Legal
Privacy Policy
The short version
- Your allowance, your tasks and your history stay on your phone. We never receive them.
- To subscribe, you create an account with your email address and a password. Our server, run by Supabase in Frankfurt (EU), keeps only that account, the phones signed in to it and the status of your subscription.
- We use a few service providers to run this: Supabase (server), Resend (email), Cloudflare (website and bot protection), Google (payments) and RevenueCat (subscription management). They are listed in section 4.
- There is no advertising, no analytics and no tracking.
- The Accessibility service only sees the name of the app that is open. It does not read what is on your screen.
- You can delete your account at any time, in the app or at deralba.com/delete-account.
1. Who we are
Deralba (“Deralba”, “we”, “us”) is a screen time app developed by Ahmet Sadık Nalbant, an independent developer based in Türkiye, who is responsible for the processing described in this policy. This policy covers the Deralba mobile app and this website, deralba.com.
For any privacy question or request, write to support@deralba.com.
2. What stays on your phone
To do its job, Deralba works with the information below. All of it is processed and stored on your device only. None of it is sent to us or to anyone else.
| Information | Why Deralba uses it |
|---|---|
| The apps you choose to guard | To know where to show the gate. |
| The name of the app currently open, and whether you are scrolling in a guarded app | To show the gate when a guarded app opens, and to measure how long you spend in guarded apps. Deralba sees the app's name, not its content. |
| Time spent in guarded apps, focus sessions and your credit balance | To run your daily allowance and show your own history back to you. |
| The tasks you write | To show your list and give you credits when you finish a task. |
| Your settings, such as your allowance and morning time | To make the app work the way you set it up. |
| Your answers to the first questions (which app, roughly how long, and when it is hardest) | To suggest a starting setup and a reminder time. |
| The last answer from our server about your subscription | To keep the app working for up to 7 days when you are offline. |
| The list of apps installed on your device | To let you pick which apps to guard. Only your choices are saved. |
3. What our server keeps
A subscription has to work on every phone you use and survive a change of phone, so it is tied to an account on our server. The server keeps only the information below, and none of the information in section 2.
| Information | Why | How long |
|---|---|---|
| Your email address and password. The password is stored only as a one-way hash, so nobody, including us, can read it. | To create your account and let you sign in. | Until you delete your account. |
| Your language (Turkish or English) | To send account emails, such as a password reset code, in your language. | Until you delete your account. |
| The phones signed in to your account: a random ID the app creates when it is installed (not a hardware ID), the phone's model name, and when it last checked in | To allow up to two phones per account and tell you when an older phone was signed out. | Until a newer phone replaces it, or you delete your account. |
| Your Google Play subscription: your plan, its status, start and end dates, and whether it is a trial, renews automatically or has a payment problem | To check that your subscription is active on any phone you sign in on. | Until you delete your account, or the purchase is refunded. |
| Waitlist sign-ups from this website: your email address, language, the page you signed up on and the date | To email you news about Deralba's launch. | Until you ask us to remove it (see section 8). |
| A one-way hash of the IP address that submitted the waitlist form | To stop the same source from sending more than five sign-ups a minute. | Deleted within one hour. |
Like any online service, our server provider also keeps short-lived technical logs, such as IP addresses and app or browser details, to run and secure the service.
4. Service providers
We use the following providers. Each one receives only what it needs to do its job for us, and each has its own privacy policy.
- Supabase hosts our server: accounts, the phone list, subscription records and the waitlist. The data is stored in the EU, in Frankfurt, Germany. Supabase privacy policy.
- Resend sends our emails: password reset codes, the waitlist confirmation and launch news. It receives your email address and the email we send you, and sends from its EU region in Ireland. Resend privacy policy.
- Cloudflare hosts this website, delivers email sent to deralba.com, and runs Cloudflare Turnstile, a bot check on the waitlist form (section 10). Cloudflare privacy policy and Cloudflare Turnstile Privacy Addendum.
- Google processes payments and subscriptions through Google Play (section 9), and provides the mailbox that receives email sent to us. Google privacy policy.
- RevenueCat manages subscriptions for us: it confirms a purchase with Google Play and tracks renewals, cancellations and refunds (section 9). It receives a random account ID (not your email address), your Google Play purchase record and technical information such as the app version and IP address. RevenueCat is based in the United States. RevenueCat privacy policy.
Some of these providers are based outside your country, including in the United States. Where personal data leaves the EU or Türkiye, the transfer relies on the safeguards the law requires, such as the European Commission's Standard Contractual Clauses.
5. Permissions, and why we ask for them
Accessibility service
Deralba uses Android's Accessibility service for one purpose: to notice when you open an app you have chosen to guard, so it can show the gate in front of it and measure the time you spend there. The only action it takes on your behalf is returning you to your home screen: when you turn back at the gate, when the maze closes because you lifted your finger or touched a wall, when your time or credits run out, or when you open a guarded app during protection or a focus session. Each of these follows something you did or a limit you set.
