1. Who we are
TMS DIGITAL SRL operates Readify Lock and is responsible for the personal data described in this policy. “Readify,” “we,” and “us” refer to TMS DIGITAL SRL.
This policy covers the Readify app for iPhone, the Readify app for Android (package name com.josephtms.readify), and the public pages hosted at readify-lock.web.app. Both apps use the same accounts, the same servers, and the same records; where the two platforms genuinely work differently, this policy says so and names the platform. It does not replace the privacy notices of Apple, Google/Firebase, OpenAI, or other services you choose to use.
2. Data we handle
| Category | Examples | Why |
|---|---|---|
| Account and profile | Firebase user ID, email address, name, preferred language, authentication provider, and optional profile photo. | Sign-in, account management, private profile display, language, and creator identity when you publish. |
| Acquisition and first-run milestones | A campaign label derived from an opaque token, its server timestamp, profile completion, and whether the app-blocking prompt was shown, approved, denied, or continued without. | Measure the free pilot from campaign to genuine reading activation, diagnose first-run drop-off, and avoid scaling a broken path. |
| Reading and challenge activity | Challenge memberships, daily reading state, recall answers and attempts, completion outcomes, streak, XP, accuracy, and leaderboard progress. | Operate the daily loop, prevent forged completion, show progress, and rank challenge members. |
| Creator content | Challenge title, description, schedule, visibility, reading program, recall questions and accepted answers, creator-access request, and generation settings. | Create, publish, discover, share, and administer challenges. |
| Safety information | Reports, report reason and details, reporter ID, private creator-block relationships, automated screening results, and operator decision metadata. | Receive abuse reports, suppress blocked creators from discovery, screen creator submissions, investigate, and enforce policy. |
| AI generation state | Requested number of days, daily quota status, request time, and a stable pseudonymous provider-safety identifier. Creator source text is processed as described below. | Apply generation limits, operate the requested feature, and prevent abuse. |
| App-instance identifiers | A Firebase installation ID, and an app-instance attestation token: App Attest on iPhone, Play Integrity on Android. | Deliver remote configuration such as the minimum-version gate, and check that a request comes from a genuine, unmodified copy of the app. |
Authentication is provided through Firebase Authentication. On iPhone you can use Sign in with Apple or an email address and password. On Android you can use Google Sign-In or an email address and password; Sign in with Apple is not offered on Android. Readify does not store a plaintext copy of your password in its own Firestore database. Apple may provide a private relay address if you choose “Hide My Email.” One account works on both platforms: an account created with Sign in with Apple can add a password from the “Forgot password” link on the sign-in screen and then sign in on Android.
An optional profile photo is stored as a JPEG in Firebase Storage for your own profile and is not copied into shared challenge membership. Public challenge catalog metadata can be seen by signed-in users. Joined members and creators see server-generated per-challenge reader aliases and progress rather than personal member names or photos. A creator’s display name accompanies challenges they publish. Reports and block lists are not public.
The Firebase Auth, Installations, Firestore, Remote Config, and App Check SDKs may process unlinked technical diagnostic data for service analytics and reliability, alongside the app-instance identifiers listed above. Those identifiers exist to serve configuration and to prove the app instance is genuine; they are not advertising identifiers, they are not used for profiling, and they are not shared for anyone else’s purposes. Readify does not use Firebase Analytics, a crash-reporting SDK, advertising analytics, IDFA, an Android advertising ID, or cross-app tracking.
Readify uses a bounded first-party milestone service rather than a general analytics SDK. It stores only the fixed account-linked milestones listed above and derives challenge joins and credited reading outcomes from server-owned product records. It does not accept arbitrary event names, free text, advertising identifiers, or client-supplied timestamps. The opaque campaign token itself is reduced to a one-way identifier and is not stored in the account record.
Website data
This static website does not set cookies, run advertising, or include client-side analytics scripts. Firebase Hosting and network providers may process ordinary request information such as IP address, user agent, requested page, and time to deliver and protect the site.
3. App blocking: what the lock can and cannot see
Read-to-unlock needs the phone to hold other apps back until the day’s reading is confirmed. The two operating systems give an app very different tools for that, so the mechanism, the permissions, and the exact wording of the promise differ. What does not differ: the lock runs on your device, it decides nothing on its own, and nothing it observes about your other apps is sent to Readify’s servers.
