Privacy Policy
Scrollpamine is operated by Grizzlify EOOD ("we", "us", "our"). This policy explains what information we collect when you use the Scrollpamine iOS and Android apps and the website at scrollpamine.com, why we collect it, and how to remove it.
We don't sell personal data, we don't show ads, and we don't run advertising trackers. The summary fits on a postcard: we keep your account so you can sign in, your decks so they sync between your devices, and a small amount of anonymous product analytics so we can tell which screens work. Everything else stays on your phone.
1. What we collect
Account info. When you sign in with Apple, Google, or an email magic link, we receive your email address and an opaque user identifier. We store these in our authentication database so we can recognise you on your next launch.
Deck content you create or import. Decks, cards, and the answers you mark right or wrong are stored on your device and synced to our database so you can use the same content across devices. You can delete any deck at any time; deletion propagates to all your devices on the next sync.
Study activity. When you answer a card, we record the card ID, the result (correct / incorrect), and a timestamp. We use this to compute your stats and your spaced-repetition schedule. We don't record anything about the contents of the apps you were trying to open.
Subscription state. If you start a paid plan, the store you bought through handles the payment and tells us whether your subscription is active — the Apple App Store on iOS, Google Play on Android, or Stripe for checkout on our website. Each sends us subscription metadata (plan, status, renewal or expiry date) but never your card details. We mirror that into an entitlement row in our database keyed to your account.
Anonymous product analytics. We record which screens you see and which actions you take — for example, "paywall_viewed", "onboarding_completed" — in our own database (hosted in the EU by Supabase). These events do not include your email, your deck contents, the apps you blocked, or anything you'd consider personal. Before sign-in, the identifier is a random per-install token; after sign-in, it is your account ID so funnels join up across sessions.
Crash and diagnostic reports. When the app or this website hits an error or crashes, we record technical diagnostics: the error type, a stack trace, and basic device information such as model, operating-system version, and app version. These reports are stored in our own database (hosted in the EU by Supabase) and used only to find and fix bugs and keep the product stable. They contain no deck contents, no email, and nothing about the apps you blocked, and they are never used for advertising. If you are signed in, a report may carry your account ID so we can tell whether a bug hit one person or many; before sign-in it carries only the random per-install token. We keep raw reports for up to one year.
Website performance metrics. On this website we use Vercel Web Analytics and Speed Insights to count page views and measure loading performance. These metrics are aggregate, do not use cookies, and do not build a profile of you across sites.
2. Legal basis for processing
Under Article 6 of the EU General Data Protection Regulation, we are required to identify a legal basis for each category of processing. Ours are:
- Performance of a contract (Art. 6(1)(b)) — your account, your deck content, your study activity, and your subscription state are processed because they are necessary to deliver the service you signed up for. Without this data, the app cannot function for you.
- Our legitimate interests (Art. 6(1)(f)) — anonymous product analytics, crash and diagnostic reports, and website performance metrics are processed because we have a legitimate interest in understanding which screens work, where in the funnel users drop off, and keeping the product stable and secure. These records contain no personal content, and the impact on your privacy is minimal. You can object to this processing by emailing the address at the bottom of this page.
- Compliance with legal obligations (Art. 6(1)(c)) — where applicable, for example responding to lawful requests from a supervisory authority.
3. What stays on your device — and never reaches us
- Which specific apps you chose to block. On iOS, Apple's Screen Time API (FamilyControls) hands these to the app as opaque tokens that cannot be read by us or by Apple's servers. On Android, the list of apps you armed is stored only in the app's private storage on your device. Either way, the list never leaves your phone.
- Which app is currently in front (Android). To interrupt only the apps you armed, the Android app needs to know which app is on screen right now. It reads this from Android's accessibility service (window-change events only, never screen contents) and the Usage access API, and uses it solely to time your armed apps and decide when to show a question. This signal is processed on your device in real time and is never recorded, transmitted to us, sold, or used for advertising.
- Browsing or app-usage data. We don't see what you scrolled, what you watched, or how long you spent on any app.
- Card contents during interception. The flashcard shown on the block screen runs entirely inside an iOS extension on your device.
4. Sub-processors
We use a small number of vendors to operate the service. Each one only receives the data it needs for its specific job.
- Supabase — authentication and the database that stores your decks, study sessions, and entitlement records. Data is hosted in the EU.
- Apple App Store — processes payments and reports subscription status for purchases made on iOS. We never see your card details.
- Google Play — processes payments and reports subscription status for purchases made on Android. We never see your card details.
- Stripe — processes payments and reports subscription status for subscriptions bought through checkout on our website. We never see your card details.
- Vercel — hosts this website and the email-link handoff page, and provides cookieless web analytics and performance metrics for it.
- Google AdMob — serves the ads shown in the free version of the mobile app, and measures ad performance. Ads are only shown to users without an active subscription. If you subscribe, no ads are shown and AdMob receives no data about you.
5. International transfers
Some of our sub-processors are headquartered outside the European Economic Area — for example, Stripe and Google are based in the United States. Where personal data leaves the EEA, the transfer is covered by an approved safeguard: the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework (where the recipient is certified), or another mechanism approved under Chapter V of the GDPR. We do not transfer data to recipients in jurisdictions without one of these safeguards in place.
6. Cookies and trackers
This website does not use advertising cookies, third-party tracking pixels, or session-recording scripts.
The free version of the mobile app shows ads through Google AdMob. On iOS it asks for App Tracking Transparency permission so that AdMob can use your device's advertising identifier to show more relevant ads and measure them. If you decline, you still get ads, but non-personalized ones. We do not use this to build a profile of you across other companies' apps or websites. If you subscribe, no ads are shown and AdMob receives no data about you.
7. How long we keep your data
Account information and decks are kept for as long as you have an account. Detailed usage records, such as analytics events and your individual study-attempt history, are kept for up to one year and then removed automatically, even while your account is active. When you delete your account, we delete the rows associated with you within 30 days. Aggregated analytics that no longer identify you may be retained for product reporting.
8. Your rights
If you are in the EU, the UK, or another region with similar protections, you have the right to access the personal data we hold about you, to correct it, to export it in a portable format, to ask us to delete it, and to lodge a complaint with your local supervisory authority. You can exercise any of these rights by emailing the address at the bottom of this page.
9. Deleting your account
You can delete your Scrollpamine account from inside the app under Settings, or by emailing us. Account deletion removes your decks, your study sessions, and your entitlement record from our database.
10. Children
Scrollpamine is not directed at children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
11. Changes to this policy
If we make a material change, we will update the "Last updated" date and, if the change is significant, notify you in the app the next time you open it.
12. Contact
Grizzlify EOOD
Email: contact@scrollpamine.com