What we can and cannot see.

These are not policies. They are limits of how the app is built, and we could not change our minds about them without shipping a different app.

• Which apps you block. Apple's picker hands Warden an opaque token, never a name or an icon. The app renders them by asking iOS to draw them, and never learns what it drew.
• How much you use your phone. iOS does not expose a usage figure to apps like Warden. There is no number anywhere in the product because there is no number available.
• Your browsing, your messages, your device location, your contacts, or your photos. The optional contact page records an approximate city, region, and country from the web request when available; it never asks for GPS access or precise coordinates.
• Your blocking schedule. It lives on your device, in storage shared with the app's own extensions, and is never sent anywhere.

Everything below lives in Google Firestore, in a project we control. It is what makes a request from one phone appear on another.

About you

First name, timezone, sign up date

Sign in

Provider used, and email if you linked one

Your pairing

Who holds your key, and their first name

Requests

Minutes asked for, your note, the answer

Streak

Days kept or broken, up to one year

Events

Override used, access revoked, missed check in

Devices

A push token per phone, so we can notify it

Subscription

Plan, trial and entitlement status; Apple handles payment details

Contact messages

Your name, reply email, message, and approximate place

The count of apps you block is stored. Their identity is not, and cannot be.

For as long as your account exists. Contact messages are kept until they have been handled and removed by an administrator. Streak history is trimmed to a year. Nothing else expires on a schedule today, and we would rather say so than describe a deletion that does not happen.

Deleting your account from Settings removes your profile, your streak, your pairings, your requests and your device registrations. Pairings where you held someone else’s key are marked ended rather than deleted, because they are also that person’s record. Event entries are currently kept.

Four companies, each doing one job. None of them is paid for your data and none is given it for their own purposes.

Google Firebase

Sign in, database, notifications

Vercel

Hosting for this site and the API

Apple

The App Store and push delivery

RevenueCat

Subscription status and purchase management

Apple processes App Store payments. RevenueCat receives purchase and entitlement information so Warden can determine whether a trial or subscription is active. Warden does not receive or store your full card or bank details.

• No analytics SDKs. Warden does not measure your behaviour inside the app.
• No advertising networks, and no sale or sharing of anything with one.
• No profile of you. There is nothing here to build one from.
• No reading of your data to train anything.

How many days you have kept, and the requests you send them. That is the entire surface. Not which apps, not what time of day, not how often you open anything.

This is enforced on the server rather than hidden in the interface. The API that serves a Keyholder simply does not return the rest.

You can see everything Warden holds about you inside the app, and delete all of it from Settings without asking anyone. If you would rather have a copy, or want something corrected, ask and we will do it.

Depending on where you live you may also have a statutory right to access, correct, export or erase your data, and to object to how it is handled. We will not ask why.

Warden is not designed for children and we do not knowingly collect anything from anyone under 13. If a child has set up an account, tell us and we will remove it.

The date at the top moves and the change is described here. The limits in the first section cannot change without a different app, which is the point of putting them first.

Privacy questions can be sent through our contact page.