Privacy Policy

Effective date: April 7, 2026 · Last updated: April 7, 2026

Pactup ("we", "us", "our") is operated by Almas Mirzakhmetov, an individual developer based in Kazakhstan. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and your rights regarding that data.

By using the App you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account Information

When you sign in with Google (Android) or Apple (iOS), we receive:

Authentication identifier — a unique ID from your sign-in provider (Google sub or Apple sub). We do not receive or store your Google/Apple password.
Display name — the name you choose to show other participants. You can change this at any time.
Profile image URL — optionally provided by your sign-in provider.

1.2 Screen Time Data

When you join a challenge, the App collects:

Per-app usage duration — how many minutes you spent in each tracked app during the challenge period.
Total device pickups — how many times you unlocked your device.
Usage snapshots — periodic summaries of the above data, cryptographically signed on your device before being uploaded.

This data is collected only for apps you explicitly choose to track in a challenge. We do not monitor your entire device usage.

1.3 Device Information

Device token — a Firebase Cloud Messaging (FCM) registration token used to deliver push notifications. This token does not identify you personally.
Device identifier — a stable per-device ID used to manage notification tokens. Not shared with third parties.
Platform — "android" or "ios", used to route notifications correctly.

1.4 Cryptographic Keys

Your device generates a P-256 ECDSA key pair stored in the platform keystore (Android Keystore or iOS Secure Enclave, hardware-backed when available). The public key is uploaded to our server to verify snapshot signatures. The private key never leaves your device.

1.5 Challenge and Social Data

Challenges you create or join (title, tracked apps, daily limit, duration, stakes)
Chat messages sent within challenge groups
Streak counts, slip events, reputation scores, and badges earned

1.6 Subscription Data

Subscription tier (free or pro) and expiration date
App Store or Google Play purchase tokens for subscription verification
We do not store credit card numbers or billing addresses — payments are handled entirely by Apple App Store or Google Play

2. How We Use Your Data

Purpose	Data used	Legal basis (GDPR)
Authenticate your account	Google/Apple sign-in identifier	Contractual necessity
Display your profile to challenge participants	Display name, emoji/avatar, reputation, badges	Contractual necessity
Track challenge progress	Screen time snapshots, streaks, slips	Consent (you opt in by joining a challenge)
Show leaderboards and group feeds	Aggregated usage data within a challenge	Consent
Send push notifications	FCM device token	Consent
Verify data integrity	Cryptographic signatures and public keys	Legitimate interest (security)
Manage subscriptions	Subscription tier, purchase tokens	Contractual necessity
Detect tampering	Snapshot chain hashes, signature verification	Legitimate interest (security)
Generate fun stake suggestions	Challenge context (no personal data)	Consent

3. Who Sees Your Data

3.1 Other Challenge Participants

When you join a challenge, the following is visible to other participants in that challenge:

Your display name and avatar
Your daily screen time totals for tracked apps
Your streak count and slip events
Chat messages you send

Participants outside your challenge cannot see your data.

3.2 Service Providers

We use the following third-party services to operate the App:

Google Cloud Platform (GCP) — cloud hosting, database (Cloud SQL PostgreSQL), located in the United States (us-central1)
Firebase Cloud Messaging — push notification delivery to iOS and Android devices
Apple App Store / Google Play Billing — subscription payment processing
OpenAI — used to generate fun stake suggestions for challenges. Only challenge context (challenge type, duration) is sent; no personal data or usage data is shared with OpenAI.

These providers process data on our behalf and are bound by their own privacy policies.

3.3 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes.

4. Android-Specific Permissions

Permission	Why we need it	When it's used
Usage access `PACKAGE_USAGE_STATS`	Read screen time data for apps you're tracking in a challenge	Only while you have an active challenge. You grant this manually in system settings.
Notifications `POST_NOTIFICATIONS`	Deliver streak, slip, and chat notifications	After you grant permission at onboarding or in settings
Display over apps `SYSTEM_ALERT_WINDOW`	Show a blocking reminder when you open a limited app after exceeding your daily cap	Only when app blocking is enabled for an active challenge
Foreground service	Keep usage tracking running reliably in the background during active challenges	Only during active challenges
Boot completed	Restart usage tracking after device reboot	Automatic — no user interaction required

5. iOS-Specific Permissions

Permission	Why we need it	When it's used
Screen Time API (Family Controls)	Monitor and restrict app usage for apps you're tracking in a challenge	Only while you have an active challenge. You grant this via the Screen Time prompt.
Notifications	Deliver streak, slip, and chat notifications	After you grant permission at onboarding or in settings
Background App Refresh	Periodically check usage data while the app is in the background	Only during active challenges
iCloud (CloudKit)	Sync shared app group data between app and extensions	Automatic — used internally for device activity monitoring

6. Data Storage & International Transfers

Your data is stored on Google Cloud Platform servers in the United States (us-central1 region). If you are located outside the United States (including the EU/EEA), your data will be transferred to and processed in the United States. By using the App, you consent to this transfer. We rely on Google Cloud's Data Processing Agreement and Standard Contractual Clauses for lawful EU-US data transfers.

7. Data Retention

Account data — retained while your account is active.
Screen time snapshots — retained for the duration of the challenge plus 30 days, then permanently deleted.
Chat messages — retained for the duration of the challenge plus 30 days.
Device tokens — automatically replaced when your device generates a new token. Old tokens are overwritten.
Cryptographic keys — historical public keys are retained to verify past snapshots. Your private key remains on-device and is deleted if you uninstall the app.

8. Data Security

All data in transit is encrypted with TLS 1.2 or higher.
Screen time snapshots are cryptographically signed on-device using P-256 ECDSA before upload — the server verifies each signature and rejects tampered data.
Sensitive credentials (private keys, tokens) are stored in the platform keystore (Android Keystore / iOS Secure Enclave), backed by hardware security when available.
Database at rest is encrypted via Google Cloud SQL encryption.
Refresh tokens are stored as SHA-256 hashes — we never store raw tokens.

9. Your Rights

Depending on your jurisdiction (GDPR, CCPA, or equivalent), you may have the right to:

Access your personal data
Export your data in a portable format
Delete your account and all associated data
Correct inaccurate personal data
Object to processing of your data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

Account deletion: You can delete your account at any time from the app's settings (Profile → Settings → Delete Account). Deletion permanently removes your profile, challenges, and all associated data within 30 days. You can also request deletion by emailing [email protected].

10. Children's Privacy

Pactup is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and notify you through the App. Continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices:

Email: [email protected]
Web: getpactup.app