Flyback Privacy Policy
Effective: 11 November 2026
Data controller: Berthin Saragih (individual developer, Indonesia). Contact: bsaragih15@gmail.com
In short
Flyback has no accounts. Your schedules, chosen apps and protection history stay on your phone. The Flyback server receives only two things: proof of a subscription purchase (to verify Plus) and anonymous statistics. Anonymous statistics are sent only if you turn them on.
Data processed on your phone (not sent)
| Data | Why | Source |
|---|---|---|
| Package name of the app that is open (Android) | To show the pause screen for the apps you chose, on your schedule | Accessibility permission |
| Tokens for chosen apps (iOS) | Screen Time shield | Screen Time permission; iOS does not give app names to Flyback |
| Routines, modes, chosen apps, reasons for Open briefly | To run your rules | What you enter |
| Daily protection history (up to 90 days) | Your week, and the bird's tree | Recorded by Flyback |
| Minutes in your chosen apps (Android, optional) | Comparison in Your week | Usage access permission |
Flyback does not read screen content, messages, typing, passwords, screenshots, the camera, the microphone, contacts or location. The data above is not included in automatic cloud backups.
Accessibility permission (Android)
Flyback uses the Android Accessibility API for one thing only: knowing which app is open, so the pause screen can appear when you open an app you chose, during a schedule you created. Flyback reads only that app's package name. This is processed on your phone, is not sent to a server, is not sold and is not shared with anyone. You can revoke the permission at any time in Settings › Accessibility.
Data sent to the Flyback server
- Installation identity: a random ID and a secret key created on your phone when the app first opens. Not your name, email or phone number. The server stores only a hash of the secret key, with the time the app last contacted the server.
- Proof of purchase: a Google Play purchase token or App Store transaction ID. Used to verify the subscription with Google or Apple and to receive renewal, cancellation or refund notices.
- Anonymous statistics (optional, off by default): counts of events such as "session finished" or "pause screen shown", with app version, platform, date and grouped categories (for example a duration of 25–49 minutes, or an install age of 1, 7, 14 or 30 days and whether protection ran that day). No app names, schedules, reasons or free text. The server stores aggregate counts.
This data is not sold and is not shared for advertising. Flyback contains no ads and no third-party tracking SDKs.
Processors and data location
| Party | Role | Location |
|---|---|---|
| Vercel Inc. | Runs the Flyback server and this website | Seoul, South Korea |
| Supabase Inc. | Flyback server database | Seoul, South Korea |
| Google LLC | Google Play Billing and purchase verification | Per Google's policy |
| Apple Inc. | App Store and purchase verification | Per Apple's policy |
Because the server is outside Indonesia, the data sent to it (installation identity, proof of purchase and anonymous statistics) is transferred outside Indonesia. We only use providers that encrypt data in transit and at rest, and we send only the minimum data listed above.
Retention and deletion
- Data on your phone stays until you delete it or remove the app.
- Profile › Privacy and data › Delete all data deletes the data on your phone and asks the server to delete all data for this installation, namely the purchase link and its contribution to statistics. If you are offline, the server deletion is retried automatically each time Flyback opens.
- Installation data on the server that is inactive for 13 months is deleted automatically, including when the app has been removed from the phone.
- Aggregate statistics that are no longer linked to any installation may be kept longer to see trends.
- The fact that the free trial was used stays recorded on the phone so the trial does not repeat.
- Deleting data does not cancel a subscription. Cancel in Google Play or the App Store.
Security
All communication with the server uses HTTPS. Every request to the server is authenticated with the installation's secret key. The subscription status from the server is digitally signed, so it cannot be faked on the phone.
Your rights
You can:
- revoke the Accessibility, Screen Time, Usage access and notification permissions at any time in Settings;
- turn anonymous statistics off;
- delete the data on your phone and on the server from inside the app.
For other requests about your personal data (access, correction or objection), email bsaragih15@gmail.com. Include your Google Play or App Store order ID if it concerns a purchase. We will never ask for a password or OTP.
Age
Flyback is intended for people aged 18 and over who manage their own phone use. Flyback is not directed at children and does not knowingly process children's data.
Changes
Changes to this policy will be announced on this page and in the app before they take effect. The date at the top shows the version in force.