Privacy Policy

As of: 1 October 2026. The German version is the authoritative one; this English text is a courtesy translation.

1. Who is responsible

Send any data protection question and any of the rights in section 9 to that address. The full details are in the Imprint.

2. The short version

• Screenshame shows your friends how long you used your phone that day, and shows you the same about them. That is the purpose of the service, not a side effect.
• Friends see your daily total, your rank, your limit and your streak. Nobody in the app except you sees which apps you used; the one exception outside the app is the support copy of section 6, and only while your account is flagged for support.
• Your per-app times are nevertheless held on our server and not only on your phone. Why, and what follows from it, is in section 3.3.
• There is no advertising, no analytics tooling and no tracker, neither in the app nor on this website.
• We do not collect location, contacts or health data.
• You can delete your account in the app at any time. Your days, your friendships and your chats are then gone for good.

3. What data we process

3.1 Account and sign-in

You sign in through Apple or Google; there is no password of ours. We store the identifier the provider knows you by and the email address it tells us it has verified (Apple often sends it only the first time). That email address is used only to help with account problems and is shown to nobody in the app. Added to that are your display name, your username, by which friends find you, and, if you upload one, your profile photo together with a colour computed from it. If you sign in with Apple, your phone also hands us a one-time code, which our server exchanges at Apple for a token that lets it withdraw Screenshame's access to your Apple ID when you delete your account; we store that token encrypted and use it for nothing else.

3.2 Session and device

We keep your sign-in as a session. We do not store the session secret itself, only a non-reversible check value of it. The app also creates an installation identifier once and puts it in your phone's protected storage; we store it with your account, because only one phone may report for you at a time.

3.3 Screen time, including per app

For each calendar day we store your total duration, your time zone, the source (the Shortcut on the iPhone or usage access on Android) and the times at which the value was reported or corrected.

We also store, for every day, every single app with its name as your phone reports it, and its duration. This happens so that limits for individual apps and your history survive a new phone or a reinstall. No other person in the app sees these rows: not your friends, not the members of your groups. The operator's admin interface shows no screen time either, neither totals nor apps. On an iPhone that still runs the older Shortcut we store only the day's total, no app, and we have deleted the per-app rows and readings that Shortcut had sent before. The first time your iPhone runs the current Shortcut, we delete every day your iPhone had reported, totals included, and read the last four weeks again.

On an iPhone with the current Shortcut we also store, with each of these rows, the app's bundle identifier, the technical name Apple gives the app (for example com.apple.AppStoreConnect). It tells two apps with the same name apart and finds the app's icon. It says as much as the app's name and is treated exactly like it. We also keep every reading of the current Shortcut and of an Android phone as it arrived: its rows, names, durations and bundle identifiers, when it was read and what the server did with it, and not only a day's newest reading. That is because iOS forgets the rows of apps deleted since, so a day's earliest readings are its most complete.

Websites. With a current app, the Shortcut also hands the app the websites Screen Time lists for a day (for example youtube.com), each with its duration. The app sends them to our server with the day's apps, and the server discards them unread the moment the reading arrives: they are not stored with the day, not in any reading kept as it arrived, not in the support copy and not in any log, and they count towards nothing, because time on a website is already part of the browser's. They are sent only so that a later version can use them without a new app; before our server keeps a single one, this page will say so. On your iPhone they wait with the day's apps in the app's storage until the app has sent the day, and are deleted with them.

The names of the apps somebody uses can amount to special categories of personal data within the meaning of Art. 9(1) GDPR: an app of a religious community, a dating app or a symptom diary permit conclusions about religion, sex life or health.

Only with your explicit consent. The per-app times are the core of Screenshame, so your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR is the condition of using the app. It covers our receiving and storing every app you use with its name, bundle identifier and duration, and our using all of your data in aggregated, anonymous form for statistics and comparisons among users. We record when and in which version you gave it. You can withdraw it at any time in the app under You, Privacy; we then delete your account with all of its data. The lawfulness of the processing before the withdrawal is not affected (Art. 7(3) GDPR). In the app only you see the per-app times, friends see your totals; the exception is the support copy of section 6.

The numbers are what your phone reports about itself. We check them for plausibility and note anything odd internally; such a note changes nothing about what friends see, and is never the basis of a penalty or a payment.

