Informativa sulla privacy

1. Introduction

This Privacy Policy explains how Anchor ("Anchor," "we," "us"), developed by kiyen, handles information when you use the Anchor mobile application (the "App"). It applies to all supported languages and platforms.

Anchor is built to be local-first: the App does not require an account, and there is no Anchor-operated server that stores your personal data, apart from the optional issue reports and early tester sign-ups described in Section 6. Almost everything the App does happens directly on your device. This policy explains exactly what data the App accesses, why, and the few cases where information does leave your device.

2. No account required

Anchor works fully without signing up, logging in, or creating an account. There is no username, password, or profile tied to your identity on our servers — because we don't operate servers that store your app data at all. Any reference elsewhere (app stores, reviews) to "your Anchor account" refers only to your Google Play account used for purchases, not an Anchor-specific account.

Because there's no account, there's no "delete my account" process to describe — see Section 8 for how your data-related rights work instead.

3. Data we store, and where

All configuration and activity data you create in the App — your blocking profiles, blocked apps/websites, blocking rules and schedules, session history, and focus statistics — is stored only on your device, in a local encrypted or app-private database. None of it is uploaded to us, because we have nowhere to upload it to.

Specifically, this includes:

• Your blocking profiles, blocked targets (apps, websites, keywords), and blocking rules/schedules you configure.
• Your strictness settings for each profile (Hold, Earn, Seal) — e.g., delay times, access windows, and bypass-token counts.
• Session state (Quick Blocking, Pomodoro, Lock Me Out) and your Guard Mode configuration (protected profiles, active days, deactivation methods, and any timer), including a securely hashed copy of any password you set — never the password itself in plain text.
• Any custom block-screen message you write, and any custom background image you choose (a resized copy is stored privately on your device).
• Local usage statistics used to power the in-app Analytics tab: which apps and websites you use and for how long, how many times you unlock your device or pick it up, the length of your longest session, how many notifications you receive (each stored only with its time and the name of the app that posted it — never its title, text or other content), which app you open first after picking up your phone and which apps you switch between, and how long your completed Quick Blocking and Pomodoro sessions lasted. For longer-term trends, Anchor also keeps a compact daily summary of these figures (see Section 4). Adult websites are left out of website statistics by default, and you can turn that off in Settings → Data & Privacy. The same exclusion applies to the daily summary.
• A record of blocking events and bypass attempts, used only to calculate your local streaks and the insights shown in the Analytics tab.
• Home-screen widgets (a small analytics view and Quick Blocking controls) and optional usage-reminder notifications (such as “you've spent N minutes on this app today”) are built on your device from the data above and are never sent anywhere.

If you use the App's backup feature, it creates a local file on your device (or wherever you choose to save/share it) — this file is created and controlled entirely by you, and deliberately excludes your usage statistics, bypass history, and any account/purchase information.

4. Data retention

Detailed Analytics data — app usage sessions, screen unlocks, phone pickups, and notification records — is automatically deleted after 120 days, and website usage records after 35 days. To show longer-term trends, Anchor also keeps a compact daily summary for up to 365 days (per day: totals, the apps you used with their time and open counts, the websites you spent the most time on, hourly totals, and counts of which apps you open first, switch between, return to, or received notifications from); it contains no timestamps or content. Bypass and block-screen history is deleted after 365 days. You can delete this history yourself at any time for any range of past days in Settings → Data & Privacy (today's data can't be deleted, because usage limits depend on it). Your blocking profiles, rules, and settings are kept until you delete them yourself or uninstall the App. Because Anchor's Android app-backup setting is disabled, uninstalling the App removes this data completely — nothing is retained afterward, by us or by Android's own backup system.

5. Permissions we request, and exactly why

Anchor requests several special ("restricted") Android permissions because its core purpose — blocking distracting apps and websites — requires deep integration with the operating system. We only request a permission when it is needed for a feature you use, and we explain what each one is for before you grant it.

Accessibility Service

This is Anchor's primary blocking mechanism. When granted, it allows the App to detect:

• Which app is currently in the foreground on your device, so Anchor can show a block screen if it matches something you've chosen to block.
• The text in your browser's address bar (for supported browsers), so Anchor can block specific websites you've configured, not just entire browser apps.
• During a Lock Me Out session, the same service lets Anchor show a full-screen lock overlay and close the notification shade, the recent-apps screen and the power menu so the session can't be sidestepped. Only the Emergency call button and the phone dialer remain reachable. It reads nothing else for this purpose.

This check happens entirely on your device, in real time, by comparing what's on screen against the blocking list you configured. Nothing is transmitted anywhere, logged permanently, or sent to us. Anchor does not use this permission to read the content of your messages, emails, photos, or any other app's data — only the foreground app's identity and, for browsers, the address bar text. Anchor's primary purpose is app/website blocking, not disability accessibility, so we do not claim to be an accessibility tool in the sense of assistive technology — we use this Android API because it is the only way to reliably detect foreground app and browser activity for blocking purposes. In-app browsers within other apps (e.g., an embedded browser inside a social app) and privacy-focused browsers like Tor are not readable by this feature.

