Privacy Policy

Attenya is private by design. The app has no user accounts, no advertising and no analytics or tracking SDKs. What you do in the app is stored on your device and is not sent to us. This policy explains when personal data is processed around the app: if you email us, buy through Apple, visit this website or our social media profiles, or join a beta. It is written to meet the EU General Data Protection Regulation (GDPR) and comparable laws, such as the UK GDPR and the Swiss Federal Act on Data Protection (FADP).

1. Who is responsible

The controller is Laurenz Zuser, sole proprietor (Einzelunternehmen), Dorotheergasse 6–8, 1010 Vienna, Austria. Email: support@attenya.app. Further provider details are in the Imprint. We are not required to appoint a data protection officer and have not done so.

2. The short version

• The app keeps your selections, progress and settings on your device. They are not transmitted to us. Apple’s Screen Time gives the app only opaque tokens for the apps you protect, not a readable list.
• No account, no ads, no tracking, no analytics SDKs. We do not sell or share personal data.
• We process personal data only when you email us or use the contact form, when you buy through Apple (Apple handles the payment), when you visit this website or our social media profiles, or if you join a TestFlight beta. Each case is explained below.

3. Data in the app on your device

3.1 What the app stores

The app stores the following on your device, in a storage area that only Attenya’s own extensions (widgets and Screen Time extensions) can also use:

• your protected-app selections as Apple Screen Time (FamilyControls) tokens, including those in profiles and schedules;
• your balances, vault and crystallized totals, focus sessions, activity history, progress statistics and goals;
• content you choose to enter, for example notes, categories or subjects, goals, names, dates and answers to in-app questions;
• your schedules and settings, and a cached copy of your Pro status; a current protection-selection warning stores only aggregate counts and repair context, and is cleared when resolved or reset;
• a small record of which Terms of Use and Privacy Policy versions you accepted (version, date, app build and language — no email address, Apple ID, IP address or identifier assigned by us);
• a small technical event log (at most 256 KB, excluded from device backups) that helps with troubleshooting on your device.

This data is processed by the app on your device. We have no access to it, and it is not transmitted to us. Please do not put sensitive information into free-text fields. Storing this data on your device is strictly necessary to provide the features you use (§ 165(3) Austrian Telecommunications Act 2021 / Art. 5(3) ePrivacy Directive), so no consent is required.

3.2 Screen Time

With your permission, Attenya uses Apple’s Screen Time frameworks (FamilyControls, ManagedSettings, DeviceActivity) to block and unblock the apps you choose. Apple gives the app opaque tokens instead of app names. The screen that appears when you open a protected app is drawn by an Attenya extension. iOS lets that extension see the blocked app’s name inside a sandbox that cannot send it anywhere. Attenya does not store or send app names.

3.3 Notifications, widgets, Live Activities and Siri

If you allow notifications, Attenya schedules them locally on your device; we run no push server. Widgets and Live Activities show information such as your balance or a running timer on your Home Screen and Lock Screen, so people near your device may see it. If you use Siri or Shortcuts, Apple processes your request under Apple’s privacy policy. Rating prompts are shown by Apple.

3.4 Device backups

Depending on your settings, app data (except the technical log) may be included in an iCloud Backup or an encrypted computer backup. These backups are controlled by Apple and your own device settings, outside the app’s control. They do not give us access to your data, and the data is not transmitted to us. You can manage or turn off backups in your device settings.

3.5 Exports and sharing you start

If you export your activity (for example as a CSV file) or share a recap, report or diagnostics file, the data goes wherever you choose to send it. We receive it only if you send it to us.

3.6 Deleting app data

Use the in-app reset (“Settings → Data → Reset all data”) or delete the app. Some histories are limited in size; the oldest entries are then removed automatically.

4. Support and email

4.1 What we process

If you email us, for example through “Settings → Help & feedback → Report a problem”, we process your email address, the name your email app shows, your message, any attachments and the technical metadata of the email.

4.2 Optional diagnostics

“Report a problem” pre-fills a short diagnostics summary. It contains only: app version and build, iOS version, device type (e.g. “iPhone”), language and region setting, whether Pro is active, whether Screen Time access is granted, whether a selection exists and its app, category and website counts, whether Deep Focus is enabled, its saved selection counts and whether its overlay is currently eligible, the combined effective selection counts, any current selection-limit warning and whether protection is currently relaxed, whether protection settings were fully applied (not proof of system enforcement), whether a focus session is running or paused or an unlock is running, the number of schedules, the last technical error code and the time the report was created. It contains no app names, no Screen Time tokens, no balances and no activity history. Nothing is sent automatically: your email app opens, and you can review, edit or delete everything before sending. Together with your email address, the diagnostics relate to you while we handle your request.

