Correction notice (October 15, 2026)

Some statements in this version (v5.3) do not match how we actually process personal information. The revised policy (v5.4) corrects them; below is the correction notice that was posted on this policy page before the revision was announced, with some sentences updated on the announcement date to reflect version 1.48.13 (the Android consent for sending backups and app categories, and how account deletion errors are handled). Before this correction notice was posted, the policy page at https://doff-elpis.web.app/privacy.html showed v5.2 (effective May 11, 2026); a copy is at https://doff-elpis.web.app/privacy-v5.2.html.

While you are signed in, your blocking group settings (group names and limits, the package names and names of the apps you put in a group and, on iOS, the app-selection tokens issued by the system), app settings and in-app records (such as streak records and your answers to the onboarding questions) and your free transcription records are backed up to your account. Daily usage records are backed up as well: on Android, the usage time per group and per app for the apps in your groups plus the daily total and compliance rate; in iOS app versions before 1.48.12, the per-group usage time calculated through Screen Time plus the daily total and compliance rate. The backup remains after you uninstall the app and is deleted when you delete your account. The iOS app and Android app versions before 1.48.13 have no separate setting to turn it off. From Android 1.48.13, backups are made only if you agree to the in-app notice after signing in, and turning off Settings > About > "Send backups & app categories" stops further uploads (records already backed up remain until you delete your account). This differs from "stored locally" in Section 1, "Processed only on your device (no server transmission)" and "Automatically deleted when the app is uninstalled" in Section 5, and, as to usage time, "D.off cannot see app names, bundle IDs, or actual usage time" and "is never transmitted to any external server" in Section 11.
The backed-up usage records are used to restore your records and statistics after you reinstall the app or switch devices and, if you join an organization (B2G), to calculate the monthly averages described in Section 4 from the daily totals and compliance rates. This differs from "Used solely for quota management" in Section 5.
On Android, while you are signed in, the package names of installed apps whose category has not yet been received from our server, or was received more than 30 days ago, are sent to our server to look up their categories. These lookups are not stored linked to your account. When adding an app to a group sets or changes that app's category, the app's package name and category are stored with your account identifier, and this record is deleted when you delete your account. From Android 1.48.13, both the lookup and this record happen only if you agree to the in-app notice after signing in. This differs from "raw app usage records, the installed app list, and URLs are never sent to a server" in Section 17 (URLs are indeed not sent).
Device integrity records (Sections 1 and 10) are not anonymized. Stored with the device hash are the identifiers of the accounts signed in on that device and of the accounts that turned on blocking on it, the first and last time the device was checked, the number of accounts that turned on blocking, the number of detected re-registrations and the time of the most recent one, and the end time and reason of any cooldown. The device is checked not only at sign-up and the first group save but whenever you open the app (Android or iOS) while signed in and when you save a blocking group, and on devices that cannot obtain a Play Integrity or DeviceCheck attestation token, the hash is derived from a device identifier set per app developer (the Android ID or identifierForVendor). When you delete your account, your account identifier is removed from the record right away, and the record itself is deleted by a daily cleanup 97 days (the 7-day cooldown plus 90 days) after the device was last checked. This differs from "Anonymized device hash" in Section 1 and "never during normal app use" in Section 10.
Information stored outside your account (app category records and device integrity records) cannot be read or written directly from the app and is handled only by the Company's server functions; on the Company's side, the person handling personal data (the representative) can access information stored on our servers. If you join an organization (B2G), its administrators are provided with your email address, your membership status (active, graduated or dropped) and that organization's activity log about you (joining, leaving, status changes and similar events), together with the items listed in Section 4. This differs from "Items provided: nickname, join date, monthly average usage time, quota compliance rate (aggregate)" in Section 4 and "only your own account can access it" in Section 17.
The Company adds no encryption of its own to the account backup; encryption at rest follows the default encryption of Google Cloud (Firestore). This differs from "encrypted with a key isolated to you" in Section 17.
When you delete your account, your Firebase account and account backup are deleted, but records such as the following may remain: promo-code redemption records (code, account identifier, email), records of premium granted by the Company as customer support (account identifier, reason), subscription event records (account identifier, event type, product, expiry time), the activity logs of organizations you left earlier (account identifier, nickname and similar), the activity log of the organization you belong to at the time (with your account identifier replaced by a random label and your nickname and email removed), and the per-IP-address request counts kept to block repeated requests (deleted by a daily cleanup once 30 days have passed). However, if the server-side deletion ends in an error, app versions before 1.48.13 may delete only your sign-in account and part of your data (account record, settings and blocking groups) from the app itself, so usage and transcription backups and similar data may remain on our servers; contact us as described in Section 6 and we will delete them. From 1.48.13, if the server-side deletion ends in an error, the app deletes nothing, keeps you signed in and asks you to try again. This differs from "delete all of your information yourself" in Section 6 and "all Firestore user data" in Section 12.
If you signed in with Apple, deleting your account may not automatically revoke D.off's Sign in with Apple authorization on Apple's side. You can remove D.off yourself from the Sign in with Apple list in iOS Settings (tap your name, then Sign-In & Security). This differs from "the app calls Apple's /auth/revoke endpoint" in Section 12.
On iOS, values stored in the Keychain (such as the device-time record used for the cooldown and the display name received when you sign in with Apple) may remain on the device after you delete the app. This differs from "Uninstalling removes all locally stored data immediately" in Section 10 and "including the local database and all stored tokens" in Section 13.