Before this permission is requested, the App shows a dedicated screen explaining exactly what is accessed, how it's used, and that nothing is shared — and asks for your explicit agreement before continuing to your device's settings.

Usage Access (Usage Stats)

Used to cross-check and improve the accuracy of the App's own local usage tracking against Android's system-level usage statistics. This data stays on your device and is used only to power the Analytics tab described in Section 3.

Location (including background location) and Wi-Fi

Anchor requests location access for two specific purposes, both opt-in and only requested when relevant:

• Reading your Wi-Fi network name (SSID) — required by Android itself (since Android 9) as a side effect of reading Wi-Fi information, used only if you set up a Wi-Fi-based blocking rule.
• Location-based ("geofence") blocking rules — if you choose to create a rule that turns blocking on or off based on your location (e.g., "block social media except at home"), Anchor needs to monitor your location, including in the background, so the rule keeps working even when the App isn't open. This is requested only when you add a location-based rule, never upfront.

Before background location is requested, the App shows a dedicated disclosure screen (the same format as the Accessibility disclosure above) explaining what's accessed and that it is never transmitted anywhere. All location processing happens on your device.

Display over other apps

Used to show the blocking overlay screen when a blocked app or website is detected.

Device Administrator (Guard Mode)

If you enable Guard Mode, Anchor asks to become a Device Administrator solely to prevent the App from being uninstalled while Guard Mode is active, as an anti-self-sabotage measure you opt into. It is removed when you turn Guard Mode off. This permission is scoped narrowly and does not give Anchor the ability to wipe, lock, or otherwise control your device beyond this uninstall protection.

Camera and NFC (Guard Mode unlock)

If you choose a QR code or an NFC tag as a way to turn Guard Mode off, Anchor uses the camera only to scan that code, and reads an NFC tag's ID only when you tap it. Nothing is recorded, photographed or sent anywhere. Only a salted one-way hash of the code or tag ID is stored on your device, and it is not included in backups. Camera access is requested only when you set this up, and you can use Anchor without it.

Notification access

Used only to detect notifications by package name (i.e., which app they came from) so Anchor can dismiss those from apps you've blocked or during a Quick Blocking session, and to keep an on-device count of how many notifications you receive. Anchor does not read the text or content of your notifications, and for the on-device count stores only the time and the name of the app that posted each notification.

Other permissions (low sensitivity)

Battery-optimization exemption, exact alarms, boot-start, wake lock, and foreground service permissions are used only to keep the blocking engine running reliably in the background and are not related to accessing personal data. Storage/media permissions are used only to save a streak or daily-average "share card" image you generate to your device's Photos when you choose to.

Anchor also reads the list of apps installed on your device so you can choose what to block and, if you turn on the Premium option to block new apps automatically, to notice newly installed ones. This list is used only on your device and is never transmitted anywhere.

6. Third-party services

Because Anchor has no backend for the App's own data, the only ways any information can leave your device are the third-party services below and the optional issue reports and early tester sign-ups described after them.

• Google (favicon lookup): when you add a website to block, Anchor requests that site's icon from Google's public favicon service, which necessarily sends the domain name you typed. No other information is sent.
• Clearbit (domain autocomplete): while typing a website address to block, Anchor may send the partial text you've typed to Clearbit's autocomplete service to suggest matching domains.
• RevenueCat: manages Anchor's subscriptions and in-app purchases. RevenueCat identifies you only by an anonymous, device-based purchase ID — not by name, email, or any Anchor account, since none exists. See RevenueCat's own privacy policy for details on how they handle this data.
• Google AdMob: Anchor shows ads to free-tier users (ads are removed for Premium subscribers). AdMob may collect an advertising identifier and other data to serve and measure ads. If you're located in the European Economic Area or UK, Anchor shows a consent form (via Google's User Messaging Platform) before any ad personalization occurs, in line with GDPR requirements. Free-tier ads include banners on some block and waiting screens, and a full-screen ad after you have been granted temporary access.
• Adult-content filter: Anchor's adult-content blocking feature checks websites entirely on your device, using a filter bundled with the App — no website you visit or attempt to visit is ever sent anywhere or checked against an external server. To keep that filter's list of blocked sites current between App updates, Anchor periodically (about once a week) downloads an updated copy of this filter file in the background. This download carries no information about you or your browsing activity — it's a one-way fetch of a public list, the same kind of update any spam or ad blocklist uses.

Issue reports (optional)

If you choose to report an issue (Settings → About → Report an issue opens the report page on our website), what you type there is sent to our server and stored in a database hosted by Supabase; the website itself is hosted by Vercel. A report contains your description and answers, the phone brand, model, Android version and app version if you enter them, screenshots you attach (up to 3, 1 MB each), and an email address only if you choose to give one. If you tick Include app info from my phone, it also contains the app version and build number, Android version, whether Premium is active, whether the accessibility service is on, which permissions are granted, how many profiles are active, and the app language. The page shows exactly what will be sent. Nothing from the App is sent unless you tick that box and press Send, and the App itself never contacts that server: it only opens the web page.

