BreakFree

Privacy Policy

Last updated: July 31, 2026 · Effective immediately

Short version: All blocking and filtering happens entirely on your device — we never see the sites or apps you block, your DNS queries, or your browsing. We run a minimal backend used only for three things: preventing free-trial abuse, sending optional accountability emails you set up, and helping you recover access. Exactly what that backend stores is described below.

1. Who We Are

BreakFree is a digital addiction blocker for Android, developed as an independent application. References to "we", "us", or "our" refer to the BreakFree development team. Our backend services run on our own infrastructure at breakfreeco.com.

2. On-Device by Default

The core of BreakFree runs entirely on your phone. The following never leaves your device and is never sent to us:

Your list of blocked websites and apps
Your browsing history and DNS queries
Your actual web traffic (HTTP/HTTPS)
Your streak counts, schedules, focus sessions, and usage statistics
Your PIN and recovery phrase (stored in encrypted device storage)

3. What Our Servers Receive

To support anti-abuse, accountability, and account recovery, our backend receives and stores a limited set of data — and nothing more:

Anti-abuse (free-trial enforcement). To stop a single device from claiming unlimited free trials, we store a one-way SHA-256 hash of your Android device identifier together with your trial start and end dates. The hash cannot be reversed to identify your device, and we do not store the raw identifier. We also validate a Google Play Integrity token to confirm the request comes from a genuine app install.
Accountability partner (optional, opt-in). If you choose to add an accountability partner, we store the email address you enter and a summary of your progress (such as your current and best streak and weekly totals) so we can email your partner your progress reports and notify them of commitment locks. You control this feature and can remove the partner at any time.
Account recovery (optional). If you use email-based recovery, we send a one-time verification code to the email address you provide so you can restore access. We do not use this address for marketing.

We do not sell your data, use it for advertising, or share it with anyone except the service providers listed in section 9 that are necessary to operate these features.

4. How the VPN Works

BreakFree optionally uses Android's built-in VPN API to create a local, on-device DNS filter. This means:

The VPN tunnel is established entirely on your device — no traffic is routed through our servers.
Only DNS queries (domain name lookups) are inspected locally to decide whether to block them. Your actual web traffic bypasses the VPN.
The VPN key icon in your Android status bar is the standard indicator for any active VPN — it does not mean your data is monitored.

5. Accessibility Service

BreakFree optionally uses Android's Accessibility Service to block specific apps and to read the address bar of your browser so it can block specific pages or sites. This service:

Reads the active app's package name and, for supported browsers, the current URL, solely to compare against your local block list.
Does not log, store off-device, or transmit that information anywhere.
Does not read message content, passwords, or unrelated screen content.

6. Local Storage

BreakFree stores your block lists, streaks, schedules, PIN, and subscription status locally on your device. This on-device data is deleted when you uninstall the app.

7. Subscriptions and Payments

Premium subscriptions are processed entirely by Google Play Billing and RevenueCat. We never receive, store, or process your payment card details. RevenueCat's privacy policy is available at revenuecat.com/privacy.

8. Push Notifications

If you grant notification permission, BreakFree sends local, on-device notifications (for example "protection restored" or trial reminders). Firebase Cloud Messaging is integrated for future remote notifications; a device push token may be generated by Google's SDK, but we do not currently store push tokens on our servers.

9. Third-Party Services

BreakFree relies on the following providers, each operating under their own privacy policies:

Google Play & Play Integrity — distribution, billing, and anti-abuse attestation (Privacy Policy)
RevenueCat — subscription management (Privacy Policy)
Firebase / Google — push notification infrastructure (Privacy Policy)
Supabase — database hosting for the anti-abuse and accountability data described above (Privacy Policy)
Railway — backend application hosting (Privacy Policy)
Resend — delivery of accountability and recovery emails (Privacy Policy)

10. Data Retention and Deletion

The hashed trial identifier is retained to enforce the one-trial-per-device policy. Accountability and recovery data is retained while the feature is in use. To request deletion of any data associated with you (such as an accountability partner email), contact us at the address below and we will delete it promptly.

11. Children's Privacy

BreakFree is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be reflected in the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or want your data deleted, contact us at:

Email: support.breakfree.dev@gmail.com