You can request access, correction, deletion or suspension of processing as described in Section 6 (chrislee.krh@gmail.com), and you can erase the whole account backup by deleting your account in the app.

Privacy Policy

Effective Date: August 3, 2026 (v5.3)

Elpis Studio ("Company") values the privacy of the D.off app ("Service") users and establishes this Privacy Policy in accordance with applicable laws.

1. Information We Collect

We collect the following information to provide our service:

Required: Email address, password (encrypted)
Social login: Nickname, profile photo (optional)
App usage data: App usage time, group settings (stored locally)
Automatic: Device info, OS version, app version
Device integrity signals: Anonymized device hash derived from Google Play Integrity API (Android) or Apple DeviceCheck (iOS), used solely to prevent abuse of the self-control mechanism
Diagnostics & analytics: Firebase Analytics (Google Analytics for Firebase / GA4) and Crashlytics crash reports collect aggregated, non-advertising usage events and crash logs to keep the app stable and improve features. Not used for cross-app tracking or advertising.

2. How We Use Information

Account registration and management
Service delivery (screen time management, statistics)
Customer support
Service improvement

3. Data Retention and Deletion

Your personal information is destroyed without delay when you delete your account. Where retention is required by law, it is stored separately from other personal information for the applicable period and then destroyed.

Items retained under law: contract and payment records for 5 years under the Korean E-Commerce Act; access logs for 3 months under the Korean Protection of Communications Secrets Act
Destruction procedure: The Company identifies the personal information for which grounds for destruction have arisen and destroys it with the approval of the Personal Information Protection Manager.
Destruction method: Information stored as electronic files is permanently deleted by technical means that make recovery or reproduction impossible; information printed on paper is shredded or incinerated.

4. Third-Party Sharing

The Company does not provide users' personal information to third parties. It is provided only in the following cases, in accordance with Article 17 of the Korean Personal Information Protection Act.

Where there are special provisions in law, or where provision is unavoidable in order to comply with a legal obligation
When you use an organization (B2G) service — Recipient: the organization you joined with an invitation code / Purpose of provision: reporting usage status at the organization level / Items provided: nickname, join date, monthly average usage time, quota compliance rate (aggregate) / Retention and use period: until the organization's contract ends or you leave the organization
Individual app package names, hour-by-hour usage patterns, and transcription content are NOT provided to organization administrators.
Joining an organization is optional. The scope of provision described above is disclosed and your consent is obtained on the invitation-code sign-up screen. If you do not consent, you can use the Service without joining an organization.

5. App Usage Data

On Android, D.off queries app usage time through the UsageStats permission. For iOS, see Section 11 (Family Controls) — iOS handles app monitoring internally within the system and does not expose raw usage data to D.off. This data is:

Processed only on your device (no server transmission)
Used solely for quota management
Automatically deleted when the app is uninstalled

6. Your Rights

You may exercise the following rights regarding your personal information processed by the Company at any time. The legal representative of a minor aged 14 or over may also exercise these rights on the minor's behalf.

Right of access (Article 35 of the Korean Personal Information Protection Act)
Right to correction or deletion (Article 36) — you can also delete all of your information yourself using the account deletion feature.
Right to suspension of processing (Article 37)
How to exercise: submit your request to chrislee.krh@gmail.com. If a representative exercises the right on your behalf, please also submit a document evidencing the delegation.
Processing period: We act on your request and inform you of the result within 10 days of receipt. If a request is refused, we notify you of the reason.

