Privacy Policy
The short version
Finit is local-first: your screen-time data lives on your device and in your private iCloud, and no server of ours ever receives it. Finit is a paid app. You are not the product: no ads, no tracking, nothing we tie to your name or email. Every party the app or this site talks to is named below; the list is short.
On your device and in your iCloud
The app stores your daily usage records (app names and durations, imported from Apple's Screen Time), your life profile (birth date, daily routine hours, optional extras you enter), and the life entries you add to the weeks grid. All of it syncs only into the private database of your own iCloud account (Apple CloudKit): encrypted, tied to your Apple ID, unreadable to us. Switch sync off for Finit in system settings and the synced copy leaves this device: your data stays in your iCloud, everything recorded from then on stays local, and it all comes back when you switch sync on again. Import logs and the last-opened date never leave the device at all. Sharing a stat image goes through the system share sheet. Where it goes is your choice.
What else leaves the device
- Apple (iTunes catalog): app icons. To show real icons, the app sends each app's name (never durations, never any ID) to
itunes.apple.comonce, then caches the answer forever. Apple, like any server, sees your IP address. - RevenueCat: purchases. Loads prices and checks your unlock status under a random installation ID that we never connect to your name or email; when you buy through Apple's App Store, it processes the transaction (product, receipt, device model, OS version) to unlock access, run the trial, and handle restores. No name, no email, no screen time.
- PostHog (EU): product analytics, a closed set of events (onboarding and paywall steps from a fixed list, never free text, never your name) under a random installation ID. No automatic capture, no person profiles, no screen-time values. The ID is pseudonymous, not anonymous: we do not link it to you, but PostHog and its infrastructure still process technical data such as your IP address to deliver and secure the request.
- Sentry (Germany): crash reports, configured without user identity, breadcrumbs, or tracing. A report carries the stack trace, device model, OS version, and the technical request data any server sees, including your IP address.
The App Store privacy label matches all of this: Purchases, Product Interaction, Crash Data: not linked to you, not used for tracking.
If you sign in (friends features)
Signing in (email code, Sign in with Apple, or Google) creates an account on our server (Supabase, hosted in Zurich, Switzerland) holding: a user ID, your display name, your friend links, your email address if you signed in with it (used only to send the code, which Resend delivers), and, only when you explicitly share a week, one weekly total, rounded to 30 minutes. Never per-app data, never per-day data, never automatically. Apple and Google sign-ins can hand over a name and an email claim, which the authentication service stores; with Apple you can edit or withhold the name right in the sign-in sheet. Shared weeks are visible only to friends who accepted your request; deleting your account in the app removes everything server-side. If you never sign in, none of this exists.
Permissions
- Screen Time: read via Shortcuts you create, using Apple's built-in screen-time action: app names and durations only, processed on-device. Delete the Shortcuts anytime to stop the import.
- Notifications: optional, all scheduled locally on your device, at most three in any week; there is no push server.
- Apple Health: optional, read-only sleep and exercise; each toggle stores one 30-day average in your profile and transmits nothing.
The app does not access your location, contacts, camera, microphone, photos, or files.
This website
getfinit.com is static: no cookies, no analytics, no external requests, hence no cookie banner. It is served by Cloudflare, which processes the technical data of each request (IP address, URL, user agent) to deliver and protect the site. Nothing on the site loads from anywhere else. The feature request link is an ordinary link, so you only reach Featurebase once you follow it.
The newsletter
If you leave your email address in the newsletter form, we first send a single confirmation mail. Your address is stored only after you click the link inside (double opt-in). Ignore that mail and nothing is kept: an unconfirmed address is never written to any list of ours. Our processors keep their own delivery and security logs for their documented periods. What's stored once you confirm: your email address, which of the site's own channel links brought you if any (a single word like "tiktok", with no tracking behind it), and the date. The mails are sent and the list is kept by Resend, under a data-processing agreement, with our mails leaving from EU infrastructure. Open and click tracking are switched off: no tracking pixels, no rewritten links. We don't know whether you open a mail, and prefer it that way. The signup request itself passes through Cloudflare like every page request (see above); we store no IP address with your subscription. Every mail ends with a one-click unsubscribe that takes effect immediately; writing to hello@ deletes the address entirely. It is never shared, and never connected to the app or an app account.
The feedback board
feedback.getfinit.com is a public board for feature requests, run for us by Featurebase. You reach it only by clicking the feature request link on this site, or the feedback button in the app. To post, comment, or vote you register with Featurebase directly, and the name and email address you give them, together with whatever you write, is held by Featurebase under our account. Opening the board without registering still leaves a visitor entry there, without a name or an account. Your Finit account is never handed over: there is no single sign-on between the app and the board, so nothing you write there is connected to your screen time. One mail to us or to Featurebase removes your board account and your posts.
Who is responsible
Owner and data controller under the Swiss FADP and, where it applies, the EU GDPR:
Finit
Joschka Bieri
Postfach 9
3550 Langnau i. E.
Switzerland
Contact: legal@getfinit.com
Legal bases and where processing happens
Where the GDPR applies: the app's core and purchases rest on performance of a contract (Art. 6(1)(b)); the newsletter, the friends account, and the Health toggles rest on consent (Art. 6(1)(a)), each revocable on the spot; diagnostics, the icon lookup, the feedback board, and the technical delivery and protection of app and site rest on legitimate interests (Art. 6(1)(f)). Those interests are: keeping the app stable and free of crashes, learning whether the setup works at all so it can be improved, showing real app icons instead of grey placeholders, having one public place where feature requests can be read and voted on, and delivering and defending app and site against abuse and overload. Wherever we choose the region, processing stays in Switzerland or the EU: Supabase in Zurich, PostHog in the EU, Sentry in Germany, Featurebase in the Netherlands, Germany, and Ireland. RevenueCat and Resend are US providers bound by data-processing agreements that include the EU standard contractual clauses, and Featurebase works with a few US providers of its own on the same basis; a copy of those clauses is available from us on request. Apple processes App Store purchases and icon lookups under its own terms.
How long data is kept
Screen-time records, profile, and life entries live on your device and in your iCloud: delete them there (or delete the app and its iCloud data) and they are gone; we hold no copy. The friends account lasts until you delete it in the app, which removes everything server-side immediately. The newsletter list keeps your address until you unsubscribe or ask for deletion, and a board account and its posts stay until you ask for their removal. Crash reports age out at Sentry after 90 days; analytics events carry a random installation ID, fixed event names and no screen-time values, and PostHog is configured to discard the IP address as the event arrives, so none is stored with them. They are deleted at PostHog when the project retention window expires. Nothing is archived beyond these windows.
Your rights
You can ask what data exists about you, have it corrected or deleted, get a copy in a portable format, object to a processing, or withdraw a consent at any time. One mail to legal@getfinit.com does it, no form required. Much of it is faster in place: deleting the friends account in the app removes all server-side data, Settings → Diagnostics stops analytics and crash reports immediately, and every newsletter mail carries a one-click unsubscribe. You can also complain to your local data protection authority.
Children
You need to be 16 or older to use Finit. We do not ask for your date of birth, and we do not knowingly collect data from children; if you believe a child has given us data, write to us and we will delete it. Finit shows no ads and no third-party content, and the friends features stay off unless you sign in.
Changes
If a future version changes any of the above, this policy is updated before that version ships.