legal

Privacy Policy

Last Updated: September 9, 2026 · BrainDetox for Android

1. Who we are

BrainDetox (“BrainDetox”, “we”, “us”) is a screen-time tracker and app blocker for Android. This policy explains what information the app and our servers handle, why we handle it, and what you can do about it.

BrainDetox is operated by Parag Gajera, which is the data controller for the account information described below. You can reach us at any time at support@braindetox.app.

2. Permissions BrainDetox uses

BrainDetox works with the following Android permissions. Those marked optional are never required for the app to run, stay off until you turn them on, and can be withdrawn at any time in Android Settings.

Usage access — to measure how much time you spend in each app and apply the limits you set. This information stays on your device.
Display over other apps — to show a block screen when a limit is reached. No information is collected through it.
Notifications — to alert you when you are close to a limit, and to show the ongoing badge Android requires while blocking is running.
Notification access (optional) — while an app is blocked, BrainDetox dismisses that app’s notifications, so a blocked app cannot put itself back in front of you thirty seconds later. BrainDetox looks only at which app posted a notification and whether Android marks it as ongoing. It does not read the title, the text, the sender or any other content of any notification, and it never stores, logs or transmits any part of one. Calls, messages, your launcher, Android Settings and BrainDetox itself are always excluded, and the silencing lifts the moment the app is no longer blocked. You grant this in Android Settings and can revoke it there at any time, which stops it immediately.
Accessibility service (optional, off by default) — powers instant app, website and short-video blocking. It checks the foreground app name — and, with a separate opt-in, the browser address bar — against your block list, directly on your device, then discards it. A blocked keyword is matched against the website address only, never against page text, your searches or anything you type. It does not read messages, passwords or page content, and nothing it processes is saved or transmitted.
Fingerprint or face (optional) — to unlock the app using the biometric already set up in Android. Android does the matching and returns only a yes or no; biometric data is never available to us.
Photos and videos (only the ones you choose) — if you attach screenshots or a screen recording to a message to support, Android’s picker hands BrainDetox only the files you selected. The app never browses your gallery.
The list of apps installed on your phone — so BrainDetox can show your apps by name and icon and let you choose which ones to limit. That list is used on your device only and is never sent to us.
Exact alarms, battery-optimisation exemption, run after restart, and running a foreground service — these keep blocking running and on time, so a limit takes effect at the right moment and blocking resumes after a reboot instead of silently staying off. They collect nothing.
Internet — to sign you in, check your subscription, send support messages, and send the diagnostic reports described in section 6.

3. Screen-Time Data

All screen-time information is:

Processed and stored locally on your device
Used only to show your usage charts and enforce your limits
Removed completely when you uninstall the app or clear its data

The same applies to your daily limits, block lists, focus sessions and app-lock PIN. Your PIN is stored only as an encrypted verifier on your device and cannot be recovered by anyone, including us.

4. Account Data

Creating an account stores the following on our servers:

Your name and email address
A password hash (never the password itself)
Your Google account identifier, if you sign in with Google
Whether the device was set up for you or for a child, and account created and updated dates
Whether your email address has been confirmed
Sign-in session information, so that one account is signed in on one phone at a time. This includes a device code: a one-way hash that BrainDetox derives on your phone from an identifier Android provides. We never receive that identifier itself. The code cannot be reversed, cannot be matched against anything outside BrainDetox, and is used only to recognise that a phone signing in is the same phone that is already signed in, and to record that a phone has claimed a free trial.
A hash of any six-digit code we email you — to confirm your address when you register, or to reset a password or PIN — together with its expiry and how many times it has been tried. Never the code itself. Codes are single-use and expire within 15 minutes.

Standard server logs are kept for security: a shortened IP address that identifies the network rather than you, a timestamp, and the endpoint that was called.

5. Subscription and payment information

BrainDetox is free for 30 days and then needs a paid plan. All payments are handled by Google Play; we never see or store your card, bank or address details.

When you start a trial or buy a plan, our servers record:

Which plan you are on, and whether it is a trial, active, in a payment grace period, paused, expired, or a lifetime purchase
The Google Play product identifier for what you bought, when it expires, and whether it renews automatically
The purchase token and order identifier Google Play issues for the purchase, and Google’s own verification response for it, kept as the record of the transaction in case of a dispute, a refund or a support question
The device code described in section 4, recorded when a free trial is claimed

We check purchases against Google Play to confirm they are genuine and current. Purchase records are kept after a subscription ends — see section 10.

6. Diagnostic reports

BrainDetox sends us reports about its own behaviour, so we can find and fix faults we would otherwise never hear about: a block screen that failed to appear, a background service that a phone manufacturer shut down, a request that never completed, a crash. There is no analytics SDK, no advertising SDK and no third-party crash-reporting service in the app. These reports go only to us.

A report contains:

What the app was doing, whether it worked, and a code for the specific outcome
Your phone’s manufacturer, model and Android version, the app’s version, and technical details of the environment such as the Android API level, the device language and whether battery saver was on
A two-letter country code, taken from the mobile network your phone is registered to, or from its SIM, or from your device’s language region. This is not location data: BrainDetox asks for no location permission, uses none, and never looks your country up from your IP address. It tells us only whether a fault is confined to one market.
Which Android permission was switched on or off, and when — so that blocking that quietly stopped working can be traced to a permission that was withdrawn, including one withdrawn while the app was closed.
The technical details of any error, including the message and the stack trace the software itself produced
For a failed network request: its address, method and status code
An identifier for that run of the app, so events from one session can be read together
Your name and email address, if you were signed in at the time
A shortened form of your IP address, recorded by our server

Reports never contain your screen-time data, your limits, your blocked apps, sites or keywords, how long any of them are set for, or your PIN. Values of that kind are stripped before a report leaves your phone and stripped again when it reaches our server. There is one deliberate, narrow exception: the name of a web browser application is kept, because website-blocking faults differ from one browser to another and cannot be fixed without knowing which browser was involved.

