Privacy Policy

1. Data We Collect

1.1 Usage Telemetry

When you pass through Router's Gateway, we collect telemetry about what happens — for example which guarded app you were opening, what you did next, and when — to understand how Router is used and whether it is helping. This applies to adult users only (see Section 7).

The same telemetry covers how you move through Router's own screens, including its subscription screens: whether the paywall was shown, whether you started or completed a purchase, and whether a subscription lapsed. These records name no app, no price and no transaction — only that the step happened.

How it's identified. Your activity is recorded against a short-lived random identifier created on your device. It isn't derived from your Apple Account, and it changes regularly.

How it links to you. Once you're signed in, we keep a record of which of those identifiers belong to your account, held apart from the activity itself. This means we can connect your activity to you, and to itself over time. Because of that, telemetry is pseudonymised, not legally "anonymous" under UK GDPR: it remains personal data, and this policy (and your rights under Section 6) apply to it.

What we use that link for. Three purposes only:

1. Your rights and deletion. Finding, exporting, correcting and deleting your telemetry when you ask (Section 6), and deleting it when you delete your account or when its retention period ends (Section 8).
2. Checking your choices are honoured. Confirming that what we store matches the privacy settings on your account.
3. Understanding Router over time. Whether people keep using Router, and whether patterns of guarded-app opens change over weeks and months. Router's effect can't be judged from a single session, so this needs your activity connected over time. For that we use a separate analytics key, which is not your name, email address or Apple identifier; the people doing the analysis work with that key alone.

What we don't do. We don't use telemetry to advertise, we don't sell it or share it with data brokers, and we don't use it to make decisions about you that have legal or similarly significant effects. Our analysis is designed to answer questions about groups of users; we don't use it to look at what a particular named person does, except when handling your own request under Section 6.

Your control. Usage telemetry is on by default for adults and can be turned off at any time in Settings, which stops any further telemetry being sent. Telemetry we have already received is no longer included in our analysis, but stays until its retention period ends (Section 8) unless you ask us to delete it — email us and we will, without closing your account. See "Your right to object" in Section 6.

1.2 Account Information

Signing in with Apple is optional. You can use Router, including its paid features, without an account. An account is what the features involving us need — contributing to the shared app catalog, taking part in impact studies, the in-app support forms, and the beta programme. If you don't sign in, nothing else in this section applies to you: we hold no identifier, no email, no display name and no session for you, because there is nothing to hold them against.

We receive and store your stable Apple-issued identifier, and your email address and display name if Apple provides them. We also hold a signal from Apple about whether you appear to be a real person rather than an automated sign-up, used only to prevent abuse; an identifier we generate so that App Store purchases can be matched to your account (Section 1.4); a credential from Apple that exists solely so that we can disconnect Router from your Apple Account when you delete your account; and a record of your current sign-in sessions, so that you can sign out of your devices remotely.

Account information is held apart from usage telemetry. The only connection between the two is the account link described in Section 1.1, used only for the purposes listed there. Your email is used only for product purposes (account recovery, replying to support requests you send us); it is not used to identify or link telemetry, purchase, or crash-diagnostic activity back to you, and it isn't available to the people analysing telemetry.

1.3 App Catalog and In-App Content

Router recognises the apps you guard using a shared catalog that users help build.

Suggesting an app. If you suggest an app for the catalog, that suggestion is shared with us: the app's name and how to open it, along with your device model, iOS version, Router version, a device identifier and your account identifier. The notice on the screen where you add a custom app tells you what is sent before you send it. We rely on our legitimate interest in a working shared catalog (Section 3), and you can object by not suggesting apps, or by email.

Why your account is attached. Your account identifier is kept with the suggestion for two reasons: it tells us a real account stands behind it, and it is what makes the suggestion findable — and so deletable — when you exercise your rights under Section 6.

Website addresses are redacted. Most apps can be opened by a link that only that app is able to claim, and we keep those. A few can only be reached through an ordinary web address, sometimes a particular one, and we do not record those at all: a web address is much easier to abuse, so we keep none of them. Any that were recorded before 21 September 2026, when this changed, have been erased.

Looking an app up. Searching the catalog, and checking that a stored link still works, are how Router recognises the apps you already use, so neither is gated by any choice you make. A lookup does tell us which app you are looking for, under a device identifier, so it is disclosed here rather than treated as invisible.

Loading Router's own content. Router periodically fetches the text the Gateway shows you, and the list of alternative digital activities it can suggest instead. The request carries no identifier, no account and no search term, and what comes back is the same for everyone, so the only thing it tells us is that a copy of Router checked for an update.

