Privacy Policy

1. Who we are

Paradox ("Paradox", "we", "us") is an app for iPhone, iPad and Android built by Paradox App SpA, a company in Chile. You can reach us at any time at support@tryparadox.app. This policy covers the Paradox apps for iOS and Android and this website.

2. Using Paradox without signing in

Blocking, scheduling, focus sessions, statistics, reading, levels and guardians all work without signing in. Your rules, your selected apps, your focus sessions and your event history stay on the phone.

Your guest account. The first time Paradox opens, it asks our server for a guest account: an anonymous record identified by a random number, with a session for this phone that carries the device identifier and session details described in section 3. It has no name, no email and no Google or Apple identity. It holds your progress: the days you had a block on and the focus sessions that earned experience (the day and how many minutes, never which apps), your level, and the guardians and attacks you chose. For each day you had a block on, it also holds the state your guardian ended that day in (Fresh, Wounded, Broken or Fallen), because that state decides how much experience the day earns. The phone works it out from your total time that day in the apps you guard, all of them added together: under 45 minutes is Fresh, 45 to 59 Wounded, 60 to 89 Broken, and 90 or more Fallen. Only the state is sent: not the minutes, not which apps, not how the time was split between them. On iPhone and iPad its session is kept in the iOS Keychain, which survives deleting the app, so reinstalling on the same device brings the same guest account back. On Android, reinstalling starts a new one.

A few other features also talk to our server, each carrying a random identifier created on the phone for this installation rather than anything about you: the articles you listened to and for how long, and battles you play with other people (see section 4). What you write to us carries the device identifier instead, as section 3 explains. The product analytics described in section 5 also run in that state, attached to a random identifier generated on the device rather than to you or to your guest account.

Signing in is optional and lives in the Profile tab. When you sign in with Google or Apple, your guest account becomes your account, with the same progress, and it follows you to any phone. If that Google or Apple identity already has a Paradox account, that account is the one you keep and the guest account is closed; if the guest had made any progress, the app tells you so and asks before going on. A closed guest account is deactivated rather than deleted, with its progress, in case you ask us to move something back. Signing out leaves the phone with a new, empty guest account at level 1, and the account you left keeps its progress for the next time you sign in. Signing in is needed to subscribe to Paradox Premium, because a subscription belongs to your account rather than to one phone, and to choose a player name.

3. What we collect when you sign in

• Name and email address. Provided by Google Sign-In or Sign in with Apple when you authorise them. If you use Apple's "Hide My Email", we receive a relay address and never your real one. Either field may be missing, and the account works anyway.
• A provider identifier. The stable subject ID Google or Apple uses for you, so we can recognise you next time. We do not store the sign-in tokens themselves: they are exchanged once for our own session and discarded.
• A device identifier. On iOS, Apple's identifierForVendor, which is specific to this app on this phone, is not shared with other developers, and is destroyed when you delete the app. On Android, the Android ID, which is specific to this app, this phone and your user profile on it. We use it to count devices on an account and to keep events from being counted twice.
• Session details. Device name, operating system version and app version, so you can tell your own sessions apart and we can debug version-specific problems.
• Your actions inside Paradox. A small set of events, each with a timestamp: a shield was shown, you passed through it anyway, you took a conscious pause, you started or stopped guarding, and moments like those. This is how we measure whether the product actually helps.
• Whether you tapped Rate. When Paradox invites you to rate it and you tap Rate, the time of that tap is kept with your account, so the invitation does not come back on another phone. Apple and Google never tell us whether you left a rating or what it said.
• Your player name. If you choose one: a unique name of 3 to 16 characters, which is what the other players of a battle see.
• Your subscription. If you subscribe to Paradox Premium, Apple or Google Play takes the payment and we never see your card. We receive the purchase record (the plan, when it started, when it renews or ends, and its status) through RevenueCat, the service that keeps track of subscriptions for us, and keep it with your account.

We never ask for a password, because there isn't one: the only way into an account is a token signed by Google or Apple.

When you write to us. The "Write to us" screen does not require an account. What you send us is the text you typed, the time, your app and operating system version, your language, and the device identifier. If you are signed in it arrives attached to your account; if you are not, it arrives anonymously.

4. What we do not collect

• Your screen time report. The per-app times you see in Stats never reach us. iOS computes them inside a sandboxed extension that is forbidden from passing them back to the app, so there is no path by which they could be sent anywhere. The screen recordings described in section 5 are masked over that part of the screen, so they do not carry them either. What can leave the phone about your time in other apps is coarse: once a day, the state your guardian ended the day in, one of four bands of your total time in the apps you guard (section 2); and, in a battle with other people, the steps described below. On iPhone and iPad the phone itself never learns the exact time: it adds up the steps of minutes each guarded app has crossed (5, 15, 30 and so on), so the state can only come out lighter than the real one, never heavier.
• Which apps you guard, on iPhone and iPad. Apple gives the app an opaque token for each selected app, not a name or bundle ID, so we cannot tell what you picked. Guarding events carry a short one-way fingerprint of that token, only so that two guarding sessions of the same app can be told apart. The one app we know by name is the app of a battle you play with other people, which you choose when the battle is created.
• Anything you type or read elsewhere. Paradox has no keyboard extension, no browsing history, no message access.
• Your precise location (Paradox never asks for it), contacts, photos, health data, or the contents of any other app.