7. Personal Information Protection Manager and contact

Please direct any question, complaint, or remedy request regarding the handling of personal data to the contact below. We respond without undue delay.

Personal Information Protection Manager: Jangchun Lee (Owner)
Organization: ELPIS / Title: Owner
Phone: +82 10-6570-9004
Email: chrislee.krh@gmail.com
You may also seek dispute resolution or counseling for remedies against privacy infringement from the Personal Information Dispute Mediation Committee (1833-6972), the Privacy Infringement Report Center (118), the Supreme Prosecutors’ Office Cybercrime Division (1301), or the National Police Agency Cyber Bureau (182) (Korean domestic hotlines).

8. Service Providers (Processors)

The Company entrusts personal data processing to the following external providers to deliver the Service:

Google LLC (Firebase Auth, Firestore, Storage, FCM, Hosting) — data storage, authentication, push notifications, hosting / United States, multi-region
RevenueCat, Inc. — subscription receipt validation and management / United States
Anthropic, PBC (Claude API) — generating AI insight responses for administrators / United States
Canva Germany GmbH (Pexels API) — supplying exercise video search results (no user-identifying information is sent) / Germany
Google LLC (Firebase Analytics, Crashlytics) — aggregated usage analytics and crash diagnostics / United States

9. International Data Transfer

Under Article 28-8(1)3 of the Korean Personal Information Protection Act, the Company transfers personal information overseas for the purposes of entrusted processing and storage in order to perform the contract and enhance user convenience, and discloses the matters listed in paragraph 2 of the same Article as follows:

Items transferred: the same as the items collected under §1
Destination countries: United States (Google LLC, RevenueCat, Anthropic), Germany (Canva Germany GmbH)
Timing and method of transfer: transmitted over the network from time to time while you use the Service. No transfer via separate storage media takes place.
Recipients and their contacts: Google LLC (1600 Amphitheatre Parkway, Mountain View, California, United States / https://support.google.com/policies) · RevenueCat, Inc. (United States / https://www.revenuecat.com/privacy) · Anthropic, PBC (United States / https://www.anthropic.com/legal/privacy) · Canva Germany GmbH (Pappelallee 78/79, 10437 Berlin, Germany / https://www.canva.com/privacy/)
Purpose of use and retention period of the recipients: the same as the retention policy in §3 and the entrusted work in §8
How to refuse the transfer and its effect: you may refuse the transfer by deleting your account, in which case use of account-based features will be restricted.

10. Device Attestation & Re-registration Cooldown

D.off is a self-control tool. To prevent users from circumventing their own self-imposed limits by deleting and recreating their account, we use device attestation:

What we collect: A SHA-256 hash derived from a Google Play Integrity (Android) or Apple DeviceCheck (iOS) attestation token. This hash does not contain advertising identifiers, IMEI, MAC address, or other persistent device identifiers we control.
When we collect: Only at sign-up and when you first save a blocking group, never during normal app use.
Purpose: If the same device hash already has a record of active blocking sessions and you sign up under a new account, a 7-day cooldown is applied during which all blocking remains active.
Opt out: You may decline by not signing up; the cooldown is part of the core self-control mechanism and cannot be disabled while using the Service. Uninstalling removes all locally stored data immediately.
What it is not: This hash is never used for advertising, cross-app tracking, profile building, or third-party sharing. The Google/Apple attestation APIs themselves are subject to their own privacy policies.

11. iOS Screen Time Data (Family Controls)

On iOS 16+ devices, D.off uses Apple's Family Controls framework to apply restrictions to apps that you yourself select.

Data collected: Only opaque tokens representing user-selected apps. D.off cannot see app names, bundle IDs, or actual usage time — these are handled internally by iOS.
Processing: All data is stored only in the device-local ManagedSettings store and is never transmitted to any external server.
Purpose: Applying user-configured blocks, schedules, and unlock challenges. No third-party monitoring, surveillance, or remote control.
Your rights: You can revoke at any time via iOS Settings → Screen Time → D.off permissions. All ManagedSettings are automatically deleted immediately upon app uninstallation.
Apple policy: This feature operates under Apple's Family Controls Distribution Entitlement approval, and Apple's Privacy Policy (https://www.apple.com/legal/privacy/) applies in conjunction.

