TollPrivacy Policy
The short version
Toll has no accounts and no server for your data. Your tasks, your token balance, your ledger and your photos are stored on your iPhone and stay there.
Toll cannot see which apps you choose to limit. Apple does not tell us — not even for our own display.
Two things do leave your phone: your purchase status, handled by RevenueCat, and four anonymous counts of when the app was opened or a purchase was made. You can switch the second one off.
That is the whole of it. The rest of this document is detail.
1. What we do not collect
We want to be specific, because "we respect your privacy" means nothing.
- No account. There is no sign-up, no login, no email address, no password.
- No name, email address, phone number, or postal address.
- No advertising identifier (IDFA). We do not track you across apps or websites, and we will never show you the App Tracking Transparency prompt, because we have nothing to ask permission for.
- No location.
- No contacts, calendar, microphone, or files.
- No crash or diagnostic reporting. There is no crash SDK in the app.
2. Which apps you limit — we genuinely cannot see this
When you choose which apps to put behind the toll, you use a picker provided by
Apple. Apple hands the app a sealed reference — an ApplicationToken — instead
of a name, a bundle identifier, or an icon.
This is not a policy we adopted. It is a technical property of Apple's Screen Time framework. The app has no way to read the identity of the apps you selected, even for its own interface. When Toll shows you your selected apps, it asks Apple to draw them; the app itself never learns what they are.
So we could not tell you, sell you, or leak which apps you limit, because we do not have it.
3. Your screen time data
Toll uses Apple's Screen Time frameworks to know when a limited app has been opened and to measure how long it has been used.
None of this leaves your device. The parts of the app that handle screen time run in extensions that have no network access at all, and the app contains no networking code in its native layer.
Toll never reads your usage totals. It does not display Apple's activity reports, and it has no way to see how long you spend in any app beyond the sessions you buy through it.
4. Health data
If you mark a task as measured, Toll asks permission to read specific figures from Apple Health — steps, workouts, mindful minutes, or stand hours, depending on the task.
- The figure is read, compared against the target you set, and discarded
- It is never stored in the app's database
- It is never transmitted anywhere
- Nothing is ever written back to Health
- Hand-entered samples are ignored, so a typed-in step count cannot earn tokens
You can revoke this at any time in Settings → Privacy & Security → Health.
One honest limitation: Apple does not tell apps whether permission to read Health data was granted or refused. A refusal and a genuine zero look identical to us. That is why Toll never claims your Health access was denied — it does not know. It quotes the figure it received and points you at Settings.
5. Photos
If you attach a photo to a task, it is saved inside the app's own private storage.
- It is not added to your photo library
- It is not uploaded anywhere
- It is visible only to you, in the app
- Deleting the app deletes it
The photo exists so that you can hold yourself to something. It is not evidence for us; we never see it.
6. What does leave your device
Two things, and only two.
6.1 Purchases — RevenueCat
If you buy premium, purchase and subscription status is handled by RevenueCat, which tells the app whether you are entitled to premium features.
Apple processes the payment. Toll never sees your payment details, card number, or billing address. RevenueCat's own privacy declaration states that it collects purchase history, not linked to your identity and not used for tracking.
RevenueCat's privacy policy: https://www.revenuecat.com/privacy
6.2 Four anonymous counts — Aptabase
Toll sends four events to an analytics service we host ourselves:
| Event | When |
|---|---|
app_opened |
The app is opened |
trial_started |
A 14-day trial begins |
purchase_completed |
A purchase completes — records which product, never who bought it |
purchase_restored |
A purchase is restored |
Each event carries: the time, a randomly generated session string that is not tied to you or your device and is regenerated after a period of inactivity, the event name, and basic technical context — operating system name and version, app version and build, and your device's language setting.
It carries no device identifier, no advertising identifier, no user id, no screen time data, no health data, and nothing about which apps you limit.
We use it to answer one question: how many people keep using the app. Nothing else.
You can switch it off. Settings → About → the analytics switch. Turning it off stops the very next event, not the next launch.
7. Where your data lives
On your iPhone, in the app's private container. Specifically:
- Tasks, ledger and settings in a local database
- Token balance and shield state in a shared container that the app and its extensions can read
- Photos in the app's own storage
There is no sync. Toll is a single-device app. If you use two iPhones, they keep separate balances and separate ledgers. We do not have a copy of your data, so we cannot restore it for you if you lose your phone.
8. Deleting the app
Deleting Toll deletes everything it stored: tasks, ledger, balance, photos, settings, and the shared container. Every shield is lifted.
We have nothing left to delete, because we never had a copy. There is no account to close and no request to make.
9. Children
Toll is not directed at children and is not offered in the Kids Category. It is a self-control tool for the person holding the phone.
Toll cannot be installed on, configured for, or used to monitor another person's device. It has no pairing, no remote configuration, and no accounts. It affects only the device it runs on.
10. Your rights
Because we hold no personal data about you on any server, most data-subject requests have nothing to act on — there is no file to export, correct or erase. Your data is in your hands, on your device.
If you are in the EU or UK, GDPR rights still apply to any personal data we do process. Our position is that the analytics described in §6.2 are anonymous and the purchase data in §6.1 is held by RevenueCat as processor.
11. Changes
If this policy changes, the date at the top changes and the updated version appears here. Material changes affecting data handling will also be noted in the app's release notes.