Privacy Policy
1. Who we are
PactMe ("the app", "we", "us") is developed and published by an individual developer, who is the controller of the personal data described in this policy. You can reach us at the address in section 16.
2. Data that stays on your device
The following data is created, processed and stored on your device, in the app's private storage. We do not upload it to our servers, to Firebase, or to other third parties, unless you turn on a feature described in section 13 that needs it.
| Data | Why it exists |
|---|---|
| Package names of the apps you choose to monitor, and the list of launchable apps on your device | So you can pick apps and so the app knows when to step in |
| Start time, end time and duration of your sessions in monitored apps; per-app usage time read from the system | To time your pacts and build your day, week and month statistics |
| Your pacts: planned duration, actual duration, cooldowns, and whether each pact was kept | To show your pact rate, streaks and history |
| Your settings: pact mode, cooldown length, theme, reminders, onboarding state | To remember how you configured the app |
| Subscription state: whether PRO is active, its expiry, and the Google Play purchase token | To unlock paid features and verify your purchase with Google Play |
If Android backup is turned on for your Google account, Android may include this app's data in your device backup, which Google stores encrypted and ties to your Google account. We do not have access to those backups. You can turn backup off in Android Settings.
3. Data sent to Google Firebase
We use three Google Firebase services. They run as part of the app and send data to Google, which processes it on our behalf as a data processor.
| Service | What it collects | Why we use it |
|---|---|---|
| Google Analytics for Firebase | An app instance ID generated on install; device model, Android version, app version, language and approximate country or region (derived from your IP address, which is not stored); first open, session start and engagement time; and in-app events we define that record which screens and features are used. These events do not contain the data listed below. | To understand which features are used and where people get stuck, so we can improve the app |
| Firebase Crashlytics | Crash and error reports: stack traces, the time of the crash, device model, Android version, app version, free memory and storage, screen orientation, and a Crashlytics installation ID. | To find and fix crashes and bugs |
| Firebase Remote Config and A/B Testing | A Firebase installation ID, app version, language and country, used to deliver configuration values and, if an experiment is running, to place your app instance in a test group. Experiment results are measured through Google Analytics. | To adjust app settings and try out improvements without shipping a new version |
Unless you use a feature described in section 13 that needs it, we do not send the following to Firebase or anywhere else:
- The names or package names of the apps you monitor or have installed.
- Your usage times, sessions, pact records, statistics or streaks.
- Information obtained through the accessibility service or usage access.
- Your name, email, phone number, contacts, precise location, or screen content.
We have disabled collection of the Android advertising ID and Google Analytics advertising features. Firebase data is not used for advertising and is not linked to a user account, because the app has no accounts.
Google may process this data on servers outside your country, including in the United States. Where data is transferred from the EEA, the UK or Switzerland, Google relies on the European Commission's Standard Contractual Clauses. See Privacy and Security in Firebase and the Google Privacy Policy.
4. Your choices about analytics and crash reports
Analytics and crash reporting each have their own switch under Settings → Privacy in the app. When a switch is off, the app stops sending that type of data from your device. Turning them off does not change how pacts, statistics or PRO features work.
- EEA, UK and Switzerland: analytics stays off until you choose "Allow" in the app. We ask once, on the privacy screen shown after onboarding. If you choose "Don't allow", we do not ask again unless this policy changes in a way that needs your consent. The app estimates your region from your SIM card, mobile network and device settings; if it cannot tell, it treats you as being in this region.
- Other regions: analytics is on by default, and you can turn it off in Settings.
- Crash reporting is on by default in every region, based on our legitimate interest in keeping the app stable. You can object by turning it off in Settings.
Turning analytics off also resets the analytics identifier on your device, so data collected later is not linked to earlier data.
5. Permissions and how we use them
PactMe asks for several permissions that Android treats as sensitive. Data accessed through them is used for the app's core features described below, is processed on your device, and is not transmitted (except as described in section 13), sold, or used for advertising.
