Privacy Policy

This policy covers the Touch Grass iOS app and this website. The short version: we collect the minimum a screen-time competition needs, your daily total minutes and a profile, and we structurally cannot see which apps you use.

What we collect

• Account: you sign in with Sign in with Apple. We store the resulting account identifier. No password, and, if you use Apple's email hiding, no personal email.
• Profile: the username you choose, an emoji avatar, your timezone, and your daily screen-time goal.
• Screen-time totals: one number per day, your total device usage in minutes, approximated on-device from Apple's Screen Time framework. Weekly totals, streaks, XP, levels, and milestones are derived from these.
• Push token: if you enable notifications, the device token needed to deliver them.
• Invite attribution: invite links use Branch to attribute an app install to the friend who sent it; that attribution is used only to connect the two accounts in-app.
• Waitlist phone number: if you join the waitlist on this site, we collect your phone number (E.164 format) and verify it via Twilio Verify SMS one-time passcode. We text a one-time code to confirm this number when you join. Not a marketing text.
• Marketing consent: when joining the waitlist, you may opt in to receive occasional league update texts. This is optional, unchecked by default, 18+ only, and not required to join. We collect the consent flag now. No marketing texts from this opt-in. You can withdraw consent at any time by replying STOP to any marketing text.
• Waitlist referrals: when you join the waitlist, we create a personal invite link for you. If you joined through someone else's link, we store which link brought you and any campaign tags (UTM) in the address you arrived from. We also count taps on the share buttons on this site. We use this only to credit invites and to see which links and posts bring people in. We don't sell it or show it to anyone else. Share events store the ref code, button type, page path, and timestamp. We do not store IP addresses or user agents in share events.

What we never collect

• Per-app usage. Which apps or websites you use never leaves your device. Apple's Screen Time framework does not permit apps to export it, and our design doesn't want it. The exact per-app breakdown you see on your own dashboard is rendered on-device by Apple's sandboxed report extension.
• Contacts, location, browsing history, message content, or advertising identifiers.

Who sees your data

• Your friends see your username, avatar, and weekly total minutes on shared leaderboards.
• Global leaderboard participants see username, avatar, and weekly total. Usernames are self-chosen; pick an alias if you prefer.
• Nobody else. We don't sell data, run ads, or share data with third parties beyond the infrastructure below.

Where it lives

Backend data is stored with Supabase (managed Postgres) with row-level security: your daily records are readable only by your account; leaderboards expose only weekly totals. Notifications are delivered through Apple's Push Notification service.

This website uses Vercel Analytics and Speed Insights, which collect aggregate page performance and visit metrics. These analytics measure site performance and usage, not your screen-time data.

Our hosting provider keeps standard request logs, which include IP addresses, for a short period for security and operations.

To stop abuse of sign-ups, verification codes, sharing, and stats, we keep rate-limit counters based on a hashed form of your IP address and, when you request a verification code, your phone number. We delete each counter within 1 hour of your last request. The counters are stored separately from your account and share events, and we don't use them for anything else.

Sharing reels

Recap videos are rendered on your device and shared only when you choose to share them. A victory reel may include your friends' usernames and avatars as shown on your leaderboard.

Deletion

Settings → Delete Account removes your account, usage history, milestones, and push tokens from our servers immediately and permanently. You can also emailhello@timetotouchgrass.com and we'll do it for you.

Age requirement

Touch Grass requires users to be at least 13 years old. The app uses Apple's individual (non-parental) Screen Time authorization only — no family controls, no guardian/child pairing.

Report abuse

To report offensive usernames, harassment, or inappropriate conduct, use the "Report a User" button in Settings or emailabuse@timetotouchgrass.com. We investigate all reports and may suspend or remove accounts that violate our terms of service.

Changes

We'll update this page when the policy changes and note the date above. Material changes get an in-app notice.

Contact

General inquiries: hello@timetotouchgrass.com
Report abuse: abuse@timetotouchgrass.com