1.4 Subscription Records

When you subscribe, Apple handles the payment and tells us that your account is entitled. We keep a record of that against your account: what was granted, when it started, when it expires, and whether it was renewed, refunded or revoked. We also store the identifier we give Apple with your purchase, which is what lets a renewal later on be matched back to your account.

We do not receive or store your payment details. No card number, no billing address, no bank details — those stay between you and Apple. We cannot see them and we could not disclose them if asked.

What Apple learns, and what Apple tells us. Because every purchase carries the identifier above, Apple is able to associate your App Store account with your Router account. In the other direction, Apple notifies us whenever your subscription changes — a renewal, an expiry, a billing problem, a refund, a revocation — for as long as the subscription exists. Apple acts as an independent controller for the purchase itself, under its own privacy policy; we are the controller for the record we keep.

If you ask Apple for a refund. Apple decides refunds, and it may ask us for information to help it decide. We answer with the purchase identifier above, how long your account has existed, how much has been spent and how much has already been refunded, whether the subscription had been working normally, and whether the account has since been deleted. We never hold a price, so the two amounts go as the broad bands Apple asks for rather than as figures. Apple is the only recipient. We rely on our legitimate interest in refund requests being decided fairly (Section 3).

If you subscribe without signing in, the subscription belongs to your Apple Account alone. Apple still tells us about it — a renewal, an expiry, a refund — but with no account at our end there is nothing for those messages to attach to, so they sit unmatched and are deleted 6 years after we receive them (Section 8). We cannot tell whose they are. If you sign in later, your subscription is recorded against your account from that point.

These records are retained for 6 years following account deletion, because they may be needed to resolve a future billing dispute (see Section 8).

1.5 Crash Diagnostics

We use Sentry to catch and diagnose crashes. No identity information is attached to these reports (no name, email, or account identifier), and Sentry does not receive your Apple identity. However, crash reports can include contextual detail like which guarded app you were opening at the time, or which screen you were on — this is content-level detail, not identity, but it's still worth knowing it's there. Sentry data is hosted in the EU and kept for 30 days.

Crash diagnostics are on by default for all users, adult and under-18 alike, and can be turned off in Settings (opt-out). It is one of two things described in Section 7 that are not restricted by age — see there for the other, and for why neither is.

1.6 Support & Feedback

If you send us a bug report, feature request, or general feedback through the app, your message is delivered via our backend to our support inbox. Our backend doesn't store the content of your message — it passes through and isn't logged there. The message and your email address are kept in our support inbox for 24 months from the day we receive them, and sent messages also sit in Resend's own dashboard and logs for 30 days (see Section 9). We do keep a minimal record of the fact that you sent something — your account, the type of message, and the time — solely to prevent abuse of the channel; this record is deleted after 30 days, or when you delete your account if sooner. Your email address is used only to let us reply to you. Your app version, OS version, and device model are included so we can diagnose your issue.

The in-app forms need an account, because they relay your message through our backend, and that channel has to be protected from abuse. You can also email us directly at feedback@tryrouter.co without an account; a message sent that way reaches the same inbox and is kept for the same 24 months from the day we receive it. Mail you send to our general address instead (Section 15) is correspondence rather than support, and is kept for as long as the matter it concerns requires.

Sending a message is unaffected by your analytics or crash-diagnostics settings — it's correspondence you've chosen to send us, not passive telemetry, so it isn't gated by those toggles.

1.7 Your Choices and Agreements

When you make or change a privacy choice in Router (usage analytics, crash diagnostics), we record the decision against your account: which choice it was, what you chose, when, which version of this policy was in force at the time, and the app version you were using. This lets us show later what you were asked and what you chose, honour your choices, and check that what we store matches them. For users under 18 or of unknown age, the app switches analytics off automatically, and the record shows that this was the age restriction rather than a choice; it does not include your date of birth. These records need an account and are kept for 6 years following account deletion (Section 8).

We keep the same kind of record when you accept our Terms of Service — when you sign in, or when the app asks you to accept updated Terms: which version you accepted, when, and how. It is kept for the same 6 years following account deletion, as evidence of what you agreed to.

2. Data We Do Not Collect or Process Off-Device

The following stay entirely on your device and are never transmitted to our servers:

• Authentication credentials — handled by Apple's Sign in with Apple / Face ID / Touch ID, on-device.
• Private intentions — any reflective notes, reasons, or personal context you enter in the Gateway stay local to your device.
• Date of birth — collected for on-device age-appropriate configuration only, never transmitted off-device. The one trace of it is the record described in Section 1.7, which notes when analytics was switched off automatically because of age.
• Emotional entry point selection — which route you choose in the Gateway (anxiety, boredom, dread, loneliness, killing time) is used to power your own in-app savings and behaviour dashboards, entirely on-device. It is never sent to us. If you're signed out entirely, none of your Gateway activity reaches our servers at all — see Section 6.

