privacy policy

the short version

holdup is built to keep your data on your phone. the app stores your blocked apps and your checklist locally on your device using apple's screen time framework. there is no holdup account, no login, and nothing about how you use the app is sent to us. the only thing we ever collect is the email you type into the waitlist form on this website — and only if you choose to.

what the app stores

your list of blocked apps and your daily checklist are saved on your device through apple's screen time (family controls / managed settings) framework. apple designed this framework so that the specific apps you select are not exposed to developers like us, and that data does not leave your phone. holdup has no server that receives your app usage, your checklist, or which apps you blocked.

• no account or sign-in.
• no copy of your checklist or blocked-app list on our servers.
• no third-party analytics or advertising trackers in the app.

what this website collects

if you submit the waitlist form, we store the email address you entered, plus basic technical details your browser sends with the request (the page source label, your browser's user-agent string, and the referring page). this lets us email you when holdup is ready to try and helps us understand which page you signed up from.

that information is stored using cloudflare (cloudflare d1, a database hosted on cloudflare's infrastructure). when a signup comes in, an automated notification email is sent to us through an email service so we know someone joined. we do not run third-party analytics or ad tracking on this site.

how we use your email

we use your email for one thing: to tell you about holdup's availability (for example, when the testflight beta or the app store release opens). we will not sell it, rent it, or hand it to advertisers.

the partner feature (in the app)

holdup has an optional paid feature where you name a partner who can unlock an app you've put behind them. when you set this up, the app sends two things to our server: your partner's email address and an anonymous device id (a random string tied to your phone, not your name or account — because there is no account).

we use your partner's email for exactly one thing: to send them a one-time, 6-digit unlock code through our email provider (resend). we do not store their email — it's used once to send that email, then thrown away.

what we do keep, tied to your anonymous device id: a scrambled (hashed) version of the code, not the code itself, plus when it expires. codes expire after 15 minutes and can only be used once. to keep the feature from being spammed, we also limit how often codes can be requested — no more than one every 60 seconds, and no more than 10 in a day, per device.

nothing about your screen time or which apps you've blocked ever leaves your phone for this feature either. no names, no analytics, no ad tracking.

if your partner wants their email address (or the record of a request) deleted, or you want your device's data cleared, email [email protected] and we'll take care of it.

your choices

you can ask us to delete your email from the waitlist at any time — just email [email protected] and we'll remove it. because the app keeps everything on your device, you can clear the app's data by deleting the app from your phone; nothing about that data exists on our end to delete.

children

holdup is not directed at children under 13, and we do not knowingly collect personal information from them.

changes

if we change how holdup handles data, we'll update this page and the date at the top. for anything material, we'll do our best to give you a heads-up.

contact

questions about privacy? email [email protected].