Privacy policy

Effective 2026-08-21. Applies to the ToddlerLock Android app, package com.ruflo.toddlerlock, and this website. Account, analytics, trial and purchase details updated 2026-09-13.

Google sign-in and shared account records

Our account service uses Supabase Auth to verify Google sign-in. It processes your Google account identifier and the email address and profile information Google supplies. ToddlerLock, PullBack and Unburden use this shared sign-in service. Each app has separate trial, referral and purchase records. Signing in does not upload your PIN, chosen app names or screen content.

Our service stores your app account identifier, trial dates, referral claims and rewards, and verified purchase and entitlement records. If you opt into referral qualification, it receives account-linked lock start and finish times. These timing records are separate from account-unlinked counters and contain no locked app names or screen content. You can turn referral timing off in the account section.

What the app processes, and where it stays

• Your PIN is stored on your device as a one-way hash. We never see it and cannot recover it.
• Your settings, meaning the chosen app, timers, hold and countdown preferences and accessibility options, are stored on your device only.
• Purchases use Google Play Billing. Google processes your payment. The app caches verified Plus access. When you sign in, our service verifies purchase tokens with Google and stores encrypted purchase references, product and subscription status, and reward records. We do not receive your payment card details.

Optional 14-day Plus trial

Trials and referrals require Google sign-in. The service remembers trial eligibility for that Google account and app so deleting an account or reinstalling does not create another 14-day offer. Your basic lock remains available without signing in.

Android sends a hashed device value derived from the Android identifier and package name. Our server stores a further keyed hash; it does not receive the original Android identifier. We use Google Play Integrity to check app installation and device eligibility for trials and referral qualification. Google processes app and device information under Google's privacy policy. The service uses the verdict for eligibility and fraud prevention, and does not store the Integrity token.

Our server receives the network address needed to handle requests and uses temporary keyed values for rate limits. Account and device records are not joined to the account-unlinked counters or used for advertising.

Account features contact our service when you sign in, refresh access, manage referrals, or sync purchases. Verified shared access can work offline for up to 24 hours, capped at its access expiry, on the same device boot. After a restart or cache expiry, reconnect to verify access. Changing the phone's date does not extend a trial. Buying Plus is a separate, explicit Google Play purchase.

Request account deletion

Request ToddlerLock account deletion in your browser. This works without installing the app and uses Google sign-in to verify ownership.

In the app, open Settings > Account > Request account deletion. For help with an account request, use the account support form. Never send passwords, payment details or identity documents.

An in-app request immediately disables shared trial and referral access and returns a pending reference. Pending means deletion has been requested, not completed. We process the request and can provide its progress through the account section or support. Uninstalling or signing out alone does not delete server records.

The request covers your ToddlerLock account and associated data. It does not delete your PullBack or Unburden accounts, your Google account, or other apps' purchases. Your shared login identity remains while another app account needs it. Basic locking stays available.

Account deletion does not cancel a subscription. Manage ToddlerLock subscriptions in Google Play to stop future renewals. Payment providers may retain transaction records for their own legal obligations.

We retain minimal app-specific eligibility and reward records to prevent repeat trials, duplicate referral rewards and purchase theft. A keyed value derived from your verified Google identity allows these checks without retaining your raw Google identifier in the eligibility record. Trial eligibility is retained while we operate the once-per-account offer. Necessary payment and reward evidence is retained for billing, restoration and fraud-prevention obligations. These limited records do not include locked app names, screen content or PINs. Other account data is removed through the deletion process; we do not describe a pending request as completed erasure.

The six counters

The free lock needs no internet connection. Separately, optional usage counts help us understand which parts of the app get used. There are exactly six, and this is all of them:

• App opened. A count, nothing else.
• Hand-over started counts a lock attempt. Hand-over completed counts the Android lock service accepting that start, not the later release or end of a session. Each includes a coarse duration band such as "20-45 minutes" and the free or Plus access tier.
• Plus screen shown, with which part of the app opened it, so we can tell which features people actually want.
• Purchase completed, with which plan.
• Permission granted, meaning overlay or accessibility.