3.4 Friends, groups, blocks

We store who you are friends with, friend requests (including declined ones), invite codes that were redeemed, who you have blocked, and your groups with their name, photo, limit, members, roles and invitations (including declined ones). If somebody has blocked you and you delete your account, we keep, for that person and for at most twelve months, a keyed hash of the identifier Apple or Google knows you by: a value that cannot be turned back into that identifier and serves only to make their block apply again if you sign up once more with the same Apple or Google account.

3.5 Limits and what friends learn about them

We store your limits, when you passed one or kept to one for a week or a month, what we told your friends about that, and your setting for which friends you want to be notified about. The other side never sees that setting.

3.6 Chat

We store messages (up to 2000 characters) with their sender and time, plus read markers, messages you hid for yourself, and reports with their reason. A simple word filter refuses particular wordings. If you delete a message for everybody, we remove it completely; what a recipient has already read, or what has already been delivered as a notification, we cannot take back. We treat display names, group names and photos as content, because people can write into them whatever they like. You can report a person's or a group's name or photo; the report keeps its reason and the name as it was when reported, so that we can judge it even if it is changed back, and it is deleted with your account, with the account reported, or with the group.

3.7 Notifications to your phone

If you allow notifications, we store your phone's push address, the operating system, the language, which kinds of notification you switched off, and which version of the app's notifications it registered with. If your phone has sent no screen time for so long that days are about to fall out of what it can still read, we remind you at most twice and record which reminder went on which day. What a notification contains and where it goes is in sections 6 and 7.

3.8 Security log

We log security relevant events (failed sign-ins, reports and deletions, for example) with their time, their kind and, where there is one, your account identifier. No app name, no bundle identifier and no website appears in any log. The server writes the same lines into the machine's system log.

3.9 What we do not collect

Location, contacts, health data, advertising identifiers, crash reports to third parties. The app asks for your date of birth once, to check the minimum age; it does not leave your phone and is not stored there either. All that is stored on your phone is the fact that the check was not passed.

4. Purposes and legal bases

Providing the data in 3.1 to 3.3 (the total) is necessary for the contract: without it there is no leaderboard. The consent to the per-app times is the condition of using the app (3.3). The photo and the notifications are voluntary. No automated decision within the meaning of Art. 22 GDPR takes place.

We use the data of all users in aggregated, anonymous form for statistics and comparisons, for example "in the lowest 10 percent": the daily totals under Art. 6(1)(b) GDPR, the per-app times on the basis of your consent.

5. Who sees what about you

• Friends (mutually confirmed): display name, photo, daily total and rank, limit, streak, the head to head comparison, how fresh your last reading is, and the chat you share. They learn when you pass a limit or change one. If you stop reporting, you appear as stale and without a rank. If you remove a friend, they lose your past days as well.
• Members of your groups who are not your friends: display name, photo, role, daily total, average, the group's limit and the group chat. If you leave a group, the seeing ends from that moment; what members saw until then cannot be unseen. This promise is weaker than the one among friends, and we say so here explicitly. Who may open your profile is your own choice: members of your groups by default, and you can narrow it to your friends in the settings, after which group members see the group's board and nothing more. For friends the setting changes nothing.
• Blocked people see nothing of you, and you nothing of them. If you share a group, you both stay in it, and neither of you sees the other on its board, their messages in its chat or notifications about them; its member list still shows the name, so that an admin can remove the person, and the total of a shared group still counts everybody.
• Everybody else signed in to Screenshame, strangers included: your display name, your username and your photo. That is your card, which anybody sees who has your username, opens a link you shared, or meets you in a request, a group or a chat; to the two of you it also says whether a friend request is waiting. Nothing more: no number, no limit and no app.
• Which apps you used is seen by none of these groups.

6. Recipients

What a notification contains. So that a notification is readable on the lock screen, its text goes to Apple or Google in the clear: the sender's display name and the beginning of their message (up to 120 characters), the display name of a friend or of a member of your group, the period and size of a limit, the name of a group, and notices the operator writes himself. Never contained is the name of an app. If it names somebody whose photo you may see, it also carries a link through which your phone fetches that photo from us, valid for as long as the notification may still be delivered (at most seven days and ten minutes); Apple and Google receive the link, never the photo. If it is about a group you are in or are invited to, it carries that group's colour and initials and, if the group has a photo, a link of the same kind to it. Your phone then shows the photo, or the group's picture, in place of the app's icon and, as it does for messengers, keeps that name and picture among its conversations and suggestions (on Android also as one of the app's shortcuts) until the system removes them. The providers hold the notification until it is delivered or has expired.

