Privacy policy

Effective November 1, 2026

In short: what you do on your phone (which apps you use, for how long and how many times you open each one) stays on your phone. On Android, Desrola reads it to show the pause and the block at the right moment; on iPhone, Apple's Screen Time takes care of that, and Desrola never even sees the names of your apps. None of it leaves the device. Your account is managed by Firebase Authentication, from Google. In addition, these services receive data from the app, and here we say exactly which: RevenueCat, for subscriptions; PostHog, for usage statistics without app names; and Meta, TikTok and Google (Firebase Analytics, on Android only), to measure our ads. The subscription is charged through Google Play or the App Store, depending on your phone. We don't show ads inside the app and we don't sell data for money. You can delete your account and your data from the app (how).

Who we are

Desrola is an app by Everflow Labs, Inc., which is responsible for your personal data. For any question about your data or to exercise your rights: hello@everflowlabs.io.

Your account

To use Desrola you create an account with Google, with Apple (on iPhone) or with your email and a password. The account is managed by Firebase Authentication, a Google service, which receives:

your email address (if you sign in with Apple, the email address Apple shares);
the name you type when you create the account; if you sign in with Google, the name and profile photo Google shares (the app doesn't use the photo); if you sign in with Apple, the name Apple shares the first time you sign in to Desrola;
which service you signed in with, a user ID, and the dates you signed up and last signed in;
if you sign in with email, your password, which Firebase stores in protected form and we can't see. If you forget it, Firebase emails you a link to create a new one;
for security, the IP address and device data you sign in from.

The account lets you sign in and keeps your subscription with you if you change phones: the account ID is what RevenueCat uses to recognize your subscription. Your streak, XP, intentions and schedules aren't stored in the account: they stay on your phone.

What stays on your phone

This is kept in the app's storage, on your phone:

Your phone usage, on Android. With Android's usage access, Desrola sees which app is open and how long you spend in each one. It uses this to show the pause and the shield at the right moment and for the “Screen time” tab (the last 7 days and today's apps).
Your list of apps, on Android. The apps that have an icon on your home screen, with their names and icons, so you can choose which ones to block or leave free.
On iPhone, Screen Time. Desrola uses Apple's Screen Time. You pick apps, categories or websites from the iPhone's own list, and Desrola only receives opaque identifiers, without the names: when an app's name or icon needs to be shown, iPhone draws it, and the shield is an iPhone screen with Desrola's text. Desrola never sees how much you use each app and, on iPhone, has no “Screen time” tab.
Your settings: the apps you chose, your intentions (the app, the limit of opens per day and the minutes per open), your schedules, your focus sessions and Tough Mode.
What happens during the day: how many times you opened each app with an intention and how many times the shield appeared.
Your progress: XP, streak and your username.
What you answered at the start: your age range, your daily screen time and how you heard about Desrola. These answers also go to PostHog as ranges (see the table).

Per-app usage and app names never leave your phone: they don't reach us, PostHog, Meta, TikTok, Google or RevenueCat. On iPhone, this applies to everything Desrola learns through Screen Time, including the app identifiers: none of it leaves your phone or is used for advertising or to measure ads. Desrola can't see what you do inside other apps (what you read, type or watch): on Android, only which app is open and for how long; on iPhone, not even the names of your apps or how much you use each one. There is no cloud copy: if you delete the app or change phones, your streak, XP, intentions and schedules don't come back. Your subscription does, with your account.

