privacy

the short version

bodhilock is built to be quiet — with your attention and with your data. we collect only what the app needs to work: your meditation sits, the lock schedules you set, your onboarding answers, and your subscription status, tied to an anonymous account. we don't ask for your name or email to use the app, we don't use advertising trackers, and we never sell your data. you can delete everything from within the app at any time.

who is responsible for your data

the person responsible for your data (the "controller") is:

maximilian hug
stückistrasse 11, 6442 gersau sz, switzerland
support@bodhilock.com

what we collect

when you use the bodhilock app, we store the following, tied to an anonymous account id (not to your name or email):

• your meditation sits — for example when a sit happened, how long it lasted, and any mood you choose to log
• the lock schedules and settings you create
• your onboarding answers and in-app actions, so the app can set itself up and we can understand how features are used
• your subscription status — whether you have an active subscription or trial
• a device token, if you turn on notifications, so we can send the reminders you ask for

the apps you choose to lock are handled on your device through apple's screen time framework. bodhilock stores your selection as an opaque reference provided by apple — we cannot see which specific apps you picked, and we cannot see your activity inside them.

if you join the early-access or update list on this website, we store the email address you give us, and use it only to contact you about bodhilock.

what we do not collect

we do not access your name, contacts, location, browsing history, microphone, camera, photos, or apple health data. we do not use third-party advertising or cross-app tracking, and we do not sell or rent your data to anyone.

why we use your data, and on what basis

we use your data to provide bodhilock and keep it working — saving your practice, running your lock schedules, managing your subscription, and sending any notifications you've enabled. for users in the eu/eea and uk, our legal bases are: performing our agreement with you (to provide the app), your consent (for example, optional notifications and the early-access email), and our legitimate interest in keeping the app secure and improving it.

who else processes your data

we use a small number of service providers who process data on our behalf, under contract:

• supabase — hosts our database and the anonymous account, and stores the data described above
• revenuecat — manages subscriptions; it receives your anonymous account id and your purchase and subscription status
• apple — processes any purchase you make through the app store; apple handles the payment and we never receive your card details
• resend — sends email, where email is used (for example the early-access list)

our database is hosted by supabase in the united states (us-east-1), and some of our other providers are also based in the united states. this means your data is stored and processed outside switzerland and the eu/eea. where we transfer data to the united states, we rely on appropriate safeguards — such as the european commission's standard contractual clauses — to protect it.

how long we keep it

we keep your data for as long as you use bodhilock. when you delete your account, the associated data is deleted. we may keep limited records where the law requires it — for example, basic records of a transaction.

deleting your data

you can permanently delete your account and all of its data from within the app at any time (settings → delete account). you can also email us at support@bodhilock.com and we'll delete it for you. note that subscriptions are managed by apple — deleting your account doesn't cancel a subscription; you can cancel that in settings → apple id → subscriptions.

your rights

depending on where you live, you have rights over your data — including the right to access it, to correct it, to delete it, to restrict or object to its use, and to receive a copy in a portable form. where we rely on your consent, you can withdraw it at any time. to exercise any of these, email support@bodhilock.com.

if you're in switzerland, you can also contact the federal data protection and information commissioner (fdpic). if you're in the eu/eea, you can lodge a complaint with your local data protection authority.

children

bodhilock isn't directed at children under 16, and we don't knowingly collect their data. if you believe a child has used the app, contact us and we'll remove the data.

changes

if this policy changes, we'll update the date above and post the new version here.

contact

questions about your privacy? email us at support@bodhilock.com.