Plain-language notice for TrapFree by Ascendify, covering the apps for Mac, Windows, Android, iPhone and iPad, the website and our server. Version: 2026-10-17.
Languages: this notice is in English and Hindi (हिन्दी). To read it in another language of the Eighth Schedule to the Constitution of India, ask our grievance officer (section 13). [DECISION: CA-18 — publish only with the Hindi text; the lawyer decides which version prevails]
1. The short version
- Your browsing stays on your device. TrapFree decides on the device. Our server never receives the addresses of pages you visit, video titles, searches, page content or screenshots.
- Our server keeps what is needed to give you one account on every device: your sign-in, your setup answers, your rules, the minutes you used per sector each day, your doors, your wallet and your plan. Your gender, your age group, where you live (country and state) and your name only if you give them.
- No GPS, ever. TrapFree never asks for your device's location. Where you live comes from your device's country setting, our server's guess from your internet address when you press "Find my state", or what you pick yourself.
- Your days are scored on our server, from what it already keeps. Unless you switch it off, each night our server marks the day before good, hard or neither, from your minutes, doors and passes and whether protection was on, and can adjust your next day's limits by a few minutes (section 4.10). Never your browsing, and never Screen Time data from an iPhone or iPad.
- Diagnostics are technical only (errors, timings, self-checks), kept 30 days. Detailed diagnostics need your opt-in.
- We sell nothing about you, show no ads and use no trackers.
- You can see, export and delete your data at any time.
2. Who we are
Ascendify (proprietor: Aman Krishna Gupta) ("we"), Block No. 13, Phase 2, Maa Narmade Nagar, Bilhari, Jabalpur, Madhya Pradesh 482020, India, [email protected], decides why and how your data is used (in Indian law, the "Data Fiduciary"; in EU and UK law, the "controller"). Data protection contact: Aman Krishna Gupta, [email protected]. Grievance officer: Aman Krishna Gupta, [email protected], Block No. 13, Phase 2, Maa Narmade Nagar, Bilhari, Jabalpur, Madhya Pradesh 482020, India. EU representative: [once appointed]. UK representative: [once appointed].
3. What TrapFree does on your devices
The "How TrapFree works" page (ascendify.pro/trapfree/how-it-works) explains every part in detail.
Setting up (every device)
- The setup has four screens before anything is installed: how strict TrapFree should be (Light, Balanced, Strict or Max, which also sets your daily minutes on YouTube and Instagram); about you: who you are (Male, Female, Other or Rather not say), your age group (18–24, 25–34, 35–44, 45+ or Rather not say; TrapFree is for adults, so there is no younger group) and where you live (country and state); how often six kinds of sites and apps pull you in (Social media, Movies & series, Shopping, Gaming, Betting & gambling, News & browsing), on a slider from 0 to 5; and a summary with Install. After installing you may add your name, for greetings.
- Why we ask about you: your age group and where you live let the setup start with the apps that pull people like you the most: the next screen's sliders, the local apps and sites in each category (for example the short-video apps popular in India, which join Shorts, Reels and TikTok as always blocked), and whether YouTube or Instagram starts with a stricter limit. The starting points come from a table that is the same for everyone with the same answers; you can move every slider, and change or remove every answer later.
- Where you live, without GPS. The app fills in your country from what your device tells every app (on iPhone and iPad the App Store's country, then the device's region; on Android the SIM's or the mobile network's country, then the device's region; on a computer the device's region). Your state is filled in only if you press Find my state: the app then asks our server, which looks up the approximate place of your internet address (the country and the state or region only, from our network provider, Cloudflare) and answers; it stores nothing for it. You can also pick the country and state yourself, or choose "Rather not say". TrapFree never asks for your device's location and never uses GPS.
- "Rather not say" keeps nothing about your gender, your age group or where you live, and the name is optional too. Shorts, Reels, TikTok and adult sites are always blocked, so we never ask about them and keep no level for them.
- Your answers stay on the device until you sign in. Then they go to your account (sections 4.1 and 4.3), so your other devices start the same; if you are already signed in, they go at once. Before that, two requests carry part of them without keeping them: "Find my state" (when you press it) and the request for the starting table for your answers (once, when you press Continue on "About you"; sections 4.1 and 5). You can change your answers, or remove your gender, your age group, where you live or your name, at any time in Settings.
- Each slider is a rule. At any level but the lowest, the category stays closed except while you open it, a number of times a day or a week ("How TrapFree works" explains each device). Each device closes a category on the device itself; our server only keeps the levels and when each open starts and ends, so every device agrees (section 4.3). It never learns which site or app you used.
Adjusting to how your days go (every device)
- Unless you switch it off, each device applies the adjustment our server sets for the day: 10 more minutes on YouTube and Instagram after 3 good days in a row, or a stricter day after 2 hard days in a row (section 4.10; "How TrapFree works" has the rules).
- No device scores a day or sends anything new for it, and no device can give itself extra minutes.