| Permission | Purpose |
|---|---|
Accessibility serviceBIND_ACCESSIBILITY_SERVICE |
Detects which app has come to the foreground, so a pact can be applied the moment you open a monitored app. It listens for window-change events and reads the package name of the foreground app. It is not used to read text, messages, passwords, or other screen content. On some customised Android systems, usage access cannot detect the foreground app, so this service is needed for pacts to work there. |
Usage accessPACKAGE_USAGE_STATS |
Reads per-app usage time from Android to build your statistics, and serves as another way to detect the foreground app. |
Display over other appsSYSTEM_ALERT_WINDOW |
Shows the duration picker and the time's-up reminder on top of the app you opened. |
Foreground serviceFOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE |
Keeps pact monitoring running in the background, with the persistent notification Android requires. |
NotificationsPOST_NOTIFICATIONS |
Shows the status notification while PactMe is running. If we add notification reminders later, they will use this permission too. |
Ignore battery optimizationREQUEST_IGNORE_BATTERY_OPTIMIZATIONS |
Optional. Stops the system from killing the monitoring service in the background. |
| App visibility (launcher-app query) |
Lists the apps on your device that you can open, so you can choose which ones to make pacts for. The list is shown to you in the app and is not uploaded. |
Internet and network stateINTERNET, ACCESS_NETWORK_STATE |
Used by Firebase (section 3) and by Google Play billing. Not used to send your usage records, except for a feature you agree to under section 13. |
Google Play billingcom.android.vending.BILLING |
Lets you buy and restore PRO, by subscription or Lifetime purchase. |
You can revoke these permissions in Android Settings. Without the accessibility service or usage access, PactMe may be unable to detect apps or enforce your pacts.
6. Google Play billing
Purchases are processed by Google Play. When you buy or restore PRO, the app receives your purchase state and a purchase token from Google Play and stores them on your device. We do not receive your card or billing details. Google's handling of the transaction is covered by the Google Privacy Policy.
7. Legal bases (EEA, UK and Switzerland)
- Providing the app and your subscription: performance of our contract with you.
- Analytics: your consent, which you can withdraw in Settings. Withdrawing does not affect data collected before you withdrew.
- Crash reports and remote configuration: our legitimate interest in keeping the app reliable and improving it. You can object in Settings.
8. Sharing
We do not sell your personal information and do not share it for cross-context behavioural advertising. Data described in this policy is received by Google (as Firebase's provider and as the Google Play billing provider), and authorities where we are legally required to disclose it.
9. Retention and deletion
- On-device data stays until you delete it. Uninstall the app, or go to Android Settings → Apps → PactMe → Storage → Clear data.
- Google Analytics data is kept for 14 months. If you keep using the app, this period is extended. The data is then deleted automatically. Aggregated reports that do not contain identifiers may be kept longer.
- Crashlytics crash reports are kept for up to 90 days.
- Firebase installation IDs are deleted when no longer used, typically within 180 days after the app is uninstalled.
Uninstalling or clearing the app's data resets the identifiers above, so new data is not linked to old data. To ask us to delete Firebase data that has already been collected, contact us (section 16).
10. Your rights
Depending on where you live, including under the GDPR, UK GDPR and California privacy law (CCPA/CPRA), you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, to withdraw consent, and to complain to your local data protection authority. Because the app has no accounts, the data Firebase holds is tied only to random identifiers. We may need your help to find it, for example the approximate install date and device model. We will respond within 30 days and will not discriminate against you for exercising your rights.
11. Security
On-device data is kept in the app's private storage, which Android protects from other apps. Data sent to Firebase is encrypted in transit using HTTPS. Storage and transmission carry some risk, so we limit what we collect to what this policy describes.
12. Children
PactMe is not directed at children under 13 and we do not knowingly collect personal data from them. Where local law requires a higher age to consent on your own (for example up to 16 in some EU countries), you need a parent or guardian's permission to use the app. If you believe a child has used the app, contact us and we will delete the data we are able to find.
13. Future features that upload data
If we add a feature that needs to upload your usage records, such as cloud sync or online challenges, it will be off by default. We will explain in the app what it uploads and ask for your consent before it uploads anything, and you will be able to turn it off later.
14. Changes to this policy
If we change this policy, we will update the effective date at the top. For material changes, such as collecting a new type of data or using data for a new purpose, we will also show a notice in the app when you first open an updated version, and where a change needs your consent, we will ask for it before the change applies to you. Minor edits, such as clearer wording, are made on this page.
15. This website
This website does not use cookies, analytics or tracking scripts, and does not store anything in your browser. Our server keeps standard access logs (IP address, request time, the page requested and browser type) for security and operations, and deletes them after 30 days.