4.3 Our email provider

Emails to support@attenya.app are received and stored by our email provider Zoho Corporation B.V. (Netherlands), which acts as our processor under a data processing agreement (Art. 28 GDPR) and stores the messages in its EU data centres. Your own email provider processes your message on your side under its own terms.

4.4 Purpose and legal basis

Purpose: answering your request and fixing problems. Legal basis: Art. 6(1)(b) GDPR where your request concerns your use of the app or a purchase; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering your request, fixing errors and improving the app.

4.5 Retention

We keep support emails only as long as we need them to handle your request and normally delete them within 12 months after it is resolved, unless a statutory retention duty applies or we need them to establish, exercise or defend legal claims.

4.6 Contact form

Instead of emailing us, you can use the contact form. We process the email address you enter, your name if you give it, your message and the language of the page. The form is sent to a function on Cloudflare (our processor, Section 6) and delivered from there to our support inbox at Zoho (Section 4.3) through Scaleway Transactional Email, operated by Scaleway SAS, Paris, France, which acts as our processor and processes the data in the EU. The form stores nothing itself, and we do not log the content of your message. Your IP address is processed by Cloudflare as described in Section 6. A hidden field that people do not see helps us filter out automated spam; no captcha and no third-party script is used. Purpose and legal basis, retention: as for support emails (Sections 4.4 and 4.5). Scaleway keeps delivery records only for a limited period under its data processing agreement.

5. Apple: App Store, purchases and betas

5.1 Download and purchases

Attenya is distributed through Apple’s App Store. Attenya Pro is available as an auto-renewable subscription or as a one-time purchase through Apple’s In-App Purchase. Apple processes the payment — depending on your country as commissionaire, reseller or merchant of record — and is an independent controller for the download, the purchase, refunds and its family and parental settings (such as Family Sharing and Ask to Buy). We never receive your payment details. The app checks your purchase status on your device using Apple’s StoreKit. Legal basis for our part: Art. 6(1)(b) GDPR (contract). Apple’s privacy policy applies to Apple’s processing.

5.2 Reports from Apple

From App Store Connect we receive sales and usage reports in aggregated form and, only if you have allowed Apple to share them with developers, crash reports and app analytics that do not identify you. If we advertise the app with Apple Ads, Apple runs the ads under its own privacy policy and we receive only aggregated campaign reports.

5.3 Ratings and reviews

If you rate or review Attenya, Apple publishes it. We see your App Store nickname and your text and may reply publicly.

5.4 TestFlight betas

If you join a TestFlight beta, Apple provides us with your name and email address (if we invited you by email), your device and iOS version, crash reports, and any feedback and screenshots you submit. We use this only to run the beta and fix problems (Art. 6(1)(b) and (f) GDPR) and remove it when the beta ends or you leave it. Apple is an independent controller for TestFlight itself.

6. This website

This website is hosted on Cloudflare Pages by Cloudflare, Inc. (USA), which also provides the DNS for our domain. Cloudflare acts as our processor. To deliver the site and protect it against attacks, Cloudflare processes connection data such as your IP address, the time, the requested page, your browser and device type (user agent) and the HTTP status. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and reliable website. Cloudflare keeps this data only for a short period under its own retention rules (typically 7–30 days).

From these connection data, Cloudflare provides us with aggregated traffic statistics, such as the number of requests and visits, countries and the pages requested. We see them only in aggregated form and cannot identify individual visitors from them. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding how the site is used and keeping it working. No analytics script runs in your browser, and we use no tracking pixels and no third-party content: fonts and images are served from this site. We set no cookies and use no browser storage (see Section 16). Links to other sites, such as the App Store, take effect only when you click them; that site’s privacy policy then applies.

7. Our social media profiles

We run profiles on Instagram and TikTok (@attenya.app). If you visit or interact with them, the platform operator processes your data under its own terms and privacy policy. We see only what is public or what you send us (for example comments or messages) and aggregated statistics. For the statistics a platform provides to us, we may be jointly responsible with the platform operator (Art. 26 GDPR; for Instagram, Meta Platforms Ireland Ltd.). The platform operator handles requests about its own processing; you can also contact us. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in presenting our app and talking with you.