What each service receives

Service	What for	What it receives
Firebase Authentication (Google)	Your account: signing in and keeping it secure.	What's listed under “Your account”, above. It never receives your phone usage or your app names.
RevenueCat	Validating and restoring your subscription, and knowing which ad it came from.	Your account ID (or, before you sign in, a random ID the app creates for your phone); the purchase data Google Play or the App Store reports (plan, dates, whether it's a trial, the store country and the price); your phone model, OS version and IP address; on Android, the Google advertising ID, the Android ID and the Firebase installation ID; on iPhone, Apple's identifier for vendors (IDFV) and an Apple attribution token that says whether the install came from an ad on the App Store (Apple Search Ads); and the anonymous ID of the Meta SDK. With those identifiers, RevenueCat sends subscription events (trial start, purchases and renewals) to Meta and, on Android, to Google from its servers, without your name or email. Apple's advertising identifier (IDFA) would only be sent if you allowed tracking in Apple's prompt.
PostHog	Learning which parts of the app get used and where people get stuck, so we can improve it.	A random ID the app creates for your phone and these events: that you opened the app; which intro, question and permission screens you completed; your age range (for example, “25 to 29”) and your daily screen time range (for example, “4 to 5 hours”), never your exact age; on Android, whether you granted usage access, display over other apps and notifications; on iPhone, whether you granted Screen Time permission and notifications; whether you created an account and with which service (Google, Apple or email), never the email; whether you deleted it; how you heard about Desrola (a friend, Facebook, TikTok, Instagram, YouTube, Play, App Store or other); when a session starts (its length, whether it blocks all apps or some, and whether Tough Mode is on), when you finish it (the XP earned) and when you give up; when you set an intention (the open limit and the minutes), without the app's name, and when you save a schedule (its XP), without the apps; whether you saw the subscription screen, which plan you tapped, whether you closed the store sheet and whether you started a trial; whether the app asked you for a rating on the Play Store or the App Store. Plus the time of each event, phone model, OS and app version, language, time zone and IP address (which PostHog uses to estimate your country). It never receives app names, your per-app usage, your name, your username or your email. On iPhone, it also never receives the app identifiers Screen Time gives Desrola.
Meta (Facebook SDK)	Measuring which of our ads on Facebook and Instagram lead to installing the app and starting the trial, and letting Meta show those ads to similar people.	That the app was installed and opened, that you created an account (and whether with Google, Apple or email), that you saw the subscription screen and that you started the trial (with the product and an encrypted transaction code). The SDK may also log in-app purchases on its own. Plus an ID generated by the SDK, the Google advertising ID (on Android), phone model, OS and app version, language and IP address. And, from RevenueCat's servers, subscription events. On iPhone, the SDK starts with tracking turned off: Apple's advertising identifier (IDFA) would only be used if you allowed tracking in Apple's prompt, and without that, Meta measures ads through SKAdNetwork, Apple's own ad measurement system. It never receives your name, your email, app names or your per-app usage.
TikTok (TikTok SDK)	Measuring which of our ads on TikTok lead to installing the app and starting the trial.	That the app was installed and opened and that you started the trial (with an encrypted transaction code), the Google advertising ID (on Android), phone model, OS and app version, language and IP address. It doesn't log purchases on its own. On iPhone, when the app includes the TikTok SDK, it receives the same, and Apple's advertising identifier (IDFA) would only be used if you allowed tracking in Apple's prompt. It never receives your name, your email, app names or your per-app usage.
Google Firebase Analytics (Android only)	Measuring which of our ads on Google lead to installing the app and starting the trial.	Firebase's automatic events (first open, sessions and in-app purchases), that you started the trial (with the product), an installation ID generated by Firebase, the Google advertising ID, phone model, OS and app version, language and IP address. And, from RevenueCat's servers, subscription events. It isn't in the iPhone app. It never receives your name, your email, app names or your per-app usage.
Google Play	On Android: charging for the subscription and, sometimes, asking for a rating.	Payments are processed by Google Play under its own policies. We don't receive your payment details.
Apple (App Store and Sign in with Apple)	On iPhone: charging for the subscription, sometimes asking for a rating and, if you choose, signing in with Apple.	Payments are processed by the App Store under Apple's policies. We don't receive your payment details. If you sign in with Apple, Apple confirms who you are and gives Firebase Authentication your email address and, the first time, the name it shares. When you delete your account, Desrola asks Apple to revoke its access to your Apple Account.

These services store data on servers in the United States and other countries.

The permissions the app asks for

On Android

Usage access (“Permit usage access”): to know which app is open and how long you spend in it. It's the heart of Desrola. It stays on your phone.
Display over other apps: Android only lets a closed app bring a screen to the front with this permission. Desrola uses it only to show the pause and the shield, which are full screens; it doesn't sit on top of anything while you use your phone.
Notifications: while a session, schedule or intention is active, Android requires an ongoing notification showing that Desrola is on. We also let you know when a session ends. Notifications are created on your phone, not sent from a server of ours.
Run in the background (optional, in Profile): so battery saving doesn't switch off blocking.
Start with the phone: so blocking comes back on its own when you turn on your phone or the app updates.
Advertising ID: so Meta, TikTok and Google can measure our ads. You can delete or reset it in your phone's settings (Google › All services › Ads, or Privacy › Ads).

