Privacy Policy

This English version is provided for your convenience. In case of any discrepancy, the German version prevails: Datenschutzerklärung.

Last updated: 27 October 2026

Overview

Offtimism is an iOS app that helps you spend less time on your phone (the “app”). This policy explains which personal data we process when you use the app, for what purposes and on which legal basis, who receives the data, how long we keep it and what rights you have.

The app is currently in a test phase (“beta”) and is distributed through Apple’s TestFlight service. Using the app is free of charge during the beta. All amounts shown in the app are test amounts; no payment obligation arises at any time.

Which apps you limit and how long you use them each day stays on your iPhone. We do not display advertising, we do not sell data, and the app contains no analytics or tracking tools.

Controller

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is Jan Schiller, Gerhart-Hauptmann-Straße 9, 75015 Bretten, Germany.

Email: info@offtimism.com

The app is developed by a team of three people. Within the team, access to personal data is limited to those who need it for a specific task, for example to handle feedback or a deletion request. All team members are bound to confidentiality.

Legal bases

We process personal data only where the GDPR permits it. Depending on the purpose, we rely on one of the following legal bases. The sections below state which one applies to each processing activity.

Consent (Art. 6(1)(a) GDPR): You have agreed to the processing for one or more specific purposes. You may withdraw your consent at any time with effect for the future.

Performance of a contract (Art. 6(1)(b) GDPR): The processing is necessary to provide the app to you under our terms of use, including during the free beta, or to take steps at your request before entering into such a contract.

Legal obligation (Art. 6(1)(c) GDPR): The processing is necessary to comply with a legal obligation to which we are subject.

Legitimate interests (Art. 6(1)(f) GDPR): The processing is necessary for our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override them. You may object to such processing (see “Your rights”).

Access to your device (Section 25 TDDDG): German law (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) governs storing information on your device and accessing information stored there. The app does so only where strictly necessary to provide a function you have expressly requested (Section 25(2) no. 2 TDDDG) or where you have consented (Section 25(1) TDDDG).

In addition to the GDPR, German data protection law applies, in particular the Federal Data Protection Act (BDSG).

Hosting and server logs

To provide the app, we store your data in a database operated for us by Supabase. Whenever the app exchanges data with our servers, your device’s IP address is processed, because the data could not be delivered otherwise.

Server logs: Requests to our servers are logged. Logs may contain the endpoint accessed, date and time, the amount of data transferred, status messages, operating system information and the IP address. We use them to keep the service secure and stable, for example to detect overload or misuse. Logs are deleted or anonymised after no more than 30 days, unless they are needed as evidence in a specific security incident until that incident is resolved.

Legal basis: Art. 6(1)(b) GDPR for providing the app; Art. 6(1)(f) GDPR for security and stability.

Provider: Supabase Pte. Ltd., Singapore. Server location: Frankfurt am Main, Germany (Amazon Web Services, region eu-central-1). Privacy policy, data processing agreement. Transfers to third countries are based on the EU Standard Contractual Clauses (see “Transfers outside the EU”).

Your account

You need an account to use the app. You can register with your email address and a password, or with Sign in with Apple.

Data we store: your email address; your password, stored only as a hash that cannot be turned back into the password; your first name and, if provided, your last name; the app language; your notification settings; the time at which you confirmed that you are at least 18 years old; a unique account identifier; and, when you sign in or use your account, the IP address and time of the action.

Purpose: to provide your account, to make your data available on every device on which you sign in, to protect the service against misuse, and to be able to demonstrate that the app is only offered to adults. Without a first name and an email address, we cannot provide an account.

Visibility: Profiles are not public. Your first name is visible only to members of your groups. Other users never see your last name or your email address.

Emails: We only send emails that concern your account: confirming your email address, resetting your password and changing your email address (see “Emails about your account”).

Deleting your account: You can delete your account at any time in the app under Profile → Delete account, or by emailing us. Your account data is then deleted without undue delay. Entries that already appear in a group’s activity remain visible to the group without your name (“Someone”). Group rules you created pass to the person who manages the group. Please save anything you want to keep before deleting your account.