The support copy. If you ask for help and the problem cannot be settled another way, the operator can flag your account for support. The server then builds a copy of all of your data that an AI programming assistant on the server may read: account and email address, phones and sessions, daily totals, the per-app times with their bundle identifiers and every reading kept as it arrived, friendships, groups, limits, log lines and your chats, group chats included from the moment you joined. A chat has another side to it: your conversation partner's messages are then in that copy too, although their account was not flagged. Never in the copy: push addresses, the check value of your session, the identifier Apple or Google knows you by, the Apple token of 3.1, and photos. The server also keeps one copy of it a day for 14 days. When the flag ends, or you delete your account, your account leaves the copy and every daily copy holding it at once. Without a flag, no such copy of your account exists. There is no contract under Art. 28 GDPR with the provider of that assistant for this use: the operator uses it as a tool of his own.

Without personal data, these work for us: Cloudflare (only name resolution for the domain, with no traffic passing through it), GitHub (source code), Apple's public iTunes lookup (our server asks it for an app's icon by the app's bundle identifier alone, never with anything about you or your phone; your phone never asks Apple for it), and the app stores of Apple and Google, from which you obtain the app and which have their own privacy notices for that. The server sits on a machine that the controller also uses for a second product of his own; the two are walled off from each other by separate user accounts, databases and services.

7. Transfers to the United States

Apple, Google, Expo and Anthropic are based in the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework, we base the transfer on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR), and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Which of the two instruments actually carries the transfer has not yet been established and filed for each recipient; once it has, it will stand here beside that name.

8. How long we keep things

Your days, friendships, limits and chats are your history in the app and stay for as long as your account exists. If you delete your account, we delete everything hanging from it in one step and at once: days, per-app times, friendships, group memberships, limits, chats, push addresses, sessions, photo, and the Apple token of 3.1, whose access we also withdraw at Apple. Lines of the security log remain, but name nobody afterwards. One thing outlives the account, and only if somebody had blocked you: the keyed hash of 3.4, for at most twelve months.

Every night an encrypted copy of the database and of the server's settings goes to a storage service of our host at the same German site (section 6). It exists only to restore the service after a failure, and nobody reads it otherwise.

9. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing we base on Art. 6(1)(f) (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)).

• Deleting is something you can do yourself: in the app under "You", "Delete account". The route without the app is on the Delete your account page.
• Access and a copy of your data are yours in the app, under "You", "Export data": "All my data (GDPR)" puts everything we hold about you into one archive, with the information Art. 15 requires beside it, made on your phone and handed to your phone's share sheet; "Screen time" exports your screen time alone, for a timeframe you choose, as TXT, JSON, CSV or XLSX. You can also ask at the address in section 1, and we answer in a common machine readable format within one month.
• A complaint can be lodged with any data protection supervisory authority, for example with the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart (Postfach 10 29 32, 70025 Stuttgart), poststelle@lfdi.bwl.de.

10. Minimum age

Screenshame is for people aged 16 and over. The app asks for your date of birth and lets nobody under 16 in; that is a self declaration, not an age verification. Parents, teachers and anybody else can report an account to us that belongs to a younger person: a message to the address in section 1 is enough, and we demand no proof for it. We disable and delete such an account.

11. This website

This website sets no cookies, loads no fonts, scripts or images from other servers, and contains no analytics or advertising tooling. When it is called up, the web server processes your IP address, the time, the path requested (without anything after a question mark, and without a username in it) and the status of its answer, as is technically necessary, and writes them into an access log (Art. 6(1)(f) GDPR: operation and security of the server).

The page a shared link opens (screenshame.de/?add=username) also reads the browser identification (user agent) every browser sends with a request, only to tell an iPhone or an Android phone from a computer: once we have set an address for that store, a phone is sent on to the App Store or to Google Play, on Android through the app if it is installed, instead of being shown the page. The redirect stores nothing, and the store is not told which username the link named.

12. Changes

If what we process or where data goes changes, we change this policy beforehand and name the new date above. For material changes we point them out to you in the app.