data centers in the United States, whose legal system is described above. See Section 8.
  • Requests. You can ask us to disclose, correct, add to, delete, stop using, or stop providing to third parties the personal data we hold about you, or to disclose records of provision to third parties, by emailing us as described in Section 5. We verify your identity first. There is no fee.

13. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will post the new version and update the date above. For a material change, we will provide additional notice in the App or obtain consent where law requires it before the new processing begins.

14. Language

This Policy is written in English. If we provide a translation, the English version controls to the extent the law allows.

15. Contact us

PhonePact LLC
Email: support@getphonepact.com