A small number of reports — a crash, a failed request, a block that did not work, a sign-in that failed before it reached us — can be sent while you are signed out, because otherwise nobody could report them. Those carry no account information.

Reports wait on your phone until they can be sent, and are deleted from it once they are.

7. Messages you send us

If you write to us from inside the app, or send a bug report, we receive your message, any star rating you gave, your app version, your phone model, and your account’s email address. You may attach up to ten images and one screen recording; we receive only the files you choose.

Please note that a screenshot or a recording shows whatever was on your screen at the time. Look at what you are sending before you attach it, and leave out anything you would rather we did not see.

8. Third-Party Services

A small number of providers process data on our behalf, or provide data to us:

Hosting and database provider — stores the account, subscription and diagnostic data described above
Email provider — delivers registration, password-reset and PIN-recovery emails
Google Play Billing — takes your payment, is the seller of record for every purchase, and tells us whether a purchase is valid and current. Google handles your payment details; we never receive them.
Google Fonts — serves the app typeface on first launch (receives your IP address, then cached)
Google Sign-In (only if you use it) — provides your name, email address and account identifier

None of these providers receives your screen-time data, your limits, your block lists or your PIN, because none of that reaches our servers at all.

9. Why we are allowed to process this

Where the law requires us to name a basis for processing:

Account, sign-in and subscription information — necessary to provide the service you asked for.
Diagnostic reports, shortened IP addresses and security logs — our legitimate interest in keeping the app working and the service secure.
The accessibility service and notification access — your consent, which you can withdraw at any time in Android Settings.
Messages you send us, and anything you attach — your consent, given by sending them.

10. Data Retention

Local app data remains on your phone until you uninstall the app or clear its data
Account and subscription data is kept until you delete your account
Purchase records are kept as a record of the transaction, as tax and accounting rules require
Diagnostic reports are kept for 30 days, or 180 days where they record a failure, and are then deleted automatically
Registration, password-reset and PIN-recovery codes are deleted when used or when they expire, within 15 minutes
Support messages and their attachments are kept for RETENTION PERIOD
Residual copies in encrypted database backups are overwritten within 30 days

11. Deleting your account

You can delete your account instantly in the app under Profile › Delete Account, or through the account-deletion page at api.braindetox.app/account-deletion. If you have already uninstalled the app, email us from your account’s address and we will complete the deletion within 30 days.

Deleting your account immediately and permanently erases your name, email address, password hash, Google account link, subscription and purchase records, and any outstanding codes. Nothing is kept as a disabled or archived record, and every signed-in device is signed out. Residual copies in encrypted backups are overwritten within 30 days.

Two things are not erased along with the account, and we would rather say so plainly:

Messages you have sent us, and anything attached to them, are kept so that the fault you reported can still be fixed. Your email address stays attached to the message unless you ask us to remove it.
Diagnostic reports already sent keep the name and email address recorded at the time, until they age out on the schedule in section 10 — 30 days, or 180 days for a report recording a failure. The record that the deletion itself took place keeps no name and no email address — only an internal identifier that no longer refers to anyone — so that we can still show a deletion was carried out.

Email support@braindetox.app and we will remove your details from both.

Your on-device data — usage history, limits, block lists, focus sessions and your PIN — is never sent to us, so there is nothing on our side to delete. It is removed when you uninstall the app or clear its data.

12. Security

Passwords and emailed codes are stored only as Argon2id hashes — we never hold either in a readable form. Sign-in tokens are held in Android’s encrypted, Keystore-backed storage, and every connection to our servers uses HTTPS. Your blocked-site, keyword and feed lists are held in an encrypted store on your device.

13. Where your data is held

Our servers and database run on infrastructure that may be located outside your country, so the account, subscription and diagnostic information described above may be stored abroad, under our providers’ data-protection terms. Screen-time data is unaffected: it never leaves your phone.

14. Children

BrainDetox is intended for people aged 13 and over, and you must be old enough to agree to this policy where you live. We do not knowingly create accounts for younger children; if you believe one exists, email us and we will delete it.

BrainDetox can be installed on a child’s phone. The account then belongs to the adult who set it up, and that adult is the one agreeing to this policy. There is no remote monitoring of any kind: the child’s usage data stays on the child’s phone, and a parent can see it only by picking that phone up.

15. Your Rights

You have the right to:

Delete all local data by uninstalling the app
Control app permissions through Android settings, including withdrawing the accessibility and notification permissions at any time
Delete your account instantly in the app under Profile › Delete Account, or through the account-deletion page on braindetox.app
Ask us for a copy of the account information we hold, to correct it, to have it erased, or to object to our processing it

Write to support@braindetox.app from your account’s address and we will answer within 30 days, free of charge.

16. Changes to this Privacy Policy

When this policy changes we update the date at the top of this page. Where a change is significant we will also tell you in the app or by email, rather than relying on you to re-read this page.

17. Contact Us

If you have any questions about privacy or data protection, please contact us at support@braindetox.app