Privacy Policy
Last Updated: October 7, 2026
1. Who Is Responsible
The controller for the personal data described in this policy is Pablo Galve, an individual developer based in Austria, email support@the-sprout.app. Further legal details are listed in the Impressum. References to "I", "me", or "the provider" in this policy mean Pablo Galve.
2. Data We Process
- Screen time and blocking data: Sprout uses your phone's built-in screen time and app permission tools to measure selected app use, apply limits, and help block selected apps or short-form video screens. On Android, this may include usage access and accessibility permissions. On iOS, this uses Apple's Screen Time tools. This information stays on your device, except for the Android diagnostic reports described below, and is never sold.
- Local activity data: Activities you complete, app usage history, active temporary unblock timers, and selected blocked apps or categories stay on your device.
- Camera, photos, and face data: Some activities ask you to show what you did, for example read a book, make your bed, go outside, smile, or exercise. When you verify one, Sprout checks a photo or the live camera preview on your device, without a network connection, to see whether it matches the activity. Sprout does not perform face recognition or face identification, does not create, store, or compare a faceprint or face template, and does not use Face ID. Sprout cannot tell who is in the picture, only whether the picture matches the activity. Nothing from the camera is uploaded, sent to me or to any third party, or used for advertising, profiling, or model training. The photo is deleted from your device as soon as the check finishes, and live preview images are never saved. All Sprout keeps is whether you completed the activity and the minutes you earned.
- Account data: If you sign in, your email address is handled by Google Firebase Authentication so you can create and access your account. I do not use your email for marketing.
- Synced account state: If you sign in, Sprout stores your earned time balance, streaks, display name, profile and onboarding preferences (including referral source, screen time range, and pain point selections), sync version, timestamps, and a device sync identifier in Google Cloud Firestore so account features can follow you across devices.
- Referral source: During onboarding, Sprout may ask how you heard about the app. This optional response is used to understand which channels are most effective and to improve promotional efforts. It is not used for behavioral profiling or sold to third parties.
- Crash reports: When Sprout crashes or hits an error, technical reports such as device model, operating system version, app version, and stack trace are sent to Sentry so I can fix stability issues.
- Optional feedback and feature votes: If you send feedback in the app, the message you write, its category, the app version, and your language are stored in Google Cloud Firestore, together with your account identifier if you are signed in. If you vote for a feature request, your vote is stored under your account identifier. Feedback does not ask for your name or email address, and screenshots are disabled. If you answer the optional question when deleting your account, your answer and any text you add are stored without any account identifier.
- Android diagnostic reports: To check that Sprout measures app time correctly, the Android app may send Sentry a report when its own measurement of an app's usage differs from Android's. The report contains that app's package name (for example,
com.instagram.android), the two measured durations, and the time window. It does not contain your name, email address, or account identifier. - Usage analytics: Sprout sends app interaction events to Firebase Analytics, such as which screens or features are used, onboarding progression, and how you found Sprout. The mobile app stores a random analytics identifier on your device to measure retention and avoid counting the same install as multiple users. This identifier is not your email address, name, or phone number. Analytics events do not include your email address, selected blocked apps, camera photos, or app usage history. You can switch usage analytics off at any time in Settings → Privacy.
- Advertising measurement: Sprout advertises through Google Ads. Firebase Analytics is linked to Google Ads so I can see which ads brought people to Sprout, for example which campaign led to an install, a sign-up, or a purchase. For this, Google may use the analytics identifier and your device's advertising identifier. Sprout does not show ads inside the app. You can switch advertising measurement off at any time in Settings → Privacy.
- Subscription and purchase data: If you buy Sprout Premium, the purchase is processed by the Apple App Store on iOS or by Google Play Billing on Android, and managed through RevenueCat. Sprout does not receive or store your card or payment details. RevenueCat processes a purchase token, a pseudonymous app user identifier linked to your signed-in account, and the analytics identifier, so your premium entitlement works across your devices and purchases can be counted in analytics. Your premium status and any time-limited free-unlock window are stored in your Firestore user document.
- Survey responses: If you complete the optional in-app survey to unlock premium, your multiple-choice answers and your account identifier are stored in Google Cloud Firestore so I can understand user needs. The survey does not collect free-text personal information.
- Referral data: If you use the referral feature, Sprout stores your referral code and, if you redeem one, the code of the person who invited you in your Firestore user document, so referral rewards can be credited. Referral codes are pseudonymous identifiers derived from your account ID — they are not your name or email address. If you share your invite link, the message contains your referral code, and anyone you share it with can see it; Sprout does not access your contacts, as sharing happens through your device's system share sheet. Opening an invite link transmits the contained code to the app so it can be redeemed. Reward crediting is processed on Sprout's servers using purchase events from RevenueCat.
- Website: the-sprout.app uses Google Analytics without cookies or other identifiers stored on your device, with advertising features turned off, to count page views and link clicks. It is skipped when your browser sends Do Not Track.
3. Why We Use This Data and on What Legal Basis
- Providing Sprout, your account, sync, purchases, and referral rewards (screen time and blocking data, account data, synced account state, purchase and referral data): necessary to perform our contract with you (Art. 6(1)(b) GDPR).