Retention: until you delete your account. IP addresses and times of sign-ins are deleted after the periods that apply to server logs.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR for logging sign-ins and recording the age confirmation.

Sign in with Apple

If you choose Sign in with Apple, Apple authenticates you. We never see or store your Apple password.

Apple provides us with an identifier confirming that you are signed in with Apple, together with your name and email address. If you choose “Hide My Email”, we only receive a relay address created by Apple, which forwards our emails to you.

When you delete your account, we also revoke the connection to your Apple ID with Apple. You can remove the connection yourself at any time in your iPhone’s settings under Apple ID → Sign in with Apple; this does not delete your account with us.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR (a convenient and secure sign-in).

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple Privacy Policy.

Screen Time and blocking

The core function of the app is to set daily limits for apps you choose and to block those apps once the limit is reached. For this, the app uses Apple’s Screen Time interface (Family Controls). iOS asks for your permission once; you can revoke it at any time in the iOS settings. Without it, limits and blocking cannot work.

Choosing apps: For the apps you select, iOS only gives the app identifiers from which we cannot tell which apps they are. You name each rule yourself.

Usage time: iOS reports to the app, in steps of five minutes, how long you have used the selected apps that day. The app uses this to calculate limits, blocking and statistics. This usage time is stored only on your device and is not sent to our servers. The only exception is your usage at the moment you extend an app (see “Rules and extensions”).

Statistics: The weekly overview shows Apple’s own Screen Time figures. iOS displays them inside the app; the app itself cannot read these figures.

Other permissions: With your permission, the app sends you notifications (see “Push notifications”). For a feedback report, you can pick a screenshot from your photo library; the app only receives the picture you select and has no access to your other photos. The app does not access your camera, microphone, contacts or location.

Legal basis: Art. 6(1)(b) GDPR; Section 25(2) no. 2 TDDDG.

Your answers during setup

During setup, we ask for your age range (for example “24–26”), how much time you estimate you spend on your phone each day, and your daily goal. The app uses the answers for the calculations shown during setup and stores them with your account. They are solely your own statements; we do not read Apple’s Screen Time figures for this.

Purpose: The team evaluates the answers to understand who uses the app and with which goals, and to improve the app. Other users cannot see them.

Retention: until you delete your account or object.

Legal basis: Art. 6(1)(f) GDPR. You may object at any time without giving reasons; we will then delete your answers.

Rules and extensions

Rules: We store the name, limit, price and pricing model of your rules with your account so that they apply on every device on which you are signed in. We recommend naming rules in a way that does not reveal anything personal or sensitive. A deleted rule remains stored, marked as deleted, for as long as extensions refer to it.

Extensions: When you extend a blocked app, we store the rule, the time, the extra minutes, the test amount and how many minutes you had used that app that day up to that moment. Our server uses the usage figure to check the price. If you confirm that the extra time starts immediately, we also record when you did so, as evidence.

Weekly test statements: Every Monday, our server creates a test statement for the previous week, listing a number, the test amount and the individual extensions. A test statement is not an invoice and does not create any obligation to pay. Instead of paying, you check in with us briefly once a week (see “Feedback and contact”), after which we close the test statement.

Retention: until you delete your account.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR for recording confirmations.

Groups

In a group, members set shared rules and compare and settle their extensions with each other. Before you create or join a group, the app shows you what the group will see about you and asks for your consent. You cannot become a member without it.

What your group sees: your first name; when you joined and, if applicable, left; from the week you joined, every extension in the apps the group covers, with time, rule, extra minutes and the group’s share of the test amount, and the leaderboard based on it; whether you have assigned the group’s rules to your apps, how many apps you selected for them, or that you do not use an app; how you vote on rule changes; your test amounts in the group settlement and whether a settlement payment has been marked as done; and entries about you in the group’s activity.