Your own device backups. What Router keeps on your device is part of the app's data, so it is included in your device's own backups — your date of birth, your usage history, and the notes and route choices described above. Those backups are yours rather than ours: they are made by your device under Apple's terms, we cannot read them, and nothing in them reaches us. What is deliberately kept out is anything that could sign you in — your credentials and your current session are excluded, so a restored backup cannot be used to get into your account.

Your payment details never reach us either, and that is worth stating in the same breath even though it works differently: card numbers, billing addresses and bank details are handled entirely by Apple (Section 1.4). They are not held on your device by Router and they are not held by us anywhere.

3. Legal Basis for Processing

Under the UK GDPR, and the EU GDPR where it applies to you, we rely on:

• Contract (Art. 6(1)(b)) — account creation, subscription and entitlement records, and delivering core app functionality, including the catalog lookups and content loading necessary for the app to work.
• Legal obligation (Art. 6(1)(c)) — handling your rights requests (Section 6), including carrying out access, correction and deletion.
• Legitimate interests (Art. 6(1)(f)) — usage telemetry (adults only, opt-out): our interest is knowing whether Router's intervention works, including whether its effect holds over weeks and months, and finding where the design makes things worse rather than better. We can't answer either question without measurement.
• Legitimate interests (Art. 6(1)(f)) — crash diagnostics (all ages, opt-out): our interest is finding and fixing crashes, which we would otherwise never see.
• Legitimate interests (Art. 6(1)(f)) — catalog suggestions: our interest is a shared catalog that recognises the apps people actually use, which only exists because users help build it. The notice on the custom-app screen is how we tell you what is sent before it is sent; you can object by not suggesting apps, or by email.
• Legitimate interests (Art. 6(1)(f)) — answering Apple's refund enquiries: our interest is that refund requests are decided fairly, which needs the account history that only we hold. Withholding it would not help you — it would leave Apple deciding your refund with less to go on.
• Legitimate interests (Art. 6(1)(f)) — support correspondence: our interest is answering the messages you choose to send us, including from someone whose account has since been deleted.
• Legitimate interests (Art. 6(1)(f)) — device attestation and abuse prevention: our interest is keeping the shared app catalog and our servers usable and free from abuse. Checking that requests come from a genuine copy of Router is part of how we do this.
• Legitimate interests (Art. 6(1)(f)) — records of your choices and agreements, and subscription records: our interest is being able to show that our processing was lawful, that you were told what you were agreeing to, and to establish, exercise or defend legal claims, including after an account is deleted (Section 8). We also use those records to check that what we store matches your choices. The same interest covers the messages Apple sends us about a subscription bought without an account (Section 1.4): we cannot attribute them to anyone, and we keep them only so that a dispute about that subscription can be answered if one ever arises.
• Consent — no processing described in this policy relies on consent as its lawful basis. Usage telemetry and crash diagnostics rest on legitimate interests, and the switches in Settings are how you exercise your right to object to them (Section 6) rather than permissions you have granted; we keep records of those choices for the reasons in Section 1.7. Usage telemetry is never offered to under-18 or unknown-age users at all, whatever any switch says (see Section 7). We do not currently collect any Article 9 special category data — the emotional entry point stays on-device (see Section 2) — so no Art. 9 basis is presently engaged; if that changes, this policy will be updated before it does.

For usage telemetry and crash diagnostics, we have balanced our interest against your right to privacy: the data is pseudonymised or carries no identity, and can be switched off at any time. The other purposes involve no behavioural data. In every case you can object; see "Your right to object" in Section 6.

4. Data Separation & Security

• Account data is stored separately from usage telemetry. The only connection between them is the account link described in Section 1.1, used only for the three purposes listed there.
• Analysis of telemetry is carried out on the separate analytics key described in Section 1.1, without access to your name, email address or Apple identifier.
• Data is encrypted in transit and at rest, and the most sensitive items — the credential we hold from Apple, and your session records — carry further protection on top of that.
• Access to systems capable of connecting telemetry to identity is restricted to personnel who need it to operate or support the service.

5. International Data Transfers

Our database is hosted in the UK (London), our servers run in the UK by default, and Sentry (crash diagnostics) is hosted in the EU. However, our providers are US-based companies. Their staff and subprocessors may access data from, or process it in, the United States, and our hosting provider may occasionally use servers outside the UK.

