Privacy Policy
Last updated: 2 September 2026
Who we are
Indistractable is made by Red Kite 9 Ltd, a company registered in England and Wales (company number 13157267) with its registered office at Riverside House, 3 Place Farm, Wheathampstead, Hertfordshire, AL4 8SB. For everything described in this policy, Red Kite 9 Ltd is the data controller. For questions, requests or complaints about your data, email us at support@indistractable.co.uk.
What we collect, and why
We collect the minimum we need to run Indistractable. Here it all is:
| What we collect | Why we collect it |
|---|---|
| Account data — your name, email address and a user ID | Signing you in (we use magic links, so there are no passwords), running your account, and answering your support requests. |
| Subscription status and purchase history — from Apple, via RevenueCat | Checking whether your subscription is active so the app can unlock paid features, and understanding overall subscription performance in aggregate. Payment itself is processed by Apple — we never see your card details. |
| Focus-session statistics — session durations and totals | Showing you your own stats, like the focused time you've won back. |
| Device identifiers | Making app features work on your device. |
| Support emails — whatever you choose to send us | Helping you when you get in touch, and keeping a record of the conversation. |
| Anonymous usage events — event names such as "session completed", with a hashed, non-reversible identifier | Understanding which features get used so we can improve the app. These events contain no personal data and can't be tied back to you. |
That's the whole list. The app contains no advertising or tracking and no crash-reporting SDKs, and the only analytics is the anonymous kind described above — events that can't be tied to you.
Your accountability partner
If you set up an accountability partner, you give us their email address. We use it for one thing only: sending them your unlock requests so they can approve or ignore them. We don't add them to any mailing list and we don't contact them for any other reason. Because you're sharing someone else's email address, it's your responsibility to make sure they're happy for you to use it.
Screen Time and your blocked apps
Blocking runs on Apple's Family Controls framework, on your device. Your Screen Time data never leaves your phone, and neither does a readable list of the apps you block. So the app can sync and restore your modes, our servers store only the opaque token Apple produces to represent your selection, as base64 data. It is encrypted by Apple and we cannot decode it — it tells us nothing about which apps you've chosen — and it's protected by row-level security, so it can only ever be read by your own account.
Our lawful bases
UK GDPR requires a lawful basis for each way we use your data. Ours are:
- Contract — providing the service you signed up for: your account, your sessions, your subscription, and support.
- Legitimate interests — telling you about service updates, keeping the service secure, improving the app, and the occasional one-off request for feedback about your own use of the service.
- Consent — marketing emails, and only if we ever send them. Every one would include an opt-out, and opting out changes nothing about your service.
Third parties we use
A short list of companies help us run Indistractable. Each receives only what it needs:
- Apple — runs the App Store and processes your payment through StoreKit. We never see your card details. Apple handles your transaction data as its own controller, under its own privacy policy.
- RevenueCat — manages subscriptions for us. It receives your purchase history and subscription status from Apple, along with your user ID and a device identifier so it can match your subscription to your account. We also use RevenueCat's dashboards to understand overall subscription performance — aggregate figures like revenue and churn, not profiles of individuals. RevenueCat processes data in the United States; our agreement with it includes standard contractual clauses to protect that transfer.
- Supabase — our backend and authentication provider. It stores your account data, focus-session statistics and the encrypted mode tokens described above, in the EU (Frankfurt, eu-central-1).
- Resend — sends our transactional email: magic sign-in links and accountability-partner requests. It receives the email addresses those messages go to. Resend processes data in the United States; our agreement with it includes standard contractual clauses to protect that transfer.
- TelemetryDeck — provides our anonymous usage analytics. It receives a hashed, non-reversible identifier and event names such as "session completed" — no personal data, and nothing that can be tied back to you. TelemetryDeck is a German company and processes data in the EU.
Our analytics is anonymous: neither TelemetryDeck nor we can tie usage events back to you. Apart from the transfers noted, your data stays in the UK and EEA.
How long we keep your data
We keep your account data for as long as your account exists. You can delete your account in the app, under Account, or by emailing support@indistractable.co.uk — once you do, your account data and your focus-session statistics are deleted within 30 days. Anonymous usage events contain no personal data and aren't linked to your account, so they can't be — and don't need to be — deleted with it. Apple keeps its own records of your transactions under its own retention policy; that part isn't ours to delete.
Your rights
Under UK GDPR you have the right to ask us for:
- Access — a copy of the personal data we hold about you
- Rectification — correcting data that's wrong
- Erasure — deleting your data
- Restriction — limiting how we use it
- Portability — receiving your data in a usable format
- Objection — objecting to processing based on legitimate interests
To exercise any of them, email support@indistractable.co.uk. If you're not happy with how we handle your data, you also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.
Children
Indistractable is not directed at children under 13 and we don't knowingly collect their data. If you believe a child has given us personal data, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll post the new version here and update the date at the top.