Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how the Tocky mobile application (the "App") and its associated website collect, use, process, and protect information when running on iOS and Android devices. This Policy is structured in strict compliance with the Apple App Store Review Guidelines (specifically Section 5.1 regarding Data Privacy and Security) and the Google Play Developer Program Policies.

2. Factual Categories of Data Collected and Processed

Tocky operates on an anonymous-by-default architecture. We do not require users to create an account, sign up with an email address, or configure password credentials. The following data points are processed:

• Anonymous Authentication Identifiers: To identify device sessions and sync settings, Tocky accesses unique, platform-provided tokens (Apple's Identifier for Vendors [IDFV] on iOS, or Google Play Services Advertising Identifier on Android). These tokens are processed securely via our secure backend servers to host profile sessions without requiring manual sign-up, email entries, or passwords.
• User-Configured Settings: We store application parameters (active/inactive armed states, targeted social media bundles, daily scroll limits, lockout durations, and chosen unlocking tasks such as breathing exercises or mindful typing challenges) associated with your anonymous platform token.
• Focus Statistics & Activity Logs: In order to render metrics on your dashboard, we track focus sessions (specifically duration in seconds, timestamps, and whether a lockout event was triggered). These logs are indexed strictly by your anonymous device token and stored securely in our cloud-hosted encrypted database records.
• Subscription Transactions: Tocky is a subscription-based utility offering a 3-day free trial. We integrate a secure subscription verification platform to verify subscription purchases, entitlement transactions, and billing states. All financial transactions are processed exclusively by Apple App Store or Google Play Store payment systems. Tocky never accesses, processes, or stores payment card credentials, bank account details, or real billing names.

3. Use of Native Platform APIs and Permissions

Tocky integrates official platform-native API frameworks to monitor feed activity and enforce digital boundaries. These permissions are requested explicitly through system dialogs:

For iOS Devices (Apple App Store Review):

• Apple Screen Time API (FamilyControls): Used to request authorization to manage boundaries and app shields for selected social applications. All processing is restricted to local Apple sandboxes; Tocky does not read, access, intercept, or upload personal messages, passwords, search strings, or media content.
• Device Activity & ManagedSettings: Required to system-trigger the native lockout shield screen when your self-configured focus sessions or time boundaries are reached.

For Android Devices (Google Play Review):

• Accessibility Services API: Utilized strictly to monitor vertical drag/swipe events inside specific designated social applications. Accessibility parameters are never used to log keystrokes, monitor chats, collect text inputs, or capture screen contents. No data collected via this API is transmitted off-device or shared with third parties.
• System Alert Window (Draw Over Other Apps): Required to project full-screen lockout covers on top of social applications when limits are exceeded.

General System Permissions (Both Platforms):

• Push Notifications: Enables the app to dispatch focus reminders, countdown completions, and session status updates.

4. Data Sharing and Third-Party Sub-Processors

We do not sell, rent, trade, or distribute your anonymous usage data or identifiers. We partner with the following infrastructure providers to deliver cloud synchronization:

• Secure Database Hosting Services: Manages authentication databases, cloud user configuration preferences, and anonymous session keys using your device's store identifier.
• Subscription Verification Engine: Handles subscription entitlements validation, receipt checks, and subscription state syncs.

5. Retention, Security, and Data Erasure Rights

All data in transit is encrypted using industry-standard TLS 1.3 protocols. Usage statistics are hosted in secured cloud environments. Local parameters are stored safely within your device's sandbox keychain or local storage. You have full rights to inspect, update, or permanently delete your anonymous user profile and linked scroll logs. To request complete deletion of all records associated with your device store ID, please email us directly at tocky.support@gmail.com.

6. Children's Privacy

Tocky is not designed for or directed to children under the age of 13. We do not knowingly collect, store, or process personal data from children under 13. Because our service utilizes anonymous device-based identifiers rather than manual sign-ups, we do not compile real-world identifiers for any users. If you believe a child under the age of 13 is utilizing Tocky, you may contact us to request the immediate erasure of any synced configuration logs.

7. Amendments

We reserve the right to modify this Privacy Policy to maintain alignment with Apple App Store policies, Google Play Store guidelines, and native OS capabilities.

8. Contact Us

If you have questions regarding this Privacy Policy or our local data-processing standards, contact us at:

Email: tocky.support@gmail.com