16. Contact
隐私政策
1. 我们是谁
守约（PactMe，下称「本应用」「我们」）由个人开发者开发并发布，是本政策所述个人数据的控制者。 联系方式见第 16 节。
2. 保存在你设备上的数据
以下数据在你的设备上生成、处理，并保存在本应用的私有存储区。 除非你开启第 13 节所述、需要这些数据的功能，我们不会把它上传到我们的服务器、Firebase 或其他第三方。
| 数据 | 用途 |
|---|---|
| 你选择监控的应用包名，以及设备上可启动的应用列表 | 供你选择应用，并让本应用知道何时介入 |
| 你在监控应用中每次使用的起止时间与时长；从系统读取的各应用使用时长 | 为守约计时，生成日、周、月统计 |
| 你的守约记录：计划时长、实际时长、冷静期、是否守约 | 展示守约率、连续天数和历史记录 |
| 你的设置：守约模式、冷静期时长、主题、提醒、引导页状态 | 记住你的配置 |
| 订阅状态：PRO 是否有效、到期时间、Google Play 购买凭证 | 解锁付费功能，并向 Google Play 核验购买 |
如果你的 Google 账号开启了 Android 备份，系统可能会把本应用的数据纳入设备备份。备份由 Google 加密保存， 与你的 Google 账号绑定，我们无权访问。你可以在系统设置中关闭备份。
3. 发送给 Google Firebase 的数据
我们使用以下三项 Google Firebase 服务。它们作为本应用的一部分运行，并将数据发送给 Google， 由 Google 作为数据处理者代表我们处理。
| 服务 | 收集的内容 | 用途 |
|---|---|---|
| Google Analytics for Firebase | 安装时生成的应用实例 ID；设备型号、Android 版本、应用版本、语言，以及根据 IP 地址推算的大致国家或地区 （IP 地址本身不会被存储）；首次打开、会话开始、使用时长；以及我们定义的、记录哪些页面和功能被使用的应用内事件。 这些事件不包含下方列出的数据。 | 了解哪些功能被使用、用户在哪里卡住，以便改进产品 |
| Firebase Crashlytics | 崩溃和错误报告：堆栈信息、崩溃时间、设备型号、Android 版本、应用版本、可用内存与存储空间、屏幕方向， 以及 Crashlytics 安装 ID。 | 发现并修复崩溃和故障 |
| Firebase Remote Config 与 A/B Testing | Firebase 安装 ID、应用版本、语言和国家，用于下发配置参数；如果正在进行实验，用于把你的应用实例分到某个实验组。 实验效果通过 Google Analytics 衡量。 | 无需发布新版本即可调整应用设置、试验改进方案 |
除非你使用第 13 节所述、需要这些数据的功能，否则以下内容我们不会发送给 Firebase 或任何地方：
- 你监控或安装的应用名称、包名。
- 你的使用时长、使用会话、守约记录、统计数据和连续天数。
- 通过无障碍服务或使用情况访问权限获得的信息。
- 你的姓名、邮箱、电话、通讯录、精确位置或屏幕内容。
我们已关闭 Android 广告 ID 的收集和 Google Analytics 的广告功能。Firebase 数据不用于广告， 也不与用户账号关联，因为本应用没有账号。
Google 可能在你所在国家以外的服务器上处理这些数据，包括美国。对于从欧洲经济区、英国或瑞士传出的数据， Google 采用欧盟委员会的标准合同条款。详见 Firebase 隐私与安全 和 Google 隐私权政策。
4. 你对统计分析和崩溃报告的选择
统计分析和崩溃报告在应用的「设置 → 隐私」中各有一个开关。开关关闭后，本应用会停止从你的设备发送该类数据。 关闭它们不影响守约、统计和 PRO 功能的使用。
- 欧洲经济区、英国、瑞士：统计分析在你于应用内选择「允许」之前保持关闭。我们会在引导之后的隐私页询问一次； 如果你选择「不允许」，之后不会再次询问，除非本政策发生需要征得你同意的变更。 本应用根据 SIM 卡、移动网络和系统设置推断你所在的地区；无法判断时，按位于该地区处理。
- 其他地区：统计分析默认开启，你可以在设置中关闭。
- 崩溃报告在各地区默认开启，依据是我们保持应用稳定的正当利益。你可以在设置中关闭，以表示反对。
关闭统计分析时，本应用还会重置设备上的统计标识符，之后收集的数据不会与之前的数据关联。
5. 权限及其用途
守约会申请几项 Android 视为敏感的权限。通过这些权限获得的数据用于下述核心功能，在你的设备上处理， 不会被传输（第 13 节所述情形除外）、出售或用于广告。
| 权限 | 用途 |
|---|---|
无障碍服务BIND_ACCESSIBILITY_SERVICE |
检测哪个应用切换到了前台，让你打开监控应用的那一刻就能开始守约。它监听窗口切换事件，读取前台应用的包名， 不用于读取屏幕上的文字、消息、密码或其他屏幕内容。在部分定制 Android 系统上，使用情况访问权限无法识别前台应用， 需要依靠该服务才能正常守约。 |