On Android: accessibility, usage access and drawing over apps

Android has no Screen Time, so Paradox relies on three permissions instead, and explains each one before asking for it. You can turn any of them off in Android's settings at any time, and blocking stops working where it needs them.

• Accessibility service. Paradox uses Android's Accessibility API for one purpose: to notice when you open an app or a website you chose to block, and put the shield in front of it. While it is on, it reads which app is on screen; in supported browsers, the address shown in the address bar, which it reduces to the site name (such as youtube.com) to compare with your blocked sites; and, only if you turn on the short-video counter, whether a Shorts or Reels feed is showing, so it can count the videos. It does not read what you type, your messages, passwords or anything else on the screen. None of it is stored or sent anywhere: the site names are held in memory while the browser is open and never written down, and no website address or history reaches us or PostHog. When a site is blocked, analytics record only that a site was blocked.
• Usage access. Lets Paradox read how long each app was in the foreground, so it can show your Stats, apply daily limits and remind you after a few minutes. Those per-app times, and how many times a day you unlock the phone, are stored in the app on your phone and kept there for as long as the app is installed. Only if you turn on "Keep this history in my account" is that history backed up to your account: for each finished day, the exact minutes of each app against a one-way fingerprint of the app, never its name, and the number of times you picked up the phone that day. Turning it off stops the backup; what is already in your account stays until you delete the account. They are also added up, on the phone, into the day's total for the apps you guard, and the only thing that total sends is the state of your guardian described in section 2. The list of apps you have installed or guard is never sent.
• Display over other apps. Used only to draw a short guide on top of Android's settings while you turn the accessibility service on. The time and video counters that float over other apps are drawn by the accessibility service itself, can be switched off, and read nothing from the app beneath them.

One exception, the same as on iOS: a battle with other people is on one app, and to show it to every player the battle stores that app's name, which on Android can be its package name (for example com.instagram.android).

Battles with other people

A battle is one app, one week and one daily limit. Played alone, nothing about your usage leaves the phone; only the result, such as how many days you won, reaches our analytics. Played with other people, the battle lives on our server so that each phone can see the others, and it stores: which app the battle is on and its daily limit, and for each player a random installation identifier, platform, app version, language, player name, guardian and level, the day they joined or left, and for each day the highest step of minutes crossed on that app (a lower bound, never the exact time) and the moment the limit was reached, if it was. Everyone in the battle sees those days, and anyone with the battle's code can look up its app, its limit and the name of the person who started it. Joining a battle with other people is how you agree to share those days with them.

5. Product analytics, ad measurement, and the tracking we don't do

Paradox uses PostHog for product analytics. It runs whether or not you are signed in, and it is how a small team finds out that a screen confuses people or that the app crashes on a particular phone or system version. It collects:

• Events. The same actions listed in section 3 (a shield was shown, a pause was taken, guarding started), plus which screens you opened, and counts describing your setup: how many apps you guard, how many rules you made, whether you signed in. Never the names of your apps: guarding events carry only the fingerprint described in section 4.
• Crash reports. The type of error and the stack trace when the app closes unexpectedly.
• Session recordings, on iPhone and iPad only. A recording of your screen while you are inside Paradox, so we can see where a flow goes wrong. App icons, the Screen Time app picker and the statistics card are masked out of the recording before it leaves the phone, and no recording is ever made of anything outside Paradox.
• Identifiers. An identifier for this installation, and your account identifier once you sign in, so that a history does not split in two the day you do. If you sign in, your name and email are attached to that profile so we can recognise the account.
• No location. The app's analytics do not look up your country or city from the IP address of a request, and the address itself is discarded: it is not stored with your events.
• Which campaign brought the app, if any. Once per installation. On Android, the referral text Google Play keeps with the install, with Google's ad click identifier removed before it is stored or sent. On iPhone and iPad, Apple's answer through its AdServices framework, which only says whether the install came from an Apple Ads campaign and which one. It goes to PostHog and to RevenueCat, so we can tell which campaigns bring people who stay.

Measuring our ads

Paradox includes the SDK of AppsFlyer, a mobile measurement company, so we can tell which of our ads, if any, led to an install and whether the people it brings stay. It reports:

• A few moments. The install and each time the app is opened, the first time you start guarding apps, and creating an account with Google or Apple. Subscription events (a trial, a purchase, a renewal, a cancellation or a refund) are sent to AppsFlyer by RevenueCat from its servers.
• Identifiers. On Android, your device's advertising ID, which you can reset or delete in your phone's settings, under Google, Ads. On iPhone and iPad, the identifier Apple gives Paradox for this device, never the advertising identifier: Paradox does not ask for App Tracking Transparency permission, and its AppsFlyer SDK is the version built without access to it. Also your Paradox account number if you have signed in, so a subscription can be matched to its install.
• Device details. The IP address of the request, which AppsFlyer uses for the country and to detect fraud, and the device model, system version, app version and language.

