Privacy policy

In effect from [date]. It covers the Rewire app on iPhone and Android, and this website.

The short version. Your screen-time figures and the apps you spend that time in stay on your phone. An account stores only what you would need on a second phone. If you ask someone to hold the code that ends strict mode, they are asked first, their name and email address are kept only until it ends, and they can tell us never to email them again. Analytics is anonymous and can be switched off inside the app. Nothing is sold, and Rewire shows no ads. Rewire is advertised on Facebook, Instagram and TikTok, and Meta and TikTok are told about installs and subscriptions so we can see which ads work.

Who is responsible

Rewire is provided by Rewire. For anything in this policy, write to privacy@example.com.

What stays on your phone

Your screen time. How long you use your phone each day, and which apps that time goes to. Rewire reads it through Apple's Screen Time or Android's usage access to show it to you, and it is not uploaded.
On iPhone, the apps you lock. Apple hands the app a sealed reference that only the system can open. Rewire cannot read which apps you chose, and cannot send them anywhere.
How often a locked app was opened, and how often you turned back.

What an account stores

An account is optional. Without one, Rewire keeps everything on the phone. When you create one — with an email address, Apple or Google — it holds what is needed to carry your progress to another phone:

your email address, and the name you typed;
your language, your daily goal and the day you started;
the activities you created, the sessions you logged, and the minutes you earned and spent;
your lesson progress;
on Android, the list of apps you chose to lock, so a new phone can lock the same ones. On iPhone this list cannot leave the device, so it never reaches us;
the answers you gave while setting Rewire up: how you would like to be addressed, where you heard about Rewire, what usually pulls you to your phone, how scrolling leaves you feeling, and what you want to earn time with;
on Android only, the one screen-time average measured when you set your goal, so the goal means the same on another phone. Your daily history is never uploaded on either platform.

If you use Rewire without creating an account, the app still uses an anonymous account behind the scenes so your data can be backed up. It holds no name, no email and nothing that identifies you, and it is deleted automatically after 30 days without use.

A code from someone you trust

Subscribers can set strict mode to end only with a code that someone else holds. If you choose this, you enter that person's name and email address. Rewire keeps both in its database only until strict mode is over.

When you choose them, we email them an invite, sent through Resend, with the name you gave Rewire, so they know who is asking. Strict mode with a code starts only once they accept it on this website. An invite lasts 5 hours, and you can withdraw it before then.
After that, they hear from us only when you ask to end strict mode: an email with a six-digit code. They do not need the app.
The code is never stored in readable form, only as a keyed hash. It works once and expires after 24 hours.
You can send 5 invites a day, ask for a code 3 times a day, and ask for a new one 5 times a day. No address receives more than 8 of these emails a day, however many people name it.
To count those limits, each email is logged for 2 days: when it went, your account id, and a keyed hash of the address, not the address itself.
Their name and address are deleted when the code is used, when the app tells us strict mode has ended, or when you delete your account. An invite that never led to strict mode is deleted when you withdraw it or send another, and after two days at the latest.
Every one of these emails has a "never email me again" link. Once it is used, that address gets no more invites or codes from Rewire, whoever enters it. To keep that promise we hold a keyed hash of the address, not the address itself, for as long as Rewire runs.

If you received one of these emails and want your address removed sooner, write to us.

Analytics

Rewire counts how its features are used, so we can tell what is working and what is broken. These counts are tied to the anonymous account id, never to your name or email. They include the screens you finished while setting up, permissions granted or refused, activities logged, blocks met, lessons, subscription events, errors, your phone's model, operating system, language and app version, and the setup answers listed above.

They never include your screen-time figures, the names of the apps you lock, your name, your email address or anything you typed.

You can switch analytics off at any time in the app, under Profile → Privacy. Nothing is collected afterwards.

Subscriptions

Payment is handled by Apple or Google. Rewire never sees your card. Our subscription provider records which plan is active against your account id, so Premium follows you to your other phones.

Measuring our ads

Rewire is advertised on Meta's apps, such as Facebook and Instagram, and on TikTok. To learn which ads bring people who stay:

Meta and TikTok are told when Rewire is installed and opened, by their own code inside the app.
Meta is told when a free trial starts or a subscription is paid for or renewed, by our subscription provider, along with the plan and what it cost.
TikTok is told by the app when a free trial starts or a subscription is bought, along with what it cost. It is not told about renewals.

These reports carry an identifier that each company's code creates for Rewire on your phone and, where your phone allows it, your phone's advertising identifier. They never carry your name, your email address, your screen time, the apps you lock or anything you typed. Meta and TikTok use them under their own privacy policies: Meta's and TikTok's.

On iPhone, Rewire asks once whether it may track you. If you say no, your advertising identifier is not shared, and your trial and subscription are not reported to Meta or TikTok. Installs and app opens are still reported, without that identifier. You can change your answer in Settings → Privacy & Security → Tracking.
On Android, you can reset or delete your advertising ID in your phone's settings, under Google → Ads or Privacy → Ads.
On both, switching analytics off under Profile → Privacy stops these reports as well.

This website

These pages set no cookies and run no advertising. Cloudflare, which hosts them, counts visits with its Web Analytics: the page opened, the site you came from, your browser, device type and country, and how fast the page loaded. It uses no cookies and does not follow you across other sites. The fonts are loaded from Google Fonts, which receives the request needed to serve them.

Who else processes this data

Supabase — the database and sign-in behind an account.
Mixpanel — the usage analytics described above.
RevenueCat — subscription status, and reporting trials and subscriptions to Meta.
Meta — measuring which of our ads work, as described above.
TikTok — measuring which of our ads work, as described above.
Resend — sending Rewire's emails, such as sign-up confirmations and strict-mode codes.
Apple and Google — distribution and payment.
Cloudflare — hosting this website and counting its visits.

Apart from Meta and TikTok, which use what they receive under their own policies, they act for us. They may process data outside Saudi Arabia. Nothing is sold, and nothing is shared for advertising beyond what Measuring our ads describes.

How long it is kept

Account data: until you delete it. Anonymous accounts unused for 30 days are deleted automatically.
The name and email address of someone holding a strict-mode code: until the code is used, the app reports that strict mode has ended, or the account is deleted; an invite that was never used, 2 days at most. The log of the emails sent to them: 2 days. The keyed hash of an address that asked never to be emailed: for good, and the hash behind each email's "never" link: 180 days.
Analytics: kept while it is useful for improving the app. Ask us and your analytics profile is deleted too.
Purchase records: held by Apple, Google and our subscription provider under their own rules.
Ad measurement reports: held by Meta and TikTok under their own rules.

Your rights

You can ask for a copy of what your account holds, ask for it to be corrected, or delete it entirely — in the app under Profile, or by writing to us. See deleting your data. You may also complain to your data protection authority; in Saudi Arabia that is SDAIA.

Children

Rewire is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to us and it will be deleted.

Changes

If this policy changes in a way that matters, the app will say so before the change applies. The date at the top always shows the version in force.