12. Sign in with Apple

On iOS, D.off supports Sign in with Apple as one of multiple sign-in methods (Apple App Store Guideline 4.8). When you use this method:

Data collected: Apple ID identifier (Firebase UID), email address (real or Apple-relay), and — only on first sign-in — your full name if you choose to share it. Re-login does not transmit your name again (Apple SDK policy).
Hide My Email: If you select "Hide My Email," Apple issues a private relay address (*@privaterelay.appleid.com) and forwards email to your real inbox. D.off stores only the relay address — your real email is never disclosed to D.off.
Display name preservation: Because Apple delivers your name only on first sign-in, D.off backs up your display name to device-local storage to restore it during subsequent logins on the same device.
Account deletion (Guideline 5.1.1(v)): When you delete your D.off account, the app calls Apple's /auth/revoke endpoint to invalidate D.off's authorization on Apple's side, in addition to deleting your Firebase account and all Firestore user data.
No data sale or marketing: D.off does not send any external marketing emails to Sign in with Apple users. Email is used only for transactional purposes initiated by you.

13. Local Data Storage & Encryption

D.off stores app data on your device using the following mechanisms:

Local database (RxDB / IndexedDB): Quota settings, app group selections, transcription journal entries, weekly stats, and category preferences are stored in your device's local store inside the app sandbox, not accessible to other apps.
Device-level encryption: D.off relies on OS-level full-disk / file-based encryption (Android FBE for Android 10+, iOS File Data Protection) to protect data at rest. Confidentiality depends on you keeping a device passcode/biometric lock enabled and your device not being jailbroken or rooted.
Sensitive token storage: Apple Sign-In access tokens and the device-time anchor used for the cooldown mechanism are stored in OS-secured storage: iOS Keychain (this-device-only, iCloud sync disabled) and Android EncryptedSharedPreferences (Keystore-backed AES-256-GCM).
In transit: All network requests to Firebase, Cloud Functions, RevenueCat, and Apple/Google identity endpoints use HTTPS (TLS 1.2+).
Removal: Uninstalling D.off removes the entire app sandbox, including the local database and all stored tokens, from the device.

14. Children under 14

D.off is intended for users aged 14 and over. We do not collect personal data from children under 14, and users under 14 may not use the Service.

Before you begin using the Service, the initial setup screen requires you to confirm that you are 14 or older and to accept the Terms.
If a user is found to be under 14, the account is terminated and the related data is destroyed.
If we become aware that we have collected personal data from a child under 14, we destroy that data without delay.
A parent or guardian may request confirmation or deletion of a child’s account at chrislee.krh@gmail.com.

15. Changes to This Policy

If we change this Policy, we announce the reason for and the content of the change through an in-app notice.

Notice is given at least 7 days before the change takes effect; for changes that materially affect user rights, notice is given at least 30 days in advance.
The previous version and a change history are posted together so that you can compare the policy before and after the change.
The effective date and version are shown at the top of this Policy.

16. Automatic Data Collection Tools and How to Refuse

The following tools collect information automatically to keep the app stable and improve features. This app does not use browser cookies.

Tools and items: Firebase Analytics (GA4) and Crashlytics automatically collect an app instance identifier, aggregated usage events, and crash logs. They are not used for advertising or cross-app tracking.
How to refuse: turn off Settings > About > "Send analytics data" and collection stops immediately. Your choice is saved on the device and can be changed at any time.
Refusing does not limit your use of the Service in any way.

17. Security Measures for Personal Data

The Company implements the following measures under Article 29 of the Korean Personal Information Protection Act.

Administrative: personal data handling is limited to the representative alone, and the Personal Information Protection Manager directly oversees processing.
Access control: all server data is protected by Firebase security rules so that only your own account can access it; unauthenticated access is denied.
Encryption: data in transit is encrypted with TLS, passwords are stored using one-way hashing that cannot be reversed (Firebase Authentication), and the statistical snapshots backed up to your account are encrypted with a key isolated to you.
Access logs: administrative access to the cloud infrastructure is automatically recorded and retained (Google Cloud audit logs).
Protection by data minimization: raw app usage records, the installed app list, and URLs are never sent to a server, structurally reducing the very possibility of a breach.
Physical security: servers run in Google data centers; the Company operates no physical servers of its own.

← Back to D.off