What they do not contain, ever:

• No identifier in the event payload. No app, device, advertising, account or session identifier is sent with a count. Our server and hosting infrastructure still process ordinary request metadata, as described above. We do not use it to stitch events into profiles.
• Never which app you lock. Which app your child uses, and when, is a fact about your household and it stays on your phone.
• No exact durations, only bands, for the same reason.

They are on by default and disclosed here. Turn them off under Settings, Anonymous usage counts, and the app sends no usage counts. Nothing is queued while they are off, and nothing is sent later. This setting does not disable account verification, separately opted-in referral timing, Google Play Billing or a feedback message that you choose to send.

We do not sell, rent or trade these counts or use them for advertising. There is no third-party analytics service involved in these counters. Our endpoint stores daily totals on our infrastructure, separate from account records. These totals are not a record of individual people or their sessions. We do not store raw events or request metadata in the totals database. Ordinary hosting logs may temporarily contain request metadata as described above.

Google Play Billing communicates with Google to check purchases when the app is active, when you open the Plus screen, restore a purchase or buy Plus, under Google's privacy policy. Subscription access is cached for up to 48 hours on the same device boot and needs another successful check after that or after restarting the phone. A verified lifetime purchase remains available offline. A successful Google Play check can update access after a cancellation, expiry or refund.

Accessibility service disclosure

ToddlerLock uses Android's AccessibilityService API to do its core job while the lock is active. It reads which app is in the foreground, closes the notification shade and recent-apps screen while the lock is on, and returns the phone to the app you chose if something else comes to the front. This processing happens in real time, on your device.

• It does not read the text, messages, passwords, or content on your screen for any purpose beyond identifying the foreground app and the system panels described above.
• It does not record, store, or transmit anything it observes.
• It does nothing at all while the lock is off.
• You can revoke the permission at any time in Android Settings, and the app asks for your explicit consent inside the app before the system permission screen ever opens.

Children

ToddlerLock is a tool for parents and guardians, operated by adults. A child may touch the locked screen. Optional accounts are for adults. The app shows no ads and does not request a child's name, age, contact details or screen content. Trial verification is initiated by the adult setting up Plus and uses the account and device records described above. The six counter payloads are not tied to an app account; they record that a hand-over happened, not who was holding the phone.

If you write to us

Settings has Suggest something and Report a problem. You write the message yourself, and nothing leaves the phone until you press Send. Six facts go with it: the app version, your Android version, your device model, whether Plus is active, and whether each of the two permissions is granted. That list is shown to you on the screen before you send, and it is the whole list. No persistent app or account identifier goes with it, and screenshots cannot be attached.

The message is sent through our notification relay to our private Telegram inbox. The relay stores the report kind, diagnostics context, delivery status, and Telegram chat and message references. The full message and diagnostics are delivered and stored as a Telegram message. We use them to answer you and fix what you reported, and never sell them or share them with an advertiser. You can also write to us through the website contact form.

Website analytics

We use our own Umami installation to understand visits to this website, which parts people explore, and whether they use the demo, follow the Google Play link, or send a contact message. It records page views, general device and referral information, and named interactions. No advertising cookies, account IDs, email addresses, names, or message text are included in these analytics. Ordinary query parameters and page fragments are removed; standard campaign labels can be included. This is separate from the app's six counters.

We respect browser Do Not Track and Global Privacy Control preferences. You can also turn website analytics off for this browser. That preference is saved locally on your device and lasts until you clear site data or turn it back on.

Website contact form

If you contact us through this website, you provide your email address, message, topic, and optionally your name. These details are sent through our private notification service to the person building ToddlerLock so we can respond. Delivery uses Telegram. We do not add you to a marketing list. The contact endpoint does not log your message or email address; delivery records include the topic, submission reference, and delivery status.

Permissions summary

• Display over other apps: draws the lock screen overlay.
• Accessibility: keeps the lock effective, as disclosed above.
• Foreground service: keeps the lock alive while active.

Changes

If a future version ever changes what the app processes, this policy will be updated first and the change will be called out in the app before it applies.

Contact

Questions: Contact us

ToddlerLock is operated by Alex Maxey (Unburden Technologies). This page is the canonical privacy policy referenced from the Google Play listing.