Privacy Policy.

1. What this policy covers

This policy covers our website and Android app. Sessions are linked to your device; no account or social sign-in is required. We do not sell personal information or share it for cross-context behavioral advertising.

2. Information sent to our backend

The app collects and sends the following information to operate sessions, recognize reinstalls, verify purchases, investigate interruptions, and review disputed session endings:

• Device and installation identifiers, including ANDROID_ID, an app-generated installation ID, and installation timing. ANDROID_ID can persist across reinstallation.
• Session start and end times, status, detected end reasons, and the app package identifiers and website domains selected when you activate a session.
• Technical records: device and OS versions, app updates, process exit reasons and system descriptions, installation events and package identifiers, accessibility enablement and connection changes, and the evidence and notices associated with session decisions.

Technical collection starts when the app runs. Records may be uploaded when it opens or returns to the foreground, including during onboarding before payment or acceptance of the session terms. Uploads are not limited to active sessions.

Session decisions can be automated. A suspected interruption can lead to recovery; a detected ending event can end the session. Contact support@gylb.app to request human review of a decision you believe is wrong.

3. Permissions and local blocking

The app reads installed-app information to let you choose what to block and stores your selection locally. With accessibility permission, it identifies visible apps and reads supported browsers’ address bars to match your blocked list.

Blocked apps are covered by an accessibility overlay. Blocked websites are redirected by changing the address bar or opening another URL. The current destination is an external Google-hosted link at share.google, which may redirect further. Those services may process your IP address and browser request information under their own privacy policies. The app does not add the blocked domain to that destination URL.

Address matching happens on your device. The app does not upload browsing history or address-bar contents to our backend. A blocked domain can appear in local Android diagnostic logs. The app does not use accessibility to collect messages, passwords, or payment details.

To display website icons, the app may fetch a website’s homepage and icon files, including from its icon host, when no bundled or cached icon is available. Those providers receive your IP address and request information even if you have not opened the site in your browser. Icons may be cached on your device.

You can change accessibility permission in Android settings. Turning it off can end an active session; follow the recovery instructions if the app reports a technical interruption.

4. Payments and support

The checkout provider processes payments. We receive purchase tokens or transaction references, product identifiers, and verification results to manage sessions, but not full payment-card details.

In-app support requests and appeals send your email address, message, and device and available session references to our backend. Support requests also include a category, installation ID, app and Android versions, device model, and available decision reference. These technical details are attached automatically to help us handle your request.

We store requests, appeals, review results, and correspondence in our backend. Our email provider also processes support notifications and messages. If you email us directly, we receive your message and any attachments. An email draft opened by the app can be edited before sending; direct in-app submissions use the fields described above.

5. Website and service providers

OpenAI Sites and Cloudflare host and deliver the website and may process IP addresses, requested URLs, browser information, and request times.

We use PostHog, hosted in the United States, to count website visits and understand referral sources and device/browser types. A randomly generated browser identifier is stored in local storage to distinguish returning browsers. PostHog receives page-view and request information, including your IP address. We do not identify visitors by name or email, record sessions, or automatically collect clicks, forms, or heatmaps. Clearing site storage resets the browser identifier.

Supabase hosts our backend, including support and appeal records; Google Play processes Android purchases; our email provider handles support correspondence. These providers receive information needed for their services. External page and icon providers are described in section 3.

We do not use advertising trackers to follow you across unrelated websites. Our website does not change its behavior in response to browser Do Not Track signals. External websites and icon hosts may collect information under their own policies when your device requests their content.

We may also disclose information when legally required or necessary to handle legal claims, prevent abuse, or protect the service and its users.

6. Storage and security

Our Supabase database is in Northern California, United States. Device, session, technical, purchase, support, and appeal records are transmitted there. Our business operates from the Republic of Korea, and our providers may process information in other countries. Those countries may have different privacy laws.

We use encrypted network transport and access restrictions for backend records. No system is completely secure.

7. Retention and your choices

Uninstalling the app or clearing its data removes local records. Uploaded records remain until manually deleted; ending a session does not delete them.

We retain session and purchase records for session management and payment disputes, technical records for troubleshooting and appeals, and correspondence for support. We handle deletion requests manually, subject to legal obligations or an ongoing dispute.

Email support@gylb.app to request access, correction, or deletion. Include your app’s device reference if available; we may need to verify that the records concern you. If you no longer have the app, contact us for assistance. We will explain any applicable retention exception or effect on an active session before processing the request.

Depending on the law where you live, you may also request a portable copy, withdraw consent, or appeal a denied request by replying to our response. You may contact your state privacy regulator or attorney general. We will not discriminate against you for exercising applicable privacy rights. Deleting information needed to operate an active session may prevent us from continuing that session.

8. Younger users

The service is for people aged 13 and older and is not directed to children under 13. Minors need parent or guardian permission. The app does not collect a date of birth or verify parental permission.

If you believe we have collected personal information from a child under 13, contact support@gylb.app. When we learn of such collection, we will take steps to delete the information and stop further collection from that child, unless legally permitted or required to retain it.

9. Changes

We will update the date above when this policy changes. For material changes, we will post a notice on this website and provide any additional notice or consent required by law.

10. Contact

Touch grass Central

support@gylb.app

touchgrasscentral.com