Where that happens, the transfer is covered by a written agreement with the provider. The safeguard in each case:

• Vercel (hosting) — EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Neon (database, contracted through Databricks) — EU Standard Contractual Clauses with the UK Addendum.
• Resend (support email delivery) — EU Standard Contractual Clauses with the UK Addendum, and certification to the EU-US Data Privacy Framework including its UK extension.
• Sentry (crash diagnostics) — certification to the EU-US Data Privacy Framework and its UK extension, with EU Standard Contractual Clauses and the UK Addendum applying instead if that framework ever ceases to cover the transfer.
• Microsoft (support inbox) — certification to the EU-US Data Privacy Framework and its UK extension, together with the Standard Contractual Clauses and UK International Data Transfer Addendum that Microsoft puts in place for transfers out of the UK and the EEA.

Apple is not our processor and makes its own arrangements for the data it holds about you (Section 9).

6. Your Rights

Subject to the UK GDPR, and the EU GDPR where it applies to you, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion
• Restrict certain processing
• Data portability
• Object to processing based on legitimate interests (see below)
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. If you live in the EU or EEA, you can complain to your own country's data protection authority instead.

To exercise these rights, contact us at aj@tryrouter.co. We will respond within one month, which is what the UK and EU GDPR require; if a request turns out to be unusually complex we may extend that by up to two further months, and we will tell you inside the first month if that happens and why.

In practice: if you've never been signed in, or you're currently signed out, your activity is recorded only on your device and never reaches our servers, so for that there is nothing server-side to locate. One thing can reach us without an account. If you subscribed without signing in, Apple's messages about that subscription arrive here unmatched (Section 1.4). We cannot tell whose they are, and we have no way to find them from a name, an email address or an Apple Account — so we cannot act on a request about them, and telling you otherwise would be a promise we could not keep. Signing in is what makes them yours, and findable. An earlier beta period collected a small amount of data before this design was in place; it could not be attributed to any individual and has been deleted. Once you're signed in, we use your account and the link described in Section 1.1 to locate everything associated with you. Anything you have sent us by email or through the in-app support forms is covered by your request too — we search our support inbox by hand, because it sits outside our automated tools — as are the copies described in Section 8.

Your right to object

Where we rely on legitimate interests (Section 3), you have the right to object to that processing, on grounds relating to your particular situation. For usage telemetry and crash diagnostics you can do this at any time with the switches in Settings; we honour it immediately, no further telemetry or crash reports are sent, and telemetry we already hold is no longer included in our analysis. If you also want us to delete what we already hold, email aj@tryrouter.co. For catalog suggestions, you can object by not suggesting apps, and you can ask us to delete any you have already made. For support correspondence, you can stop by not writing to us, and you can ask us to delete a thread. Device attestation and abuse prevention protect the shared catalog for everyone, and a request that isn't attested can't be told apart from an abusive one, so we are likely to have compelling grounds to continue while you use the app; uninstalling the app ends it and destroys the device identifier (Section 8). The records described in Section 8 as surviving account deletion are the other exception: we keep those to defend legal claims, so an objection doesn't stop us keeping them. If we decline an objection, we'll tell you why.

7. Children

Router may be installed and used by children, and no data specifically identifying or sensitive to children is knowingly created, processed, or delivered through the app.

Minimum age. You must be at least 13 to use Router. The app asks for your date of birth when you start and won't let anyone under 13 continue. Because a date of birth can't be verified, anyone we can't verify as an adult is treated as under 18 for the protections below.

Because Router is "likely to be accessed by children" in the ICO's terms, it falls in scope of the UK Age Appropriate Design Code (Children's Code), regardless of whether it's marketed at children. In practice this means:

• For adults: usage analytics and crash diagnostics are both on by default, and each can be individually turned off in Settings (opt-out).
• For under-18 and unknown-age users: usage analytics is never offered, and no telemetry about how you use Router is ever collected or transmitted. There is no toggle, because there is nothing to toggle. No such link is created either, since there is no telemetry to link.
• Two things are available at every age, and in both cases withholding them from a young person would work against their interests rather than for them. The first is crash diagnostics, on by default and switchable off, the same as for adults: an app whose crashes we can never see for a child specifically gives that child a worse, buggier experience. The second is suggesting an app for the catalog, which stays available because it is how a young person gets an app they want to control recognised by Router for everyone. A suggestion is a fact about an app — its name and how to open it — not a record of anything the person did, and blocking it would protect nobody.
• No profiling or telemetry-driven "nudging" is used to encourage engagement beyond the wellness purpose of the app.
• No use of usage data for advertising, and no sharing with data brokers.
• Geolocation is not collected.
• Parental-control context (FamilyControls) is used only for its intended screen-time purpose.

