Privacy Policy

Effective date: 2026-09-22 · Last updated: 2026-09-25

Summary

• What VerbKey does: gates apps you choose (Instagram, TikTok, and so on) behind short language-learning exercises, so you earn screen time by practising irregular verbs in Spanish, English, or French.
• Your Screen Time data never leaves your iPhone. The apps you chose to gate, how often you open them, and the screen time you earn are stored only on your device. They are never transmitted, and I cannot read them.
• Your learning progress stays on your device unless you sign in. If you sign in, it is backed up to your account so that it survives a reinstall or a new phone.
• An account is optional. You can use VerbKey without one. If you choose to sign in with Apple or Google, I hold your email address, your name if the provider shares it, and an account ID — never a password. You can delete your account in the app at any time.
• Subscriptions are pseudonymous unless you sign in. Buying a subscription creates a random identifier that is not linked to your name or your Apple ID. If you sign in, your subscription is linked to your account instead.
• No advertising, no analytics SDKs, no data brokers, no tracking. VerbKey shows no ads and does not track you across apps or websites.

Who is responsible for your data

VerbKey is built and operated by Franklin Velásquez, an individual developer, acting as the data controller for the limited processing described below.

Contact: verbkeyapp@gmail.com

What stays on your device and is never collected

The following never leaves your iPhone, whether or not you sign in. It is held on your device and is not transmitted to me or to anyone else:

• Your app selection. When you choose apps to gate, Apple's Family Controls framework returns an opaque FamilyActivitySelection token. The token is meaningless outside Apple's own system — even VerbKey cannot tell which apps you picked or read their names. This is Apple's design, and it is a core part of the privacy promise.
• Your unlock history — when you earned time, and how many minutes.
• What you answer — the words you pick, type or say in exercises.
• Your app usage — how often you open gated apps, or how long you spend in them.

Your learning progress — your streak, how many sessions you have done, and for each verb and exercise how often you got it right or wrong, when you last practised it and when it is due for review — also stays on your device, unless you sign in, in which case it is backed up as described below.

To remove any ambiguity, VerbKey also does not collect your location, contacts, photos, calendar, health data, or camera. The app requests microphone access only for speaking exercises; speech is processed by Apple's on-device speech recognition and is not recorded, stored, or sent to me.

VerbKey does not use cookies and does not track you across other apps or websites. No App Tracking Transparency prompt appears because there is nothing to track.

What is collected, and by whom

Your account (optional)

You can sign in with Apple or Google from the app's Settings. Signing in is never required to use VerbKey or to subscribe. If you do, my Supabase backend creates an account holding:

• your email address, as your sign-in provider shares it. With Sign in with Apple you can choose Hide My Email, in which case I receive only an Apple relay address;
• your name, if the provider shares it. Apple shares it only the first time you sign in, and only if you allow it. Google shares your profile name and a link to your profile picture, which VerbKey does not display;
• an account ID — a random identifier Supabase assigns, and which provider you used;
• sign-in records — when the account was created and last signed in to, and, in Supabase's security logs, the IP address and device details of sign-in requests.

Progress backup. While you are signed in, VerbKey also saves a copy of your learning progress (described above) to your account after each session, and restores it when you sign in on a new install. It contains no answers you gave, only the counts, dates and review schedule derived from them.

I use this only to sign you in, to back up and restore your progress, to link your subscription to your account (below), and to answer you if you contact me. I never receive your Apple or Google password.

Deleting your account. In VerbKey, go to Settings → Account → Delete account. This permanently deletes your account, the backup of your progress, and the copy of your subscription record held in Supabase. The progress on your phone stays there. For Sign in with Apple, it also revokes VerbKey's access to your Apple ID; for Google, it disconnects VerbKey from your Google account. Deleting your account does not cancel your subscription, which belongs to your Apple ID — cancel it in your Apple account settings.

Subscription data

VerbKey is free to download; blocking apps requires a paid subscription. Payment is processed by Apple, and subscription status is managed by RevenueCat.

When you subscribe, RevenueCat assigns your installation a random anonymous identifier. VerbKey never gives RevenueCat your name, email address, or Apple ID. If you sign in, VerbKey tells RevenueCat your account ID instead, so that your subscription follows your account; because that ID belongs to your account, your subscription is then linked to the email address held with it. Against that identifier, the following is recorded:

• which product you bought, and from which store
• whether the subscription is currently active, and when it expires
• Apple's original transaction identifier
• whether the purchase was made in the sandbox or production environment
• the price paid, its currency, and your App Store country

To process purchases, RevenueCat also receives technical details that accompany any request from the app, such as your IP address and your app and iOS versions.

A copy of this subscription record is stored in my own Supabase database so that entitlements survive a reinstall.

When a purchase, renewal, cancellation or refund happens, I receive an automated message through a messaging service I use for internal alerts. It contains only the event type, product, price, currency, store, and App Store country — no subscriber identifier and no personal information.

I never see your credit card details, billing address, or Apple ID. Apple does not share them with me.

Update and configuration checks

When VerbKey starts, it asks my Supabase backend for the minimum supported app version, so that a broken release can be corrected. This is a read-only request that sends no information about you. As with any internet request, the server necessarily sees the originating IP address and processes it transiently to serve the response.

