1. Who this covers
This policy explains how PhoneStack ("we", "us") handles information when you use the PhoneStack iOS app and related services. PhoneStack is a social focus app: you run shared "Stack" focus sessions with friends, make Pacts to stay under daily app limits, set shared goals, and build streaks.
2. Information we collect
You give us: your email address and a password (handled by our authentication provider; we never see your plaintext password), a username and display name, and — if you enable notifications — your Apple push (APNs) device token.
Created as you use the app: Stacks you create or join (duration, goal, join code) and your "locked in" status during them; Pacts you're in (title, daily limit, and pass/fail results per day); shared goals and progress; streak counts; friendships and friend requests; nudges sent within sessions.
3. Screen time & Family Controls — what we can and cannot see
PhoneStack uses Apple's Family Controls and Device Activity frameworks. By Apple's design, we never receive your app usage data: which apps you pick for a Pact or Stack, and how long you use them, is known only to your device. Your phone evaluates limits locally and sends us exactly one thing when a Pact limit is crossed: a pass/fail event for that day. App selections are stored only on your device and cannot leave it. Blocking during Stacks is applied by iOS on your device.
4. Information we do NOT collect
We do not collect your app usage or Screen Time data (see above), your contacts, or your precise location. We do not sell personal information and we do not use it for third-party advertising. We currently use no third-party analytics; limited operational logs (crashes, errors) may be processed to keep the service working.
5. How we use information
To run your account and the core features (sessions, pacts, goals, streaks, friends, notifications), to secure the service, and to comply with law. That's it.
6. Sharing
With other users: friends see your profile (name, username), streaks and focus stats, and pact members see your daily pass/fail and whether your device has the pact set up. Session presence is visible only to participants of that session.
Service providers: Supabase (database, authentication, hosting; data stored in the United States) and Apple (push notifications). They process data only to provide the service.
Legal: if required by law, or to protect rights, safety, and service integrity. If PhoneStack is ever part of a merger or acquisition, data may transfer with notice as required by law.
7. Retention & deletion
We keep your information while your account is active. You can permanently delete your account in the app: Me → Delete account. This erases your profile, friendships, pacts, sessions, and streaks, subject to limited retention required by law or security. You can also email diegoprozzi@tamu.edu.
8. Security
Encryption in transit, row-level security so users only see data scoped to them, and scoped access keys. No system is perfectly secure, but data minimization is the core design: the most sensitive data (your app usage) never reaches us at all.
9. Children
PhoneStack is for users 13 and older. It is not directed to children under 13 and we do not knowingly collect their data. If you believe a child under 13 has provided us information, contact us and we will delete it.
10. Your rights
Depending on where you live (e.g., California/CCPA, EU/UK GDPR), you may have rights to access, correct, delete, or port your data. Exercise them via in-app deletion or by emailing diegoprozzi@tamu.edu.
11. International users
We operate from, and store data in, the United States. By using the service you understand your information is processed there.
12. Changes
We may update this policy; we'll change the date above and notify you in-app or by email for material changes.