Privacy Policy

The controller responsible for processing personal data in the Frictio app and on this website is:

Questions about privacy can reach us at any time at the email address above.

• Frictio is built so that as little data as possible leaves your device.
• Camera: movement is recognised on your device only. No image is stored or transmitted.
• Screen Time: Frictio never learns which apps you picked or how long you use them. Apple only provides anonymous tokens. On Android, your app selection and usage minutes are read and kept on your phone only and never sent to us.
• For your account we store your email address, profile and settings on Google Firebase servers in the EU.
• Subscriptions run through Apple or Google Play; RevenueCat manages the subscription status. We never see payment details.
• No ads, no tracking, no analytics tools, no selling of data.

The following features run entirely on your iPhone, iPad or Android phone. This data reaches neither us nor any third party:

• Camera (movement tasks): push-ups, squats and the plank are recognised on the device with Google's ML Kit Pose Detection. The image is only analysed and shown live, never stored or sent. ML Kit may send anonymous technical data about recognition performance (e.g. device model, run time, errors) to Google, but never images.
• Screen Time (Apple Family Controls): your app selection is stored on the device as anonymous tokens. How long you use which app is computed and shown by iOS itself in a sealed extension; Frictio does not receive these figures. On Android, your app selection and usage minutes are read and kept on your phone only and never sent to us.
• The lock on Android (usage access and accessibility service): with usage access, Frictio reads how many minutes the apps you picked were open today, to apply your daily limit. Its accessibility service only notices which app comes to the front, so that Frictio can show its lock screen when that app is locked. It does not read screen content and does not record what you type. Your app selection, the minutes and these events stay on the phone and are never transmitted to us or third parties.
• Motion sensor: for the “phone flips” task, only while the task runs.
• Alarms and notifications: alarms (AlarmKit on iPhone, the system alarm clock on Android), a custom alarm sound and reminders are set up locally on the device.
• Statistics and widgets: history, streak and widget data live on the device.

iOS or Android asks your permission for camera, Screen Time or usage access and the accessibility service, notifications and alarms. You can withdraw it at any time in your device settings.

To use Frictio you create an account with email and password, with Sign in with Apple, or with Google. We use Firebase Authentication by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

• processed: email address (with Apple possibly an anonymous relay address), password (stored encrypted by Firebase only), a user ID, sign-in times
• emails to reset your password or confirm a new address are sent through Firebase

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

So that Frictio carries on on a new device, we store a copy of your profile in Cloud Firestore (Google Firebase), stored in Europe (Belgium and the Netherlands):

• the name you give, email address, language and app version
• your answers from setup (e.g. age, estimated screen time, goals, preferred tasks) and your settings (daily limit, difficulty, unlock time, appearance)
• your streak and any redeemed invite code

Not stored: which apps you lock, camera images, usage times of individual apps, and your alarms. The legal basis is Art. 6(1)(b) GDPR.

Every account gets its own invite code. We store which account (user ID) owns a code and, when someone redeems a code, which account redeemed it and when. The inviter only sees the number of redemptions, never names or addresses. The legal basis is Art. 6(1)(b) GDPR.

If you give stars in the app, write to us, report a bug, suggest a feature, or give a reason when cancelling or deleting, we store your text with your user ID but without your email address to improve Frictio (legitimate interest, Art. 6(1)(f) GDPR). Bug reports and suggestions also carry the app version, platform and operating system version so we can reproduce the problem. These are voluntary.

Frictio Pro is bought exclusively through the Apple App Store or Google Play. Apple or Google process the payment; we never receive payment details. Their privacy policies also apply.

We manage the subscription status with RevenueCat (RevenueCat, Inc., USA). This processes your user ID, purchase receipts from Apple or Google Play, product, price, currency, country and technical device and app details. Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR. More: revenuecat.com/privacy.

If the app crashes or an error occurs, it sends a report to Firebase Crashlytics (Google). It contains technical details such as device model, OS and app version, time, the error trace and a random installation ID, but no content from the app. The purpose is fixing bugs (legitimate interest, Art. 6(1)(f) GDPR). Reports are deleted after 90 days.

We have a data processing agreement with Google. Google may also process data in the USA; transfers rely on the EU-US Data Privacy Framework and standard contractual clauses. More: firebase.google.com/support/privacy.

This website uses no analytics or tracking services and loads no fonts or scripts from third-party servers. If you switch the language, your browser remembers that choice in a strictly necessary cookie (frictio_lang, one year) so you land in your language next time (§ 25(2) TDDDG).

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary server log data (IP address, time, page, browser) to deliver the site and protect it from abuse (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel; transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses. More: vercel.com/legal/privacy-policy.

If you play the little game on the error page (404), your browser keeps your best score in your device's local storage. It is never sent to us and can be cleared in your browser settings.

If you pick a light or dark theme at the top, your browser remembers that in local storage too. It never leaves your device either.

• Account and profile copy: until you delete your account.
• You can delete your account in the app under Settings → Delete account. This deletes the account, profile copy and invite code.
• Feedback and reasons remain without an email address; invite code redemptions remain under an ID that can no longer be linked to anyone once the account is gone.
• Crash reports: 90 days.
• Purchase records: as long as statutory retention duties require.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time (Art. 7(3)). Just write to hello@fade.de.

You may also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Frictio is intended for people aged 16 and over. Younger people may only use Frictio with their parents' consent.

We update this policy when Frictio or the law changes. The version published here applies.