Privacy Policy

Last updated: 3 November 2026

This policy explains what data the Bolota app ("Bolota", "the app") processes, why, who we share it with, and your rights. If the Portuguese and English versions differ, the Portuguese version prevails.

1. Data controller

Matheus Mello, independent developer, based in Portugal ("we", "us").
Contact: suporte@bolota.app

2. The short version

The apps you choose to block, your schedules and your usage stay on your iPhone.
Apple represents the chosen apps as opaque tokens. We cannot see app names and never send them to the cloud.
We collect anonymous product analytics (PostHog, EU servers) to improve the app.
Purchases are processed by Apple and managed through RevenueCat. We never see your payment details.
No ads, no ad SDKs, no data sales, no cross-app tracking.
No account required.

3. What we process and why

3.1 Data that stays on your device (we don't receive it)

Data	Purpose
Apps selected for blocking (opaque Apple Screen Time tokens)	Enforce the block
Schedules (Night, Work, Always, or custom)	Know when to block
Breathing pause and temporary unlock state	Re-apply the block when an unlock ends
Streak, estimated screen-free minutes, Bolota growth stage	Show your mascot's growth
Language preference	Show the app in your language

This data is stored locally in the app and in the app's shared container with its iOS extensions (App Group). Screen Time (Family Controls) authorization is managed by Apple, and you can revoke it in iOS Settings > Screen Time. Deleting the app deletes this data from the device.

3.2 Product analytics (PostHog)

We record in-app events such as: "onboarding completed", "permission granted/denied", "schedule created", "breathing pause started/completed", "shield shown", "plans screen viewed", "purchase started/completed" (with the plan type), "protection check ran", "block re-applied".

Each event may include a random identifier generated at install (not your name, email or advertising identifier), the app version, iOS version, device model and language.

We do not send: names or identifiers of the apps you block, screen content, session recordings, contacts, precise location or payment details.

Purpose: understand which parts of the app work, find broken flows, improve Bolota.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in improving the product in a minimised way without direct identification.
Control: Settings > Privacy includes the "Share anonymous statistics" on/off setting. It is on by default; your choice is saved on the device and applied at startup. Turning it off does not affect protection.
IP address: PostHog receives the IP address with the technical request. We disable (or will disable before launch) IP-based geolocation and discard the IP.

3.3 Purchases and subscriptions (Apple and RevenueCat)

When you buy Bolota Pro, payment is processed by Apple. We do not receive your name, email or card details. RevenueCat receives transaction data from Apple (product, date, subscription status, country/storefront, receipt), linked to an anonymous app identifier, to check whether Pro is active and to let you restore purchases.

Purpose: deliver what you bought, manage subscriptions, restore purchases.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations such as tax and accounting (Art. 6(1)(c)).

3.4 Email support

If you email us, we process your email address and message to reply.

Legal basis: legitimate interests in answering your request, or contract when it concerns a purchase.

4. Who we share data with (processors and third parties)

Entity	Role	What	Location
Apple Inc. / Apple Distribution International Ltd.	App distribution, payments, Screen Time	Purchase data; Screen Time authorization and blocking run on-device	Ireland / USA
RevenueCat, Inc.	Processor: subscription management	Transaction data + anonymous identifier	USA
PostHog Inc. (EU region, "PostHog Cloud EU")	Processor: product analytics	Events + random identifier	European Union (Germany)

For payments and the App Store, Apple acts as an independent controller towards users.

We do not sell or rent personal data. We do not share data with ad networks or data brokers. We may disclose data where the law requires it.

5. International transfers

RevenueCat is in the USA. Transfers rely on the EU-US Data Privacy Framework (if RevenueCat is certified) and/or the European Commission's Standard Contractual Clauses in the provider's data processing agreement.

6. How long we keep data

Data	Period
On-device data	Until you delete the app or its data
Analytics events (PostHog)	Up to 12 months, then deleted or aggregated
Transaction data (RevenueCat)	While the app's RevenueCat account is active and for the statutory tax/accounting retention period
Support emails	Up to 24 months after the last message

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection (including to processing based on legitimate interests, such as analytics). Where processing relies on consent, you may withdraw it at any time.

Because there are no accounts, for requests about analytics or purchases please give us, if you can, the identifier shown in the app under Settings > Privacy or your Apple transaction ID (on the purchase receipt). That way we can find the data without asking for more information than necessary.

Write to suporte@bolota.app. We reply within one month (extendable under Art. 12 GDPR).

We do not make solely automated decisions with legal or similarly significant effects on you.

8. Complaints

You have the right to lodge a complaint with a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. If you live elsewhere in the EU/EEA, you may complain to your local authority. We'd appreciate the chance to fix things first.

9. Children

Bolota is not directed at children under 13 and does not knowingly collect children's data. In Portugal, digital consent applies from age 13 (Law 58/2019, Art. 16). Bolota has no accounts and its analytics are anonymous, so we don't ask your age. If you believe a child has sent us personal data (e.g. by email), contact us and we'll delete it.

10. Security

Connections to our providers are encrypted in transit (HTTPS/TLS). On-device data is protected by iOS data protection. The app only contains public client keys (designed to ship inside apps). Access to provider dashboards is restricted to the controller and protected with two-factor authentication.

11. Changes

If we change this policy, we update the date above. For material changes, we also tell you in the app or in the release notes.

12. Contact

Matheus Mello · suporte@bolota.app · bolota.app