What your group does not see: your screen time, including in the group’s apps; which apps exactly you selected; any other apps; your personal rules and extensions outside the group; your test amounts owed to Offtimism; any content of your apps; your last name and your email address.

Group name and rules are visible to all members and are set by the person who manages the group. Existing rules only change if all members agree.

Withdrawing consent: You can withdraw your consent at any time by turning off “Share extensions with …” in your profile or by leaving the group. You leave the group immediately. The current week’s settlement is still completed so that the other members can settle correctly. Earlier entries in the group’s activity remain visible until the group is dissolved.

Retention: for as long as the group exists. Dissolved groups are deleted after their final weekly settlement.

Legal basis: Art. 6(1)(a) GDPR; completing the current settlement after you leave is based on the other members’ legitimate interest in a complete settlement, Art. 6(1)(f) GDPR.

Invitations

Members can invite others with a link containing a six-character code. You share the link yourself, for example via the iOS share sheet or WhatsApp; the terms of the service you choose apply to that message.

Preview: Anyone who has the link or code can see, before joining, the group name, the first name of the person who manages the group, the number of members with their initials, and the group’s rules. Please share invitations only with people you want to invite. The person who manages the group can renew the code at any time, which makes the previous link invalid.

Without the app installed: If the app is not installed, the link opens a page at join.offtimism.com that shows the same preview. The page sets no cookies and loads no third-party content; the preview is fetched directly from our server. When the page is opened, our web host processes server logs (IP address, time, address requested including the code, browser type). Provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR for operating the page securely.

Push notifications

If you allow notifications, iOS creates a device token. We store it together with your language and the time of registration in order to deliver notifications to you.

Content: notifications about your groups, for example when a member extends an app, a rule change is proposed or the weekly settlement is ready. Reminders about your own limits and extensions are created by the app on your device and are not sent through our servers.

Delivery via Apple: Group notifications are delivered through the Apple Push Notification service. Apple receives the device token and the content of the notification, for example the group name, first names and rule names, but never amounts. Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA; transfers are based on the EU Standard Contractual Clauses.

Settings: You choose which notifications you receive under Profile → Notifications, and you can turn off all notifications at any time in the iOS settings. When you sign out, delete your account or the token becomes invalid, we delete the token. Our log of sent notifications is deleted after 30 days.

Legal basis: Art. 6(1)(b) GDPR; Section 25(2) no. 2 TDDDG. The token is only created once you allow notifications.

Feedback and contact

When you contact us, for example through the feedback form in the app, by email, text message or WhatsApp, we process your message, your contact details and your name to handle your request.

Feedback in the app: Under “Feedback”, you can send us a message and optionally attach a screenshot and device data. Device data is only sent if you turn on “Include device data”. It consists of the iOS version, device model, language, time zone, connection status, the permissions you have granted, the number of your rules and groups, and the most recent entries of the app’s technical log. The log does not contain rule names or usage times. Under “What gets sent”, you can see all device data before sending. We receive your report together with the first name and email address of your account so that we can follow up.

Weekly check-in: During the beta, you check in with us once a week by WhatsApp, text message or email instead of paying a test statement.

WhatsApp: If you use WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, processes data under its own responsibility, including metadata showing that you are communicating with us; data may be transferred to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework. See the WhatsApp Privacy Policy. If you prefer to avoid this, please use email or text message.

Email: Our mailbox is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Retention: feedback, including screenshots and device data, for no more than six months after receipt; other messages until your request has been dealt with; check-in messages until the end of the beta.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (handling requests, fixing errors and improving the app); for screenshots and device data, your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by attaching the screenshot or turning on the option.

Emails about your account

We use an email delivery service to send emails about your account (confirming your email address, resetting your password, changing your email address). These emails contain your first name or your new email address and a confirmation link. They contain no tracking pixels, and we do not measure opens or clicks.

Legal basis: Art. 6(1)(b) GDPR.

Provider: AhaSend B.V., Amsterdam, the Netherlands, processing on servers within the EU. Website.