On iPhone: Screen Time
If you authorize Screen Time, Readify uses Apple’s Family Controls, Device Activity, and Managed Settings frameworks to apply a shield to the application categories Apple exposes. iOS controls the exact system scope and exceptions.
The app stores only local lock state and a time-bounded active-challenge policy, shared with Readify’s Device Activity extension through an App Group. The extension reads that policy, applies or clears the system shield, collects no data, and makes no network requests.
Screen Time authorization is optional. You can decline it during setup or change access through iOS Settings. Without authorization, Readify cannot enforce the read-to-unlock shield.
On Android: usage access and the app overlay
Android has no Screen Time API, so Readify asks for two special permissions instead. Both are granted by you in system Settings, not by a tap inside Readify, and both can be revoked there at any moment.
- Usage access — Android’s “usage access” special permission — answers exactly one question, repeatedly: which app is in the foreground right now? Readify compares that answer against the short list of apps it never pauses, and then discards it. The answer is not written to a file, not written to a log, and never sent to a server or to any third party. Readify does not request permission to list your installed apps (the Android permission that would allow it, QUERY_ALL_PACKAGES, is not declared); it can only look up the handful of system roles it must never pause — your launcher, phone app, messaging app, and the settings app.
- Display over other apps is how the “Apps are paused” screen reaches the display when you open an app that is on hold. It draws Readify’s own screen on top; it does not read, capture, or record what is underneath.
To keep watching while you are in another app, Readify runs a foreground service. Android requires a visible notification for that service, so while a lock is in force you will see a low-priority Readify notification reading “Apps are paused — Finish today’s reading in Readify to open them.” It is the only notification Readify sends; there are no product notifications, marketing pushes, or reminders. If you deny the notification permission, Android hides the badge and the service still runs. The service starts when a lock is in force and stops as soon as the day’s reading is finished.
Two smaller permissions serve the schedule rather than any data collection. Readify asks, optionally, to schedule an exact alarm so the lock lands on the minute you agreed to rather than up to an hour late; Android also shows that alarm in the system’s next-alarm affordance, so you may see a Readify entry beside your own alarms. Readify listens for the device finishing a restart so it can re-arm that alarm, because a reboot clears it. It also uses vibration for the moment the day opens.
While a lock is in force, Readify pauses the app in the foreground unless it is Readify itself, your launcher, your phone app, your default emergency app, your messaging app, the Android system settings app, the Android system interface, or your current keyboard. Web browsers are paused. If Readify cannot confidently classify an app, it does not pause it.
The Android app ships no accessibility service, no notification listener, no screen capture and no media projection. It therefore has no mechanism to read the content of any screen — its own or another app’s. Drawing a window over an app conveys nothing about what is inside it.
On Android, joining a challenge requires usage access and the display permission, because without them there is nothing for Readify to pause and a challenge would do nothing at all. You can decline both, use the rest of the app, and grant them later; and you can revoke them at any time in Settings → Apps → Special app access, which ends the lock immediately.
On both platforms
If authorization, content, or the lock policy is unavailable or cannot be trusted, Readify is designed to fail open rather than trap you behind a shield.
For free-pilot improvement, Readify may record that its app-blocking prompt was shown and whether the setup path resulted in approved, denied, or continued without app blocking. These are client-reported first-run milestones, not proof of current OS permission and never authority to lock or unlock. Readify does not send your selected apps or categories, your installed-app list, the name of any app you opened, or your usage history.
4. AI-assisted generation and safety screening
Approved creators can ask Readify to generate a challenge from a topic or from a PDF or TXT document. For a document, Readify reads the file on the device, extracts and limits its text, and sends the resulting source text—not the original file object—to a Firebase Cloud Function. The prompt may include the topic, source text, language, requested duration, and generation instructions.
The Cloud Function sends the prompt to OpenAI, which returns generated reading and recall content to Readify. The generation request includes a stable pseudonymous safety identifier derived from the Firebase user ID to help the provider detect abuse; Readify does not send the raw Firebase user ID or email address in that field. Generated content is stored in Firestore when a creator publishes the challenge.
Readify also sends creator prompts, generated programs, the exact draft submitted for publication at any visibility, creator identity included with the challenge, and later day corrections to OpenAI for automated safety screening. A flagged submission or unavailable/invalid screening result is rejected rather than returned, published, or saved as a correction. Screening is not a factual, copyright, or final human review, so creators remain responsible for their material and users can still report it.