We use a report only to find and fix the problem you describe and, if you left an email, to reply to you about that report. We do not use it for advertising, marketing, analytics, profiling or training models, we do not sell it, and we do not share it with anyone except Supabase and Vercel, which process it on our behalf. Your email address is never added to a mailing list.

To limit abuse we keep a salted one-way hash of your network address (and of your email address, if given) for at most 48 hours; we do not store the address itself. A report is kept until 180 days after we close it (its screenshots 90 days), then deleted. To have a report deleted sooner, email us the report code shown after you send it.

Early tester sign-up (optional)

While Anchor is in a closed test, you can ask to join it (Settings → About → Become an early tester, or the link on our website, opens the sign-up page). What you type there is sent to our server and stored in the same Supabase database (the website is hosted by Vercel): your email address, your tick of the consent box, and, only if you enter them, your phone model, Android version, a short note and the language of the page. The App itself never contacts that server; it only opens the web page.

We use this only to send you the test invitation (a Google Play test link and a Google Group link) and to contact you about the test. The invitation is sent by hand from a personal mailbox or, if we switch it on, by an email service that sends it for us (currently none). We do not use it for advertising, marketing, analytics, profiling or training models, we do not sell it, and we do not add it to a mailing list. To add you to the test, your email address is entered into Google Groups / Google Play Console, which process it under Google's own terms. It is deleted 60 days after the test ends, or 30 days after we remove you; email us to have it deleted sooner. As with reports, we keep only a salted one-way hash of your network address and email for at most 48 hours to limit abuse.

We do not use any analytics, crash-reporting, or advertising-tracking SDK beyond what's described above — in particular, we have no Firebase, Sentry, Mixpanel, or similar third-party analytics integrated into the App.

7. Children's privacy

Anchor's declared target audience on Google Play is users aged 13 and older. Anchor is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information through a third-party service listed above, please contact us using the details in Section 11.

8. Your rights

Depending on where you live, you may have rights under laws such as the EU/UK GDPR, US state privacy laws (e.g., CCPA/CPRA), Brazil's LGPD, India's Digital Personal Data Protection Act (DPDP Act), or Indonesia's Personal Data Protection Law (UU PDP), including rights to access, correct, delete, or export your personal data.

Because Anchor stores your data only on your device and has no account system, these rights are largely self-service:

• Access & correction: everything Anchor knows is visible and editable directly in the App.
• Export: use the in-app Backup/Export feature to save a local copy of your configuration.
• Deletion: delete individual profiles or rules within the App, delete your usage history for any range of past days in Settings → Data & Privacy, or uninstall the App to remove all local data at once (Anchor does not use Android's automatic app-backup, so uninstalling leaves nothing behind).

For anything involving the third-party services in Section 6 (e.g., a RevenueCat purchase record, or an AdMob advertising identifier), please contact that provider directly using their own privacy tools, or contact us and we'll help direct your request.

California (CCPA/CPRA)

If you're a California resident, you have the right to know what personal information is collected about you, request its deletion or correction, and opt out of the "sale" or "sharing" of your personal information. Because Anchor shows ads through Google AdMob, this may involve "sharing" your advertising identifier for cross-context behavioral advertising as CPRA defines it — even though no information is ever sold for money. To exercise your opt-out right, open Settings → About → Privacy Options in the App (visible when required for your region) — this opens Google's consent management tool, where you can withdraw consent for personalized advertising at any time. Anchor does not sell personal information, and does not knowingly sell or share the personal information of anyone under 16.

India (DPDP Act)

If you're located in India, the Digital Personal Data Protection Act, 2023 applies to any personal data Anchor's third-party services (Section 6) process on your behalf. Anchor's own data processing is consent-based by design — you choose to grant each permission, and the local-first architecture described in Sections 3–5 means most "processing" never leaves your device in the first place. The DPDP Act defines a "child" as anyone under 18; see Section 7 for Anchor's declared minimum age.

9. International data transfers

Since the App has no first-party server, this section only concerns the third-party services in Section 6 and the hosting of issue reports and tester sign-ups. Google, RevenueCat, Clearbit, and, for issue reports and tester sign-ups you choose to send, Supabase, Vercel and (for the test invitation) Google may process data outside of your country of residence as part of their own global infrastructure; please refer to their respective privacy policies for details on international transfers and safeguards.

10. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add a feature that changes what data the App accesses. The "Effective date" at the top of this page always reflects the latest version. If a change is significant, we'll aim to let you know inside the App (e.g., a one-time notice) in addition to updating this page.

11. Contact us

If you have questions about this Privacy Policy or how Anchor handles data, contact us at anchor.kiyen@gmail.com.

For help using Anchor, see our Help & Support page.