Privacy Policy

Effective date: 2026-09-22 · Last updated: 2026-09-22

Summary

• What VerbKey does: gates apps you choose (Instagram, TikTok, and so on) behind short language-learning exercises, so you earn screen time by practising irregular verbs in Spanish, English, or French.
• Your Screen Time data never leaves your iPhone. The apps you chose to gate, how often you open them, your exercise answers, and your streak are stored only on your device. They are never transmitted, and I cannot read them.
• VerbKey has no user accounts. There is nothing to sign up for, so I hold no name, no email address, and no password for you.
• Subscriptions are pseudonymous. Buying a subscription creates a random identifier that is not linked to your name or your Apple ID.
• No advertising, no analytics SDKs, no data brokers, no tracking. VerbKey shows no ads and does not track you across apps or websites.

Who is responsible for your data

VerbKey is built and operated by Franklin Velásquez, an individual developer, acting as the data controller for the limited processing described below.

Contact: verbkeyapp@gmail.com

What stays on your device and is never collected

The following never leaves your iPhone. It is held in the app's shared App Group container and is not transmitted to me or to anyone else:

• Your app selection. When you choose apps to gate, Apple's Family Controls framework returns an opaque FamilyActivitySelection token. The token is meaningless outside Apple's own system — even VerbKey cannot tell which apps you picked or read their names. This is Apple's design, and it is a core part of the privacy promise.
• Your unlock history — when you earned time, and how many minutes.
• Your exercise responses — every answer you give, right or wrong.
• Your learning progress — streaks, verb mastery, and scheduling state.
• Your app usage — how often you open gated apps, or how long you spend in them.

To remove any ambiguity, VerbKey also does not collect your location, contacts, photos, calendar, health data, or camera. The app requests microphone access only for speaking exercises; speech is processed by Apple's on-device speech recognition and is not recorded, stored, or sent to me.

VerbKey does not use cookies and does not track you across other apps or websites. No App Tracking Transparency prompt appears because there is nothing to track.

What is collected, and by whom

Subscription data

VerbKey is free to download; blocking apps requires a paid subscription. Payment is processed by Apple, and subscription status is managed by RevenueCat.

When you subscribe, RevenueCat assigns your installation a random anonymous identifier. VerbKey does not attach your name, email address, or Apple ID to it, because it does not have them. Against that identifier, the following is recorded:

• which product you bought, and from which store
• whether the subscription is currently active, and when it expires
• Apple's original transaction identifier
• whether the purchase was made in the sandbox or production environment

A copy of this subscription record is stored in my own Supabase database so that entitlements survive a reinstall, and I receive an automated notification when a purchase happens. That notification contains the same pseudonymous subscription details and no personal information.

I never see your credit card details, billing address, or Apple ID. Apple does not share them with me.

Update and configuration checks

When VerbKey starts, it asks my Supabase backend for the minimum supported app version, so that a broken release can be corrected. This is a read-only request that sends no information about you. As with any internet request, the server necessarily sees the originating IP address and processes it transiently to serve the response.

Diagnostics

VerbKey integrates no crash-reporting or analytics SDK. If you choose to share crash diagnostics with developers in your iOS settings, Apple may provide me with aggregated crash reports — device model, iOS version, and where the crash occurred. These come from Apple, contain nothing about your gated apps or your exercise activity, and are not linked to you.

If I add crash reporting or analytics in a future version, this policy will be updated and the provider named here before the feature ships.

Third parties I share data with

These are the only third parties involved, and this is everything they receive. Each provides protections at least equivalent to those described in this policy, as required of me by Apple's App Store Review Guidelines.

I do not sell your personal information, share it with advertisers or data brokers, or use it to build a profile of you. Per Apple's Family Controls framework agreement, VerbKey does not use any device or usage data received through Family Controls for advertising or advertising measurement, or share it with data brokers.

Legal basis for processing

For users in the European Economic Area and the United Kingdom, I rely on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract — processing your subscription record, so that you receive the paid features you bought and can restore them on a new device.
• Legitimate interests — the update check that keeps the app working, and the security and integrity of the service. These are minimal and pseudonymous, and do not override your rights.

There is no processing based on consent today, because VerbKey collects nothing that requires it. VerbKey does not carry out automated decision-making or profiling that produces legal or similarly significant effects.

How long data is kept

• On-device data — kept until you delete it in the app or uninstall VerbKey. Deleting the app removes all of it permanently, and I have no copy.
• Subscription records — kept for the life of the subscription and for up to 7 years after it ends, because tax and accounting rules require records of sales to be retained.
• Crash diagnostics from Apple, where provided — kept no longer than 12 months.
• Server logs — rotated by Supabase and Cloudflare under their own retention schedules, typically measured in days.

International transfers

VerbKey is available worldwide, and the providers above operate infrastructure in several countries, including the United States. Where data is transferred out of the European Economic Area or the United Kingdom, that transfer is covered by the providers' Standard Contractual Clauses and equivalent safeguards, as set out in the privacy policies linked in the table above.

Your rights

Wherever you live, you may ask me to:

• Access the data held about you, and receive a copy of it
• Correct anything inaccurate
• Delete it
• Export it in a portable format
• Restrict or object to how it is processed
• Withdraw consent, where processing rests on consent

How to exercise them: email verbkeyapp@gmail.com. I will respond within 30 days. Because subscription records are pseudonymous, please include your Apple receipt or original transaction ID so that I can locate the right record — without it I may be unable to identify your data, which is itself a consequence of how little I collect.

To delete everything held on your device, uninstall VerbKey. Nothing further is required, and nothing is retained elsewhere.

If you are in the EEA or the UK, you also have the right to lodge a complaint with your national data protection authority.

California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them. I do not sell or share personal information, and never have. Exercise these rights at the same address above. VerbKey is a small independent app that likely falls below the CCPA's applicability thresholds, but these rights are honoured regardless.

Security

Data that never leaves your iPhone is protected by your iPhone — its encryption, its passcode, and iOS's App Group sandbox. This is deliberate: the most sensitive information VerbKey touches is the information it never transmits.

The little that is transmitted travels over encrypted HTTPS connections, and the subscription database is reachable only with credentials I hold. No method of transmission or storage is completely secure, and I cannot guarantee absolute security, but the amount of your data exposed to that risk is intentionally close to zero.

Children's privacy

VerbKey is rated 13+ and is not directed at children under 13. I do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided me with personal information, contact me and I will delete it.

Links to other sites

VerbKey and this website may link to sites I do not operate, such as Apple's. I am not responsible for their content or privacy practices, and I encourage you to read their policies.

Changes to this policy

I may update this policy as VerbKey changes — particularly if user accounts are added, since that would introduce personal data this policy does not currently describe. The Last updated date at the top always reflects the current version, and material changes will be announced in the app before they take effect.

Changelog

Contact

Questions, requests, or corrections about this policy:

Email: verbkeyapp@gmail.com