VerbKey also checks Expo's update service for bug fixes and content updates that can be delivered without a new App Store release. That request carries your IP address, your platform and app version, and a random identifier that Expo generates for this installation to roll updates out gradually. The identifier is not linked to your name, your Apple ID, or your subscription.

Diagnostics

VerbKey integrates no crash-reporting or analytics SDK. If you choose to share crash diagnostics with developers in your iOS settings, Apple may provide me with aggregated crash reports — device model, iOS version, and where the crash occurred. These come from Apple, contain nothing about your gated apps or your exercise activity, and are not linked to you.

If I add crash reporting or analytics in a future version, this policy will be updated and the provider named here before the feature ships.

Third parties I share data with

These are the third parties involved, and this is everything they receive. Each provides protections at least equivalent to those described in this policy, as required of me by Apple's App Store Review Guidelines.

I do not sell your personal information, share it with advertisers or data brokers, or use it to build a profile of you. Per Apple's Family Controls framework agreement, VerbKey does not use any device or usage data received through Family Controls for advertising or advertising measurement, or share it with data brokers.

Legal basis for processing

For users in the European Economic Area and the United Kingdom, I rely on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract — processing your subscription record, so that you receive the paid features you bought and can restore them on a new device; and, if you create an account, holding it and your progress backup so that you can sign in, restore your progress, and have your subscription follow you.
• Legitimate interests — the update check that keeps the app working, and the security and integrity of the service. These are minimal and pseudonymous, and do not override your rights.

There is no processing based on consent today, because VerbKey collects nothing that requires it. VerbKey does not carry out automated decision-making or profiling that produces legal or similarly significant effects.

How long data is kept

• On-device data — kept until you delete it in the app or uninstall VerbKey. Deleting the app removes all of it permanently, and I have no copy.
• Your account and progress backup — kept until you delete your account. Deletion is immediate and permanent.
• Subscription records — kept for the life of the subscription and for up to 7 years after it ends, because tax and accounting rules require records of sales to be retained. If you delete your account, the copy in my Supabase database is deleted at once; Apple and RevenueCat keep their own transaction records under their policies.
• Crash diagnostics from Apple, where provided — kept no longer than 12 months.
• Purchase notifications — kept for the same period as subscription records, as part of my sales records.
• Server logs — rotated by Supabase, Expo and Cloudflare under their own retention schedules, typically measured in days.

International transfers

VerbKey is available worldwide, and the providers above operate infrastructure in several countries, including the United States. Where data is transferred out of the European Economic Area or the United Kingdom, that transfer is covered by the providers' Standard Contractual Clauses and equivalent safeguards, as set out in the privacy policies linked in the table above.

Your rights

Wherever you live, you may ask me to:

• Access the data held about you, and receive a copy of it
• Correct anything inaccurate
• Delete it
• Export it in a portable format
• Restrict or object to how it is processed
• Withdraw consent, where processing rests on consent

How to exercise them: email verbkeyapp@gmail.com. I will respond within 30 days. If you have an account, write from its email address. If you don't, your subscription record is pseudonymous, so please include your Apple receipt or original transaction ID so that I can locate the right record — without it I may be unable to identify your data, which is itself a consequence of how little I collect.

To delete your account, use Settings → Account → Delete account in the app — no email needed.

To delete everything held on your device, uninstall VerbKey. If you never created an account, nothing further is required and nothing is retained elsewhere, apart from the pseudonymous subscription record described above.

If you are in the EEA or the UK, you also have the right to lodge a complaint with your national data protection authority.

California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them. I do not sell or share personal information, and never have. Exercise these rights at the same address above. VerbKey is a small independent app that likely falls below the CCPA's applicability thresholds, but these rights are honoured regardless.

Security

Data that never leaves your iPhone is protected by your iPhone — its encryption, its passcode, and iOS's App Group sandbox. This is deliberate: the most sensitive information VerbKey touches is the information it never transmits.

The little that is transmitted travels over encrypted HTTPS connections. The database holding accounts and subscription records is reachable only with credentials I hold, and a signed-in app can read nothing but its own account. No method of transmission or storage is completely secure, and I cannot guarantee absolute security, but the amount of your data exposed to that risk is intentionally close to zero.

Children's privacy

VerbKey is intended for teens and adults. It is not directed at children under 13, or under the minimum age required in your country, and I do not knowingly collect personal information from them. VerbKey is a self-control tool for the person who installs it and is not designed for parents to manage a child's device. If you are a parent or guardian and believe your child has provided me with personal information, contact me and I will delete it.

Links to other sites

VerbKey and this website may link to sites I do not operate, such as Apple's. I am not responsible for their content or privacy practices, and I encourage you to read their policies.

Changes to this policy

I may update this policy as VerbKey changes — for example, if more of what stays on your device today were ever sent to my backend. The Last updated date at the top always reflects the current version, and material changes will be announced in the app before they take effect.

Changelog

Contact

Questions, requests, or corrections about this policy:

Email: verbkeyapp@gmail.com