Privacy Policy | TiedSiren

TiedSiren is an app blocker for Android and this website. Both are built and operated by Epictechtus ("we"), a one-person studio in France. This policy covers both. It lists what we collect, why, which companies process it for us, and what you can do about it.

We do not sell your personal data.

1. Data the app collects

The app needs an account. This is what it collects once you have one.

Your account

Email address: used to sign you in, to send you account emails (verification, password reset, welcome) and to answer you.
User ID: a random identifier that Firebase Authentication creates for your account. Every other record below is filed under it.
Google sign-in: if you sign in with Google, we receive the email address, the name and the profile picture address of that Google account. We do not ask for your contacts or for any other Google data.

We do not store your password. Signing in is handled by Firebase Authentication.

Your blocklists, sessions and preferences

These are stored on your device and synced to our servers under your account, so that they survive a reinstall and follow you to another device.

Blocklists: their names and what you put in them: the apps (package name, display name and icon), the websites and, where the feature is available, the keywords.
Block sessions: their names, start and end times, repeat settings and weekly schedule, the blocklists they use, and an identifier of the phone model they apply to.
Onboarding answers: the app categories you said distract you, your estimate of your daily screen time, the strictness you chose and whether you granted the accessibility permission.
Appearance: your theme and your icon style.

Some things stay on your device and are never synced: the name of your phone, the Strict Mode timer, your notification schedule and your time format.

Installed apps

To let you choose what to block, the app reads the list of apps installed on your phone. That list stays on the device. Only the apps that end up in one of your blocklists are saved, including the starter blocklist the app builds from the categories you pick during onboarding.

Accessibility Service

TiedSiren uses the Android Accessibility Service to enforce your blocks. The service tells the app which app is in the foreground and, in a supported browser, what the address bar contains. The app compares both with your blocklists and closes a match while a block session or Strict Mode is running. The address bar is the only on-screen text the app looks at. It does not read your messages, your passwords or the content of a page.

This check runs on your device. Two technical channels can still carry a name out of the phone. The diagnostic trail (see "Diagnostics") records the package name of an app the blocker detected or closed during a session. A session recording (see "Analytics and session recordings") includes the app's technical log, which can name an app or a website the blocker acted on.

You can turn the service off at any time in Android Settings, under Accessibility. Blocking stops until you turn it back on.

Diagnostics

The app sends error reports, warnings and a sample of performance measurements to Sentry, so that we can find and fix bugs. A report contains:

your user ID, your account email address and your IP address, so that we can find the report that matches a support request
the phone model, the Android version, the app version and the country set on the device
the error or the warning itself
a trail of the technical events that led to it. The trail can contain the package names of the apps in your blocklists, the package name of an app the blocker detected or closed during a session, and the name of that session

The trail does not contain the addresses of the websites you visit.

Analytics and session recordings

To understand how the app is used, it sends usage events to Google Analytics for Firebase and to PostHog, filed under your user ID:

when you open the app, and the screens you open in it
the steps of onboarding, of sign-up (with the method, email or Google), of the paywall and of a purchase
the creation of a blocklist, and the creation, start and stop of a block session, with its repeat type and the number of blocklists it uses
the start of Strict Mode, with its duration
three account properties: your strictness level, your onboarding status and whether you have a subscription

These events do not contain the names of your apps, websites, keywords, blocklists or sessions.

PostHog also records sessions of the app: screenshots of TiedSiren's own screens as you use them, so that we can replay a problem. A recording shows what those screens show, including your blocklists and what you type in the app. Password fields are always masked. A recording also includes the app's technical log, which can name an app or a website the blocker acted on while the recording ran. Recordings cover TiedSiren only, never another app.

Purchases and support

Purchases: subscriptions are sold through Google Play and managed with RevenueCat. RevenueCat receives your user ID and the state of your purchases. Google Play processes the payment, and we never see your card details.
Support chat: when you open the support chat in the app, your user ID and your email address are passed to Crisp, our chat provider, with the messages you send.

Other requests the app makes

Feature flags: your email address is sent to Firebase Remote Config, which tells the app which features are switched on for your account.
Account emails: verification, password reset and welcome emails are sent by our server at tiedsiren.com through Resend, to your email address.
Website icons: when you add a website to a blocklist, the app loads its icon from Google's favicon service, which receives the domain name of that site.
App updates: the app asks Expo's update service whether a newer version of its code exists. That request describes the installed build, not your account.

2. Data this website collects

Waitlist: the email address you submit, stored with Resend. The campaign parameters of your first visit (the UTM tags and the page you landed on) are recorded with it in our server logs.
Audience measurement: Vercel Analytics and Vercel Speed Insights count visits and measure loading times without cookies. PostHog counts page views, and stores nothing in your browser until you accept analytics cookies.
Support chat: the chat widget is provided by Crisp. It receives the messages you send and keeps a session identifier in your browser, so that a conversation survives a page change.
Server logs: our host, Vercel, logs each request with its IP address and browser details.

3. Cookies and browser storage

The site works whatever you answer to the cookie banner. You can change your answer at any time with "Cookie settings" in the footer.

Always: your cookie choice, your light or dark theme and the campaign parameters of your first visit are kept in your browser's local storage. The chat widget keeps its session identifier.
If you decline, or do not answer: Google Analytics and Google Tag Manager, where enabled, run in consent mode: they set no cookie and send only cookieless measurements.
If you accept: Google Analytics and Google Tag Manager may set analytics and advertising measurement cookies. PostHog keeps an identifier in a cookie and in local storage, and records your session on the site.

4. Who processes your data

We share your data only with the companies below, which process it for us to run the app and the site.

Google: Firebase Authentication, Google Sign-In, Google Analytics for Firebase, Firebase Remote Config, Google Play billing, the favicon service, and Google Analytics and Tag Manager on the site.
Supabase: the database that stores your synced data.
PowerSync: the service that syncs that data between your devices and the database.
Sentry: error and performance diagnostics.
PostHog: usage analytics and session recordings.
RevenueCat: subscription management.
Crisp: support chat.
Resend: account emails and the waitlist.
Vercel: website hosting, server logs and audience measurement.
Expo: app updates.

Some of these companies process data outside the European Economic Area, including in the United States.

5. Storage and security

Everything the app and the site send travels over an encrypted connection (HTTPS/TLS). On your phone, the sign-in session is encrypted with a key kept in the Android Keystore. The local database of the app is protected by the Android app sandbox and by the storage encryption of the device; we do not add a second layer of encryption to it. On our servers, access rules let an account read and change only its own records.

6. How long we keep it

Sign-in account: until you delete your account.
Synced data: until it is erased, see "Deleting your account".
Diagnostic, analytics, purchase, support and waitlist records: for the retention period of the provider that holds them.

7. Deleting your account

You can delete your TiedSiren account from the app:

Open TiedSiren.
Go to Settings.
Tap "Delete Account".
Sign in again when asked, then confirm with "Delete My Account".

An account cannot be deleted while Strict Mode is running. Wait for the timer to end.

Deletion cannot be undone. It removes your sign-in account (email address and user ID), and your blocklists and block sessions from your device. Copies of your synced data can remain on our servers. Our providers keep their diagnostic, analytics, purchase and support records for their own retention period.

To have what remains erased, or to delete an account you cannot open, write from the email address of the account to privacy@tiedsiren.com.

8. Children's privacy

TiedSiren is not directed at children under 13, and we do not knowingly collect personal data from them.

9. Changes to this policy

We may update this policy. The date at the top of this page is the date of its last change.

10. Contact

For a question about this policy or about your data, write to privacy@tiedsiren.com.