8. Data Retention

• Account data: when you delete your account in the app, it closes immediately: you're signed out and we revoke Router's access to your Apple Account. We keep your account details and activity — including your telemetry and the account link (Section 1.1) — for 90 days so you can restore your account by signing in again with the same Apple Account; after that they are permanently erased. Restoring brings back your account, your subscription and your activity on our servers, but not the history stored on your device. If you ask us by email to delete your data, we erase it straight away, with no 90-day hold. In both cases we keep a minimal record — your Apple-issued account identifier, an internal token used to match App Store purchases to your account, and the dates your account was created and deleted — alongside your subscription records and the records of your choices and agreements (below), and delete it with them.
• Usage telemetry: retained on a rolling basis for 24 months from creation, after which granular records are deleted.
• Account link: deleted with your account data, and otherwise once the telemetry it points to has been deleted.
• Analytics identifier: deleted along with your account data.
• Device identifier: Router keeps a key in your device's secure hardware, used to prove that requests come from a genuine copy of the app. It is destroyed when you uninstall Router, and a reinstall is issued a fresh one — but nothing short of uninstalling removes it: it survives signing out, resetting Router from inside the app, and deleting your account. Our side of it is deleted after 24 months without use. A device identifier based on it also stays on any catalog suggestion you have made. If you ask us to erase your data we remove that identifier from the suggestion but keep the suggestion itself, because it is what records that an app's link works on a real device, and removing it would take that evidence away from a catalog entry other people rely on.
• Subscription records: retained for 6 years following account deletion, for the purpose of resolving billing disputes — the same statutory basis as ordinary financial recordkeeping (Companies Act 2006 / HMRC guidance). This covers the ledger and the notifications Apple sends us about your subscription. Notifications that reach us but never match an account are deleted 6 years after we receive them.
• Records of your choices and agreements (Section 1.7): retained for 6 years following account deletion on the same dispute-resolution and lawfulness-evidence basis as subscription records, even past account deletion — this is what lets us demonstrate that processing was lawful, and what you agreed to, if either is ever questioned.
• Catalog suggestions (app version, OS version, device model): retained indefinitely to support long-term product quality. The device identifier attached to a suggestion is redacted 24 months after it is made, and the account identifier on it is removed at the same time, so what remains after that is not linked back to a specific device or person.
• Support send-stamps: deleted after 30 days, or on account deletion if sooner.
• Support messages: kept in our support inbox for 24 months from the day we receive them; see Section 1.6 for Resend's copy.
• Crash diagnostics: kept by Sentry for 30 days.
• Apple credential: we revoke Router's access to your Apple Account when you delete your account. If that fails, we retry for up to 30 days and then delete the stored credential regardless.
• Backups: deleted data may persist in encrypted backups for up to 7 days before it is overwritten.
• Apple's own records: Apple keeps its own sales and customer records for App Store purchases, under its own privacy policy and as an independent controller. Those are Apple's to keep or delete, not ours, and a request to us cannot reach them.

9. Third-Party Processors

We use the following third parties to operate Router, each acting as a data processor under contract, except where noted:

• Apple — Sign in with Apple, FamilyControls/DeviceActivity, and In-App Purchase. Apple does not act as our processor: it is an independent controller under its own privacy policy for Sign in with Apple and for App Store purchases. Apple is also the recipient of the refund information described in Section 1.4, in the cases where it asks us for it.
• Vercel — hosting/functions. Vercel keeps short-lived server logs of requests to our servers, which can include IP addresses and the text of a catalog search, for 30 days. Vercel also acts as a controller, rather than as our processor, for data it generates about how we use its own platform.
• Neon — database
• Resend — delivers the support/feedback messages you send us to our inbox; note that sent messages also sit in Resend's own dashboard/logs, so their retention practices apply alongside ours
• Microsoft (Microsoft 365) — hosts our support inbox, in the UK
• GoDaddy — the reseller through which our Microsoft 365 subscription, and so our support inbox, is provided and administered
• Sentry — crash reporting and bug diagnostics, EU-hosted

9a. Cookies & Similar Technologies

The Router app and the tryrouter.co website do not currently use cookies or similar tracking technologies. If this changes in future (e.g. website analytics), we'll update this policy and, where legally required, request your consent via a cookie banner before any non-essential cookie is set.

10. Changes to This Policy

We'll update the "last updated" date above and, for material changes, notify you via the app or email.