AppsFlyer matches that against the ads it knows about and, when one of our ads led to the install, tells the network that showed it (Meta, TikTok, Google or Apple) that the ad worked: that it brought an install, a first guard or a subscription. The network uses that to measure the ad and to show it to people likely to want it. On iPhone and iPad networks also receive Apple's anonymous reports (SKAdNetwork and AdAttributionKit). Nothing about how you use other apps, no screen time, no names of apps and nothing from your Stats is ever part of it. Paradox shows no ads, so none of this is used to show you ads inside the app.

This website

www.tryparadox.app uses PostHog too, to count its visits: which pages you open, the page or search that sent you here, your country, browser and device type, and whether you pressed the waitlist button. It sets no cookies and stores nothing in your browser, which is why there is no banner to click through, and also why every visit starts from zero: we cannot tell that you came back. As with any website, your IP address reaches PostHog with each request; it is used to look up the country. The requests travel through our own domain rather than PostHog's.

Paradox shows no ads and contains no SDK from any ad network. Apart from measuring our own ads, described above, we do not combine your data with data from other companies, we do not build advertising profiles, and we do not sell or rent your personal information to anyone. Paradox does not ask for App Tracking Transparency permission and never reads Apple's advertising identifier. If you would rather not be included in analytics or ad measurement at all, write to us: we will delete your analytics profile and ask AppsFlyer to erase what it holds about your device.

The waitlist

If you leave your email address on the waitlist page, we store that address, the link or button that brought you there, the two-letter country our CDN assigns to your connection and your browser's language. That is the whole record: no name, no profile, nothing joined to your analytics. We will write to that address once, on the day Paradox is released, and you can ask us to delete it before or after that by writing to support@tryparadox.app. We do not sell or share the list, and it is not a newsletter.

That page carries no analytics of its own: it is a single file with no tracking script in it. The form is protected by Cloudflare Turnstile, which checks that a person and not a script is submitting it. To do that, Cloudflare receives your IP address and some signals from your browser. Cloudflare acts as our processor for that check and does not use it to build an advertising profile; it sets no tracking cookie for it. We never store your IP address ourselves.

6. Where your data lives

Account and event data is stored in a PostgreSQL database hosted by Neon, reached through an API hosted by Vercel. Subscriptions are tracked by RevenueCat, and guardians, backgrounds, music and articles are downloaded from Cloudflare. Analytics data is stored by PostHog on its US cloud. Waitlist addresses live in that same Neon database. Cloudflare runs the anti-spam check on the waitlist form, and AppsFlyer measures our ads. All of them are processors acting on our instructions and none is permitted to use your data for their own purposes. Data may be processed in the United States. Sign-in is handled by Google and Apple under their own privacy policies, and the ad networks that hear from AppsFlyer that one of our ads worked (section 5) handle that under theirs.

Session tokens are stored on your device in the iOS Keychain or in the Android app's private storage, and on the server only as a one-way hash: a leak of our database would not let anyone sign in as you.

7. How long we keep it

• On your device: events older than 90 days are deleted automatically.
• On our servers: your account and events are kept while the account exists, so your statistics stay meaningful over time. A guest account, including one closed when you signed in to an existing account, is kept the same way until you ask us to delete it. Sign-in sessions expire after 90 days.
• On the waitlist: your address is kept until the release email has been sent, and deleted within 90 days after that. Ask us sooner and it goes sooner.
• In analytics: session recordings are deleted automatically after 30 days, and events and crash reports after 12 months. Both are deleted sooner on request.
• After deletion: everything linked to your account is removed from the live database within 30 days, and from encrypted backups within 90.

8. Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it and close your account. Write to support@tryparadox.app from the address on the account and we will answer within 30 days. See Delete your account for the deletion process specifically.

Deleting your account from inside the app removes your account, your provider identity, your sessions, the guardians you earned and every event stored against them, permanently and with no grace period. From that moment the app stops attaching anything to you and starts over with a fresh anonymous identifier and a new, empty guest account. The analytics profile already held by PostHog is not deleted by that action; ask us and we will delete it too.

Deleting the app removes everything stored locally, but not your guest account on our server. The app has no delete button for a guest account, because it holds no name or email. To have it deleted, send us a message from "Write to us" inside the app before you delete it, asking for that: the message carries the device identifier, which is how we find the guest account. You can also write to support@tryparadox.app. We delete it within 30 days.

If you are in the European Economic Area or the United Kingdom, the legal bases we rely on are performance of a contract (running your account) and our legitimate interest in understanding whether the product works. You also have the right to complain to your local data protection authority.

9. Children

Paradox is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, write to us and we will delete it.

10. Changes to this policy

If we change what we collect or why, we will update this page and change the date at the top. Material changes will also be announced in the app before they take effect.

11. Contact

Questions, requests, or something here that doesn't match what you see in the app: support@tryparadox.app.