Do not submit confidential information, sensitive personal data, or material you do not have the right to share. You can avoid AI generation processing by not using creator generation. Publishing or correcting a challenge still requires safety screening, including for private and unlisted challenges. Deleting your account deletes your published creator challenges and Readify’s account-linked AI usage records; AI providers may retain technical records under their own terms and retention schedules.
5. How we use data and our legal bases
Depending on where you live, we rely on the following grounds:
- Performance of our agreement: to authenticate you, provide challenges, confirm reading outcomes, maintain progress, publish content at your direction, and provide account controls.
- Legitimate interests: to secure the service, prevent fraud and forged progress, apply reasonable generation limits, confirm requests come from a genuine app instance, diagnose server failures, respond to reports, and improve the free pilot. We do not use these interests for targeted advertising.
- Your choice or consent: when you grant app-blocking access—Screen Time on iPhone, or usage access and the display-over-other-apps permission on Android—upload an optional profile photo, or ask an AI provider to process creator material. You may withdraw a permission in your device’s system settings, although the related feature will stop working.
- Legal obligations and protection: where we must retain, disclose, or use information to comply with law, enforce rights, or protect people and the service.
We do not sell personal data or use Readify data for targeted advertising. The free v1 apps have no Firebase Analytics, crash-reporting SDK, advertising, IDFA, Android advertising ID, or App Tracking Transparency runtime. Firebase service SDKs may still process the unlinked diagnostics and app-instance identifiers disclosed above.
7. Retention and deletion
We keep account, profile, challenge, progress, safety, and usage information while your account is active and as needed to provide the service, secure it, resolve reports, and meet legal obligations. Readify does not currently promise a fixed retention period for every record.
You can delete your account inside either app. After recent authentication, the server removes the Firebase Authentication account, user profile and subcollections, profile image, memberships and progress, leaderboard entries, account-linked AI usage records, reports you filed, creator-block records linked to you, creator-access requests, and challenges you created. Deleting creator-owned challenges also removes their content and reader projections, so other members lose access.
A report another person filed about a challenge is that reporter’s private moderation/security record. It may remain after the challenged creator deletes the challenge so deleting content cannot erase an open abuse report. It is not a retained public copy of the challenge and is removed if the reporter deletes their account, except where a separate legal obligation requires limited preservation.
To prevent a deleted credential from recreating an account, Readify retains a server-only deletion marker whose document key is a one-way SHA-256 digest derived from the former Firebase user ID. It stores only its security purpose, deletion state, and timestamps—no raw user ID, profile, challenge content, or reading data—and clients cannot read or remove it.
Deletion does not require us to remove statistics that have already been aggregated so they no longer identify an account, nor information we must retain by law. Firebase, Apple, Google, OpenAI, and network providers may keep limited security, billing, or technical logs under their own retention schedules. Device-local preferences may remain until you clear app data or uninstall Readify.
See the step-by-step Data Deletion guide.
8. Security and younger users
Readify uses access rules, server-authoritative mutations, app attestation where available (App Attest on iPhone, Play Integrity on Android), HTTPS, and provider security controls. On Android, cleartext HTTP is refused by the platform and device backup and device-to-device transfer of Readify’s local state are switched off. No system is completely secure, so do not submit information you do not need Readify to process.
Readify is intended for people age 13 and older and is not offered in the App Store Kids category or under Google Play’s Families programme. You must also be old enough to agree to these terms and online-service data processing where you live. We do not knowingly ask creators to publish age-restricted content. If you believe a child has provided personal data without required authorization, contact us so we can investigate and delete it where appropriate.
9. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to withdraw consent. You may also complain to your local data-protection authority.
- Change your language in the app, or contact us to correct other profile data.
- On iPhone, decline or change Screen Time authorization in iOS Settings.
- On Android, grant or revoke usage access and “display over other apps” in Settings → Apps → Special app access. Revoking either one ends the lock.
- Block or unblock creators in Discover.
- Delete your account in Readify under Record → Settings → Delete Account.
- Contact us for another privacy request. We may need to verify your identity before acting.
10. Changes to this policy
We may update this policy as Readify changes. We will update the date above and, when a change is material, provide an appropriate notice before or when the new policy takes effect.
11. Contact
TMS DIGITAL SRL
Privacy and support: admin@tmsdevelops.com
For a privacy request, use the subject “Readify privacy request” and do not send your password, an Apple or Google authorization code, or copies of sensitive source documents.