8. Recipients

• Apple (App Store, In-App Purchase, TestFlight, Siri, iCloud Backup) — independent controller.
• Cloudflare, Inc. (website hosting, DNS) — our processor.
• Zoho Corporation B.V. (support email) — our processor.
• Scaleway SAS (delivery of contact-form messages) — our processor.
• Meta (Instagram) and TikTok — independent controllers for their platforms; possibly jointly responsible with us for page statistics (Section 7).

We do not pass personal data to anyone else, and we do not sell it. We disclose data to authorities only where we are legally required to (Art. 6(1)(c) GDPR).

9. International transfers

Some recipients process data outside the EU/EEA:

• Cloudflare, Inc. (USA) is certified under the EU–US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. Cloudflare additionally uses the EU Standard Contractual Clauses.
• Zoho stores support emails in the EU. Limited access from outside the EEA, for example by Zoho support staff, is covered by the EU Standard Contractual Clauses.
• Scaleway processes contact-form messages in the EU; no transfer to third countries.
• Apple and the social media platforms process data as independent controllers under their own safeguards.

You can ask us for a copy of the safeguards we rely on at support@attenya.app.

10. How long we keep data

• App data on your device: until you reset or delete the app; some histories are capped automatically.
• Device backups: according to your Apple and device settings.
• Support emails: as long as needed; normally deleted within 12 months after your request is resolved, unless statutory retention duties or legal claims require longer.
• Website connection data: short-term at Cloudflare, typically 7–30 days.
• TestFlight data: until the beta ends or you leave it.
• Payment and billing data: we hold none; Apple handles payments.

11. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability (Art. 15–20 GDPR). To exercise these rights, email support@attenya.app. We reply within one month and may ask you to confirm that the request comes from you, for example by replying from the same email address. Data stored only on your device is not available to us; you can view, export or delete it yourself in the app.

11.1 Right to object (Art. 21 GDPR)

Where we process your data based on legitimate interests (Art. 6(1)(f) GDPR) — website connection data, support emails and social media — you can object at any time on grounds relating to your particular situation. An email to support@attenya.app is enough.

11.2 Right to lodge a complaint

You can complain to a data protection supervisory authority. In Austria this is the Österreichische Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority in the EU/EEA country where you live or work; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

11.3 No obligation to provide data

You are not required to give us personal data. The app works without it. If you do not email us, we simply cannot reply to you.

12. What we do not do

No advertising in the app, no advertising identifiers, no tracking across apps or websites, no data brokers, no sale or sharing of personal data, no profiling and no automated decision-making with legal or similarly significant effects (Art. 22 GDPR). That is also why the app never shows Apple’s App Tracking Transparency prompt. Scores and statistics in the app are calculated on your device, only for you.

13. Children

Attenya is a general-audience app. It is not directed at children under 13, and the app itself collects no personal data from anyone. Use and purchases by minors are governed by Apple’s family and parental settings (such as Family Sharing, Ask to Buy and Screen Time). If you are a minor, please ask a parent or guardian before you email us. If we learn that a child under 13 has emailed us without a parent’s consent, we will use the address only to reply once where the law allows it and then delete the message.

14. California and other US states

Because of our size, the obligations that the California Consumer Privacy Act (CCPA/CPRA) places on “businesses” do not apply to us. We still follow its core principles: we do not sell or share personal information, we do not use sensitive personal information, and we do not use personal data for targeted advertising. You can ask us what personal information we hold about you and ask us to delete it at support@attenya.app; we will not treat you differently for doing so.

Do Not Track. This website and the app do not track you across other websites or apps. They therefore do not respond differently to “Do Not Track” or Global Privacy Control signals: there is nothing to switch off.

15. Changes to this policy

We update this policy when the app, our providers or the law change. The current version and its date are shown at the top of this page; earlier versions are available under “Previous versions”. For material changes we will also inform you in the app.

16. Cookies and similar technologies

We set no cookies of our own and use no browser storage (such as localStorage). Under our current Cloudflare configuration, Cloudflare sets no cookies either. If we ever turn on a Cloudflare security feature, such as bot protection or challenges, Cloudflare may set strictly necessary security cookies, for example __cf_bm (about 30 minutes) or cf_clearance. These are used only for security, not for tracking, analytics or advertising, and need no consent under § 165(3) Austrian Telecommunications Act 2021 / Art. 5(3) ePrivacy Directive. We will update this section if we enable such a feature. Cloudflare lists the cookies it can set in its cookie documentation; see also Cloudflare’s privacy policy.

17. Contact

Questions about privacy? Email support@attenya.app.