- Crash reports, diagnostic reports, and preventing abuse of free unlock options: our legitimate interest in keeping Sprout working, secure, and fair (Art. 6(1)(f) GDPR).
- Optional feedback, feature votes, survey answers, and the referral source answer: you choose to send them; they are used on the basis of your consent (Art. 6(1)(a) GDPR).
- Usage analytics and advertising measurement: our legitimate interest in understanding how Sprout is used and which advertising works (Art. 6(1)(f) GDPR). Both are on by default and you can switch each off at any time in Settings → Privacy, which stops collection from that moment.
- Camera checks for activity verification: necessary to perform our contract with you (Art. 6(1)(b) GDPR) — the check is what earns you the time. It happens on your device and nothing is transmitted.
- Keeping purchase records: Apple, Google, and RevenueCat keep purchase records to meet their legal and tax obligations (Art. 6(1)(c) GDPR).
Sprout does not sell personal data and does not make automated decisions that have legal or similarly significant effects on you.
4. Recipients and International Transfers
- Firebase Authentication, Cloud Firestore, and Firebase Analytics (Google): sign-in, account sync, feedback, and analytics. See Firebase's Privacy Information and Google's Privacy Policy.
- Google Ads (Google): advertising measurement as described above. See Google's Privacy Policy.
- Sentry (Functional Software, Inc.), EU data region: crash reports and diagnostic reports are stored on Sentry's servers in Germany. See Sentry's Privacy Policy.
- Apple App Store (Apple): processes premium purchases on iOS. See Apple's Privacy Policy.
- Google Play Billing (Google): processes premium purchases on Android. See Google's Privacy Policy.
- RevenueCat, Inc.: manages subscription entitlements. See RevenueCat's Privacy Policy.
These providers process data on my behalf or as independent controllers for their own store and payment services. Google, RevenueCat, and Sentry are based in the United States, so data may be transferred there. Such transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46 GDPR). I do not share personal data with any other third parties.
5. Children
Creating a Sprout account is meant for people aged 16 or older. A parent can also set Sprout up on a child's device to limit the child's apps; the parent agrees to this during setup. On a device set up for a child, usage analytics and advertising measurement are switched off once setup is finished, and stay off unless the parent turns them on in Settings → Privacy. Crash reports are still sent so the app keeps working. If you believe a child has created an account without a parent's agreement, contact me and I will delete it.
6. Data Retention
- Local data: local screen time, blocking, activity, and temporary unblock data stays on your device until you delete app data or uninstall Sprout.
- Camera photos and face data: a verification photo is deleted from your device as soon as the check finishes, and is never uploaded. Live preview images are never saved. No faceprint, face template, or other face identifier is created, so there is nothing to retain, share, or delete.
- Account data: your Firebase authentication record and Firestore user document are kept while your account is active and removed when you delete your account.
- Analytics data: the mobile analytics identifier stays on your device until you uninstall Sprout or clear app data. Firebase Analytics events are kept for the retention period set in Google Analytics. When you delete your account, Sprout asks Google Analytics to erase the events collected under this device's analytics identifier. If Google does not accept the request straight away, it is recorded and retried, and completed within 30 days.
- Crash and diagnostic data: kept only as long as needed to investigate and fix issues, then removed under Sentry's retention settings.
- Feedback: kept until you delete your account or ask me to delete it. Feedback sent without an account carries no account identifier.
- Purchase, survey, referral, and feedback data: premium status, free-unlock windows, survey answers, referral codes, feedback you sent while signed in, feature votes, and PIN reset codes are removed from Firestore when you delete your account. Account-deletion answers carry no account identifier, so they cannot be linked back to you. RevenueCat, Apple, and Google keep purchase records under their own policies and to meet legal and tax obligations.
7. Your Rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its processing, and to receive it in a portable format. Where processing relies on legitimate interest, you can object at any time (Art. 21 GDPR); for analytics and advertising measurement the switches in Settings → Privacy do this directly. Where processing relies on consent, you can withdraw it at any time without affecting processing that happened before. To exercise your rights, email support@the-sprout.app or use the in-app delete option.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one in your country of residence. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at.
8. Deleting Your Data
You can delete your account at any time from the app's Settings → Delete Account option. This removes your Firebase authentication record, your Firestore user document, and the other Firestore data linked to your account, and asks Google Analytics to erase this device's analytics data. Because screen time, blocking, activity, and temporary unblock data is stored locally, uninstalling Sprout or clearing its app data removes that information from your device. To have crash or subscription records deleted as well, email support@the-sprout.app. For details, see the Delete Account page.
9. Security
I take reasonable measures to protect data handled by Firebase Authentication, Cloud Firestore, and Sentry. Firestore security rules limit each signed-in user to their own user document. No method of transmission or storage is perfectly secure, so absolute security cannot be guaranteed.
10. Liability
Sprout is provided on an "as is" and "as available" basis. To the maximum extent permitted by law, the provider is not liable for indirect, incidental, or consequential damages arising from use of the app or third-party services outside reasonable control.
11. Changes to This Privacy Policy
This policy may be updated from time to time. Material changes will be reflected on this page with an updated "Last Updated" date.
12. Contact
For privacy questions or to exercise your rights, contact Pablo Galve at support@the-sprout.app.