使用情况访问PACKAGE_USAGE_STATS |
从系统读取各应用使用时长，用于生成统计；同时作为识别前台应用的另一种方式。 |
显示在其他应用上层SYSTEM_ALERT_WINDOW |
在你打开的应用上方显示时长选择和到点提醒。 |
前台服务FOREGROUND_SERVICE、FOREGROUND_SERVICE_SPECIAL_USE |
让守约监控在后台持续运行，并按 Android 要求显示常驻通知。 |
通知POST_NOTIFICATIONS |
显示守约运行时的状态通知。以后增加了通知提醒，也会走这个权限。 |
忽略电池优化REQUEST_IGNORE_BATTERY_OPTIMIZATIONS |
可选。防止系统在后台结束监控服务。 |
| 应用可见性 （查询可启动应用） |
列出你设备上可打开的应用，供你选择守约对象。列表在应用内展示给你，不会上传。 |
网络访问与网络状态INTERNET、ACCESS_NETWORK_STATE |
供 Firebase（第 3 节）和 Google Play 结算使用，不用于发送你的使用记录（你按第 13 节同意的功能除外）。 |
Google Play 结算com.android.vending.BILLING |
用于购买和恢复 PRO（订阅或终身买断）。 |
你可以在系统设置中撤销这些权限。关闭无障碍服务或使用情况访问后，守约可能无法识别应用或执行约定。
6. Google Play 结算
购买由 Google Play 处理。购买或恢复 PRO 时，本应用会从 Google Play 获得购买状态和购买凭证，并保存在你的设备上。 我们不会收到你的银行卡或账单信息。交易的处理适用 Google 隐私权政策。
7. 处理的法律依据（欧洲经济区、英国、瑞士）
- 提供应用功能和订阅服务：履行与你的合同。
- 统计分析：你的同意，可在设置中撤回。撤回不影响此前已收集数据的合法性。
- 崩溃报告和远程配置：我们保持应用稳定、改进产品的正当利益，你可以在设置中拒绝。
8. 数据共享
我们不出售你的个人信息，也不会将其用于跨情境行为广告。本政策所述数据的接收方为 Google（作为 Firebase 和 Google Play 结算的提供方）， 以及法律要求我们披露时的相关主管机关。
9. 保存期限与删除
- 设备上的数据一直保留到你删除为止。卸载应用，或前往系统设置 → 应用 → 守约 → 存储 → 清除数据。
- Google Analytics 数据保存 14 个月；如果期间你继续使用应用，与你相关的数据保存期会随之延后，之后自动删除。不含标识符的汇总报告可能保留更久。
- Crashlytics 崩溃报告最长保存 90 天。
- Firebase 安装 ID 在不再使用后删除，通常在卸载后 180 天内。
卸载或清除应用数据会重置上述标识符，新数据不会与旧数据关联。如需删除已收集的 Firebase 数据，请联系我们（第 16 节）。
10. 你的权利
根据你所在地区的法律，包括 GDPR、英国 GDPR 和美国加州隐私法（CCPA/CPRA），你可能有权访问、更正、删除或转移你的个人数据， 反对或限制处理，撤回同意，并向当地数据保护机构投诉。由于本应用没有账号，Firebase 中的数据只与随机标识符关联， 我们可能需要你协助定位，例如大致的安装时间和设备型号。我们会在 30 天内答复，也不会因为你行使权利而区别对待你。
11. 安全
设备上的数据保存在本应用的私有存储区，受 Android 系统保护，其他应用无权读取。发送给 Firebase 的数据在传输过程中通过 HTTPS 加密。 存储和传输都存在一定风险，因此我们把收集范围控制在本政策所述内容之内。
12. 儿童
守约不面向 13 岁以下儿童，我们不会故意收集儿童的个人数据。如果你认为有儿童使用了本应用，请联系我们，我们会删除能够找到的相关数据。 在当地法律要求更高年龄才能自行同意的地区（例如欧盟部分国家为 16 岁），你需要获得父母或监护人的同意后再使用。
13. 将来需要上传数据的功能
如果将来加入需要上传使用记录的功能（例如云同步或在线任务），该功能默认关闭。我们会在应用内说明它上传哪些内容， 在上传之前征得你的同意，你之后也可以将其关闭。
14. 本政策的变更
如果本政策发生变更，我们会更新顶部的生效日期。对于重大变更，例如新增收集的数据类型或把数据用于新的用途， 我们还会在你首次打开更新后的版本时于应用内提示；需要征得你同意的变更，会在对你生效前先征得同意。 措辞调整等小修改只在本页面更新。
15. 本网站
本网站不使用 Cookie、统计或追踪脚本，也不在你的浏览器中存储任何内容。 我们的服务器出于安全和运维需要保留标准访问日志（IP 地址、访问时间、请求的页面和浏览器类型），30 天后删除。