Privacy Policy
Last updated: June 28, 2026
Pawl is a self-control tool that helps you stop something you're struggling with — gambling, adult content, or any distracting app — by blocking it with Apple's Screen Time and making it deliberately hard to unblock. This policy explains what Pawl does and doesn't collect, how the small amount of data we do handle is used, and how you can delete it.
The short version. Pawl works without an account, and most of your data never leaves your iPhone. We never see which specific apps or websites you block. We don't use advertising, we don't track you across other apps, and we never sell your data. If you create an account, you can delete it and everything tied to it from right inside the app — Settings → Account → Delete account.
1. Who this applies to
This policy covers the Pawl iOS app and the website getpawl.com. Pawl is intended for
adults (17+). It is not directed to children.
2. What Pawl never sees
Pawl blocks apps and sites using Apple's Screen Time / Family Controls framework. Apple hands the app only opaque tokens that stand in for your selections — Pawl cannot read, and never receives, the identities of the specific apps or websites you choose to block. Your blocking choices are not transmitted to us.
3. Data that stays on your device
When you use Pawl without signing in, the following stays on your iPhone (and, where you've enabled it, your own private iCloud) and is not sent to us:
- Your clean-day streak and history.
- Your relapse log and urge/“tough moment” entries.
- Your blocking selections (as opaque Screen Time tokens), friction settings, and the optional “someone you trust” phone number.
You can remove this by deleting the app (see Section 9).
4. Data we collect only if you create an account
Signing in is optional and only needed for the sponsor / accountability feature. Account sign-in uses Sign in with Apple. If you sign in, we store the following in our backend (hosted on Supabase) to provide the feature:
| Data | Why |
|---|---|
| Apple user identifier | Identifies your account so your data and sponsor link persist across launches. |
| Email address (from Apple; may be Apple's private relay) | Account identity and contact. You can use Apple's “Hide My Email.” |
| Display name (optional, you type it) | So your sponsor sees it's you rather than “Someone you sponsor.” |
| Sponsor link + unlock requests | Lets a trusted person approve your unlock requests. |
| Heartbeat + device push token, device identifier | Detects if your protection is removed and alerts your sponsor; delivers notifications. |
| Commitment status & friction settings | Keeps your setup in sync; lets the sponsor feature work. |
Sensitive by nature. The fact that you use Pawl can imply you're working on a gambling, adult-content, or focus problem. We treat your information as sensitive. Your relapse and urge entries are private to you — they are never shared with your sponsor. A sponsor only ever sees your display name, your unlock requests, and alerts that your protection was removed.
5. How we use data
- To provide the optional sponsor/accountability feature and send the related notifications.
- To keep your account and setup working across devices and reinstalls.
- To keep the service secure and operational.
We do not use your data for advertising, we do not track you across other companies' apps or websites, and we do not sell or rent your personal data.
6. Who we share data with
- Your chosen sponsor — only your display name, unlock requests, and protection alerts, and only while the link is active. Never your relapse/urge log.
- Service providers that run the backend on our behalf: Supabase (database and authentication) and Apple (Sign in with Apple and push notifications). They process data only to provide their service to us.
- No advertisers or data brokers.
7. Where data is stored and how it's protected
Account data is stored in our Supabase Postgres database, protected by row-level security so each person can reach only their own rows (and a sponsor only the limited fields above). Data is encrypted in transit. Push tokens and the Apple sign-in token are accessible only to our secure server functions.
8. Retention
We keep account data for as long as your account exists. When you delete your account, the associated data is deleted (see below). On-device data is kept until you remove it.
9. Your choices and rights — including deleting your account
You can request access to, correction of, or deletion of your personal data. You also have a built-in, one-tap way to delete everything:
Delete your account from inside the app:
Open Pawl → Settings tab → Account → Delete account → confirm. This permanently and immediately deletes your Pawl account and all data tied to it — profile, sponsor link, unlock history, devices, heartbeats, and alerts — and revokes Sign in with Apple. It cannot be undone. (Your on-device protection and streak remain on your iPhone; remove those by deleting the app — Section 9 below.)
If you can no longer access the app and want your account deleted, email us at the address below from the email associated with your account and we'll delete it.
Removing on-device data
To remove the data Pawl keeps on your iPhone: open Settings → Screen Time, turn off Screen Time (or remove Pawl under “Apps with Screen Time Access”), then delete Pawl from your Home Screen.
10. Children
Pawl is not directed to children and is rated 17+. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we'll delete it.
11. Changes to this policy
If we make material changes we'll update the date at the top and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.
12. Contact
Questions, requests, or account-deletion help: privacy@getpawl.com.