On iPhone

Screen Time: iPhone shows a system prompt and asks you to confirm with Face ID or your passcode. It's what lets Desrola pause the apps you choose. Desrola never sees the names of your apps or how much you use each one, and what it learns through this permission never leaves your phone: it doesn't reach us, PostHog, Meta, TikTok, Firebase or RevenueCat, and it isn't used for advertising or to measure ads.
Notifications: to let you know when a session ends and, on iOS versions before 26.5, so you can open Desrola when you tap the shield button that leads to the app. They're created on your phone. There's no ongoing notification on iPhone.
Tracking (App Tracking Transparency): Apple's advertising identifier (IDFA) would only be used if you allowed tracking in Apple's prompt. Without that permission it isn't used, and Meta measures our ads through SKAdNetwork, Apple's ad measurement system.

The app doesn't ask for access to your camera, microphone, location, contacts or photos, and doesn't use the accessibility service.

What we don't do

We don't show ads inside the app. The Meta, TikTok and Google SDKs only measure our own ads.
We don't sell or rent data for money.
We don't send anyone which apps you use or for how long.
We don't read what other apps show on screen or what you type.
On iPhone, we don't use anything Screen Time tells Desrola for advertising or to measure ads.

How to delete your account and your data

From the app: on any tab, tap the circle with your initial (top left) to open Profile, then tap “Delete my account”. If you signed in with email, the app asks for your password to confirm; if you signed in with Apple, your iPhone asks you to confirm with your Apple Account, and Desrola asks Apple to revoke its access to your account. This deletes your Firebase account and everything the app keeps on your phone: streak, XP, intentions, schedules and settings; on iPhone, it also removes every block Desrola set through Screen Time. It can't be undone. Deleting only the app removes what's on your phone, but not your account.

Without the app, or if you already deleted it: email hello@everflowlabs.io from your account's email address, with the subject “Delete my Desrola account”. We delete your account and confirm by email when it's done.

What happens to each thing:

Your account (Firebase): deleted. If you signed in with Apple, Desrola also asks Apple to revoke its access to your Apple Account.
What's on your phone: deleted when you tap “Delete my account” or delete the app. We never had a copy.
Purchase data (RevenueCat): when you delete the account, the app switches to a new ID. We delete the history tied to the old account when you ask us by email. Google Play and the App Store keep your purchase history under their own rules; we can't delete that.
Usage data (PostHog): when you delete the account, the app switches to a new ID. We delete older events when you ask us by email; since they aren't tied to your email, we may ask you to help us identify your installation.
Your subscription: deleting the account or the app doesn't cancel it. You cancel it in Google Play or, on iPhone, in Settings › your name › Subscriptions › Desrola (see Support).
Meta, TikTok and Google: their events don't include your name or email, so we can't find them through your account. You can review and disconnect that activity under “Your activity off Meta technologies” in your Facebook or Instagram account, review the ad settings of your TikTok account if you have one, and, on Android, delete or reset the advertising ID in your phone's settings.

This section is also our data deletion instructions page for Google Play and Meta.

How long we keep data

Your account: as long as it exists. It's deleted when you delete it.
Usage data: as long as it helps us understand and improve the app, or until you ask us to delete it.
Purchase data: as long as it's needed to validate and restore your subscription, or until you ask us to delete it.

Why we use your data

To provide the service you signed up for: your account and your subscription.
For our legitimate interests: usage statistics, to improve the app, and measuring our ads. You can object by writing to us, and on Android you can delete or reset the advertising ID in your phone's settings.

Your rights

Depending on where you live, you can ask us for access to your data, to correct it, delete it or receive a copy, to know who we share it with, and to object to its use, by writing to hello@everflowlabs.io. We won't treat you differently for exercising these rights. You can also complain to your local data protection authority.

US state privacy laws (such as California's): we don't sell personal information for money. We do share device identifiers and app events with Meta, TikTok and Google to measure and improve our ads, which some state laws treat as “sharing” for targeted advertising. To opt out, email us at hello@everflowlabs.io and, on Android, delete or reset your advertising ID in your phone's settings. On iPhone, Apple's advertising identifier (IDFA) would only be used if you allowed tracking in Apple's prompt.

Children

Desrola is not directed to children, and we don't knowingly collect data from children under 13. If you're under 18, use the app with the permission of a parent or guardian.

Changes

If we change this policy, we'll publish the new version on this page with its effective date.