The service does not read the content of your screen. It does not read text, messages, passwords, photos or anything you type. It only uses the name of the app in front, which app each window on your screen belongs to, and a signal that scrolling is happening. This information is used on your device and is never transmitted. You can turn the service off at any time in your device's Accessibility settings; the gate stops working when you do.
Data from the Accessibility service is never used for advertising, never sold, never shared with anyone, and never used to make decisions for you beyond the actions described above.
Before Deralba asks you to turn the service on, the app explains what it can and cannot see. You decide whether to turn it on. Deralba cannot work without it, because the gate depends on it.
Display over other apps
Used to draw the gate, the maze and session screens on top of a guarded app.
Notifications
Used for gentle reminders, such as writing tomorrow's list in the evening. You can turn notifications off at any time.
Visibility of installed apps
Used to show you the apps on your device so you can choose which ones to guard. The list is read on your device and is not stored or shared.
6. What we don't do
- We don't send your usage, tasks or history to any server.
- We don't include advertising, analytics or crash-reporting services in the app. The app connects to three places only: our server, for your account and subscription, and Google Play and RevenueCat, for purchases.
- We don't sell or rent personal data, and we don't share it with anyone except the providers in section 4, for the purposes described there.
7. How your data is kept safe
- Everything Deralba records on your phone is kept in the app's private storage, which Android isolates from other apps, and is excluded from device and cloud backups.
- All connections between the app, this website and our server are encrypted.
- On our server, access rules let each account read only its own records. Changes are made only through a small set of checked operations. Passwords are stored only as one-way hashes.
- The keys that can change server data never appear in the app or on this website.
- The emails we receive are read only by the developer.
8. Keeping and deleting your data
On your phone: to delete everything Deralba records, use Delete all data in the app's settings, uninstall the app, or clear its storage in your device settings. Because this data never reaches us, we cannot restore it for you.
Your account: delete it in the app, or at deralba.com/delete-account. This immediately and permanently deletes your account, your language setting, the list of phones signed in to it and your subscription record, and removes your record at RevenueCat. Deleting your account does not cancel your Google Play subscription; to stop payments, cancel it in the Play Store under Subscriptions.
The waitlist: every email we send has a link to leave the list, after which we send you nothing more. To have your address removed completely, write to support@deralba.com.
9. Purchases
Subscriptions are sold and billed by Google Play under its own terms and privacy policy. We never receive your card or payment details. When you buy or restore a subscription, the app passes the purchase record Google Play gives it to RevenueCat, together with a random account ID. RevenueCat confirms the purchase with Google Play, and our server asks RevenueCat whether that subscription is active. Google Play tells RevenueCat, and RevenueCat tells our server, when a subscription renews, is cancelled, runs into a payment problem or ends. Google may collect technical information about the purchase and its billing library, as described in Google's privacy policy.
10. The waitlist and this website
deralba.com uses no analytics, no advertising and no third-party fonts. Its own scripts run the animations and the forms on the page and collect nothing else. The site is hosted by Cloudflare, which processes technical information such as IP addresses and browser details in order to deliver the site and protect it from abuse.
The waitlist form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is signing up. It runs invisibly and is loaded only when you start using the form. To do this, Turnstile processes information such as your IP address, your browser's user agent and technical signals from your browser, and may use cookies that are strictly necessary for bot detection. It is not used for advertising or to track you across sites. Cloudflare's processing is described in the Cloudflare Turnstile Privacy Addendum.
The account deletion page sends the email address and password you enter directly to our server over an encrypted connection to confirm it is you. It does not store them.
11. When you email us
If you write to us, we receive your email address and whatever you choose to include in your message. We use it only to reply to you, and delete the conversation within 12 months of our last reply, unless you ask us to delete it sooner. Email to deralba.com is delivered through Cloudflare's email routing to a mailbox provided by Google.
12. Legal bases
Where laws such as the EU and UK GDPR or Türkiye's KVKK apply, we process personal data on these grounds:
- to provide the service you signed up for: your account, your phones and your subscription;
- your consent: the waitlist, which you can leave at any time;
- our legitimate interest in keeping the service secure and free of abuse: bot protection, rate limits and technical logs.
13. Children
Deralba is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child under 13 has given us personal data, write to us and we will delete it.
14. Your rights
Depending on where you live, laws such as the EU and UK General Data Protection Regulation and Türkiye's Personal Data Protection Law (KVKK) give you rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority.
You can view and delete the data on your phone yourself, and delete your account yourself at any time. For anything else, including a copy of what our server holds about you or emails you have sent us, contact support@deralba.com and we will respond within 30 days.
15. Changes to this policy
If this policy changes, we will update the date at the top of this page. If a change affects how your data is handled, we will also tell you in the app before it takes effect.