Beta testing via TestFlight

During the beta, the app is distributed through Apple’s TestFlight service. Apple processes data under its own responsibility, for example about your invitation, installation, crashes and feedback you send through TestFlight. Apple shares crash reports and this feedback, including screenshots, with us. If we invited you by email, we also know your name and email address; if you joined via a public link, we do not receive them.

Purpose: running the beta test, analysing errors and improving the app.

Retention: until the end of the beta.

Legal basis: Art. 6(1)(f) GDPR.

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. TestFlight and privacy.

Data stored on your device

Some data is stored only on your device: which apps belong to your rules, your usage times, the app’s technical log, a copy of your data for offline use, and your sign-in in the iOS keychain. We have no access to this data unless you send it to us in a feedback report. If you delete the app, iOS removes this data; only the sign-in may remain in the keychain, readable solely by the app.

Legal basis: Section 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR.

Recipients

We share personal data only where this is necessary for the purposes described in this policy. Recipients are the service providers named above (Supabase, AhaSend, IONOS), Apple for the services described, and, within the group feature, the other members of your groups. We have concluded data processing agreements under Art. 28 GDPR with our processors. We do not pass on data for advertising purposes and we do not sell data.

Transfers outside the EU

Our database is located in Frankfurt am Main. However, our hosting provider Supabase Pte. Ltd. is based in Singapore and uses sub-processors that are mostly based in the USA, so data may be accessed from these countries, for example for operations and support. These transfers are based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

Apple and WhatsApp may transfer data to the USA. Where a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR); otherwise it is based on Standard Contractual Clauses. More information is available at dataprivacyframework.gov and from the European Commission.

We will provide a copy of the Standard Contractual Clauses on request.

Retention periods

We delete personal data as soon as it is no longer needed for the purpose for which it was collected, consent has been withdrawn, or there is no other legal basis for keeping it, unless we are legally required or entitled to keep it longer. During the beta, no invoices or other records subject to statutory retention under German commercial or tax law are created.

Account, rules, extensions, test statements and setup answers: until you delete your account; setup answers earlier if you object.

Groups: for as long as the group exists; dissolved groups after their final weekly settlement.

Feedback, including screenshots and device data: no more than six months after receipt, or earlier if you delete your account.

Log of sent push notifications: 30 days.

Device tokens: until you sign out, delete your account or the token becomes invalid.

Server logs: no more than 30 days.

Messages by email, text message or WhatsApp: until your request has been dealt with; check-in messages until the end of the beta.

Your rights

Under the GDPR, you have the following rights. To exercise them, an informal message to info@offtimism.com is sufficient.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the processing of your setup answers without giving any reasons; we will then delete them.

Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

Access (Art. 15 GDPR): You may ask whether we process data about you and, if so, receive information about it and a copy of the data.

Rectification (Art. 16 GDPR): You may ask us to correct inaccurate data or to complete incomplete data.

Erasure and restriction (Art. 17 and 18 GDPR): You may ask us to delete your data or to restrict its processing, as provided by law.

Data portability (Art. 20 GDPR): You may receive the data you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller.

Complaint (Art. 77 GDPR): You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Security

We take appropriate technical and organisational measures to protect your data, taking into account the state of the art, the costs and the risks involved. The app communicates with our servers exclusively over encrypted connections (TLS). Access rules apply to every table in our database, so that users can only access their own data and the data shared within their groups. Passwords are stored only as hashes. Access to the server administration is limited to the team and protected by individual credentials. We design the app according to the principles of data protection by design and by default.

Minimum age and automated decisions

Minimum age: The app is intended only for people aged 18 or over. We do not knowingly process data of minors.

No automated decision-making: The app calculates extension prices using fixed rules that are shown to you in advance. We do not engage in automated decision-making within the meaning of Art. 22 GDPR or in profiling.

Changes to this policy

We update this policy when changes to our processing require it. The current version is available in the app under Profile → Privacy and at offtimism.app/datenschutz. If a change requires your consent or other action on your part, or an individual notice, we will inform you in the app.