Privacy Policy. Short, because Toll collects little.

No account

Toll has no sign-up, no login and no server of its own. We cannot see who you are. Your habits, what you write and your photos never reach us; Toll sends only the anonymous counts described under Analytics.

Photos

Photos come from Toll's camera only. They are checked on your iPhone by Apple's on-device image analysis and on-device language model, then discarded. Toll never stores a photo, never uploads a photo, and never reads your photo library.

What Toll keeps

Your habits (name, schedule, photos a day, kind, and for your own habit the description you wrote), photo records (the time of each photo, whether it was accepted and which check accepted it, never the photo), rest days, focus sessions (their times, and whether Strict mode held them), schedules and time limits (their names, days, times and minutes) live on your iPhone and in your private iCloud database, through your own iCloud account, so they follow you to a new iPhone. With iCloud off, they stay on this iPhone.

On this iPhone only, and in its backups: your name, your first-run answers (the kinds of habit you picked, your estimate of your daily phone time and the time of day you chose for reminders; setups before this version also kept an age and a reason for starting), your settings (the block screen's words and your website switches), which time limits were reached today and the apps you chose to lock. If you set a PIN lock, only a salted fingerprint of the PIN is kept.

We have no access to any of it.

Screen Time

Toll uses Apple's Screen Time frameworks to lock the apps you pick. Apple does not tell Toll which apps those are; Toll works with tokens that stay on your iPhone. The Screen Time figures on the score page are drawn by iOS inside a Screen Time report that Toll cannot read, so the numbers never reach Toll and never leave your iPhone. A time limit works the same way: iOS tells Toll only that the minutes you chose were used up, never which app or for how long.

Website protection turns on Apple's own adult-content filter and, while your apps are locked, blocks every website; Toll never learns which sites you visit. iOS turns off Safari's Private Browsing while a filter is on.

Toll never hides apps and never touches your passcode. If you turn on Strict mode, iOS also blocks deleting apps and keeps the date and time automatic while your apps are locked; both clear when they unlock. Deleting Toll removes every lock.

Purchases

Toll Pro is sold through Apple's App Store. Apple processes the payment; Toll never sees your payment details. RevenueCat, the service that checks purchases for Toll, receives an anonymous identifier its software creates on your iPhone and your Toll purchase and trial history, and with each request technical details: the iPhone model, the iOS and Toll versions, the App Store country, your preferred languages and an identifier Apple gives Toll on this iPhone, plus your IP address, which every server sees. This happens when Toll loads the plans or checks Toll Pro, from the first launch. When the plans page is shown, RevenueCat also records that it was viewed, to count how many people see the plans; it carries the same anonymous identifier and nothing about who you are. RevenueCat never receives your name, email, photos or habits. See revenuecat.com/privacy.

Notifications

Toll sends only the notifications listed on its Notifications page, each with its own switch, and only with your permission: the evening reminder on days a habit is still due, a note an hour before a due habit's day ends, a morning plan, a note before a streak ends, a weekly recap, a note before a schedule locks your apps or when a time limit is reached, a note when a focus session ends, and, after you start a free week, one reminder 2 days before it ends, in time to cancel. Streak at risk and the weekly recap start on once you allow notifications, and the free week's reminder when you ask for it; the others are off until you turn them on. Each can be turned off there or in the Settings app. They are planned on your iPhone; none comes from a server.

Analytics, advertising and tracking

Toll sends anonymous usage counts to TelemetryDeck, an analytics service built for privacy, so we can see where Toll is hard to use: when Toll is opened; which first-run pages are reached and when the first run is finished; when the practice photo on the demo page is taken (with the habit's kind; it is a drawing, never a real photo); the range you pick for your daily phone time (such as "4 to 6 hours"); whether you ask for the free week's reminder and what iOS answered; each step of the Screen Time page (shown, continue, approved, declined, try again, and the type of error if one happens); how many apps you chose to lock, as a range (none, 1, 2 to 3, 4 to 6, 7 or more), never which ones; how many days your first habit is due and the time of day you chose for its reminder; when the plans are shown and which plan you tap; when a purchase starts, completes, fails or is cancelled (with the plan and whether it has a free week), and when the renewal is turned off during the free week; when a photo is accepted or turned down (with the habit's kind and which check decided); and when a habit, schedule or time limit is made (with its kind). Each count carries an anonymous identifier (a scrambled form of the one iOS gives Toll on this iPhone) and technical details: the iPhone model, the iOS and Toll versions, and settings such as language, region, time zone and text size. A count never carries your name, what you write, your photos, your apps or the websites you visit. TelemetryDeck does not store IP addresses. See telemetrydeck.com/privacy.

Toll has no ads and no trackers, does not track you across other companies' apps or websites, and does not sell any data. If you choose to share analytics with app developers in the Settings app, Apple may send us crash reports; they contain no photos and do not say who you are.

Your data, your choices

Everything Toll keeps is on your devices and in your own iCloud, so you can see it, export it and delete it yourself. Export data in Toll's Settings writes your habits, photo records, rest days and focus sessions to a file you keep. Deleting Toll deletes its data from the iPhone; Toll's iCloud data is deleted from your iCloud storage in the Settings app. To have the purchase records RevenueCat holds deleted, write to us.

Children

Toll is for people managing their own phone. It is not directed at children under 13, and we do not knowingly collect anything from them.

Toll's website

tollapp.github.io has no cookies, no analytics and no scripts, and loads nothing from other services. It is hosted on GitHub Pages; GitHub may log visits, including IP addresses, to keep the service secure, as described in GitHub's privacy statement.

Changes

If this policy changes, the date at the top changes and the new version is published in the app and on tollapp.github.io/privacy.

Contact

Questions about privacy: csamaha655@gmail.com.