On a computer (Mac today; Windows in development)
- A local filter (mitmproxy, an open-source project) runs on
127.0.0.1:8080. It reads only traffic for youtube.com, googlevideo.com, instagram.com, facebook.com and tiktok.com and their content servers. Every other site — banking, email, work tools — passes through untouched and unread. - A certificate created on your computer lets the filter read those sites. Its private key never leaves your computer and only the system service can read it.
- A watchdog keeps the settings in place (system proxy, hosts entries, firewall rules, DNS).
- While one of your categories is closed, its websites are blocked in the computer's hosts file, as the sites on your block list are; nothing about your visits to them is read or recorded.
- An adult-content filter (a domain list plus Cloudflare for Families DNS, 1.1.1.3), on from setup because adult sites are always blocked, and, optional, strict network mode (VPN and other DNS blocked).
- What the adult filter and strict mode mean for your DNS: with the adult filter on, your computer looks up site addresses at Cloudflare for Families (1.1.1.3) in ordinary, unencrypted DNS. Strict mode also blocks VPN apps (including a work VPN) and encrypted DNS (DNS over TLS, and DNS over HTTPS to the well-known public resolvers), so every lookup goes unencrypted. On a shared or public Wi-Fi network, others on that network can see, and could alter, the names of the sites your computer looks up, and you cannot use a VPN to protect yourself while strict mode is on.
- Decisions (allow, count, block) happen in memory on your computer. Only the page address is checked; nothing from a page is stored or sent. To see the page addresses, the filter decrypts your traffic to YouTube, Instagram, Facebook and TikTok on your computer, so in memory it also sees what you send to those sites, including their sign-in cookies and, when you sign in there, your password. It never stores, logs or sends them.
On Android (in development)
- An Accessibility service, which you switch on after an in-app explanation, watches only YouTube, Instagram, Facebook and TikTok (including Facebook Lite and TikTok Lite) and the browsers Chrome (including Chrome Beta, Dev and Canary), Samsung Internet, Firefox, Edge, Brave and Opera; "How TrapFree works" lists each app's Android package name. It recognises the Shorts and Reels screens and matches browser addresses against your rules. What it reads is processed on the phone and never stored or sent.
- Usage access (as a backup) counts how long YouTube and Instagram are open, on the phone, and tells TrapFree which app is in front, so it can close the apps of a category while it is closed. Which apps you use stays on the phone.
On iPhone and iPad (in development)
- Apple's Screen Time controls, which you approve with Face ID or Touch ID. You pick the apps, and for each category with a limit its apps or Apple's matching category; Apple gives TrapFree only anonymous tokens. Apple does not let TrapFree read your Screen Time reports.
- A Safari extension (you switch it on) blocks Shorts and Reels addresses in Safari and counts time there, on the phone.
4. What we keep on our server
You sign in with a mobile number or an email address and a one-time code. We keep:
4.1 Your account
| Data | Why | Kept for |
|---|---|---|
| Your verified mobile number and/or email (encrypted) | Sign-in, receipts, reminders, support | Until you delete the account |
| Country (from the phone code or your IP address at sign-up) | Prices, tax, legal notices | Until account deletion |
| "Confirmed 18 or older" and the date (not your birth month or year) | The legal age requirement | Until account deletion |
| The age group your birth month and year fall in (never the month or year; two groups in your birth month, when your birthday may still be to come) | Checking the age group you choose in the setup, which your devices send right after you sign up | At most 24 hours after sign-up, or until your setup answers arrive, whichever is first |
| Time zone and language, and when the time zone last changed | Daily rules, notices; the time zone can change once every 7 days | Until account deletion |
| Whether you want product emails | Your choice at sign-up (off unless you tick the box) | Until you change it or delete the account |
| Your gender, only if you give it at setup or in Settings: Male, Female or Other ("Rather not say" keeps nothing) | Where the setup's sliders start on your devices; suggesting settings | Until you change or remove it in Settings, or delete the account (then it is removed at once) |
| Your name, only if you give it after setup or in Settings (encrypted, like your phone number and email) | Greeting you in the apps, for example "Good evening, Aman." | Until you change or remove it in Settings, or delete the account (then it is removed at once) |
| Your age group, only if you give it at setup or in Settings: 18–24, 25–34, 35–44 or 45+ ("Rather not say" keeps nothing). If the month and year of birth you give when you sign up put you in another group than the one you chose, and your answer reaches us within 24 hours of sign-up, we keep the group from your birth date instead (still never the month or year); "Rather not say" is never filled in from it | Where the setup's sliders start and which local apps and limits it starts with; suggesting settings | Until you change or remove it in Settings, or delete the account (then it is removed at once) |
| Where you live, only if you give it at setup or in Settings: your country and your state or region (for example India · Maharashtra), as the app filled them in or as you picked them (section 3, "Where you live, without GPS"; "Rather not say" keeps nothing). This is separate from the country in the row above, which sets prices and tax | Where the setup's sliders start, the local apps and sites it adds to your categories and to the always-blocked rows, and which limits it starts with; suggesting settings | Until you change or remove it in Settings, or delete the account (then it is removed at once) |
Two requests during setup that we keep nothing from. Before you sign in, and before these answers reach your account, two requests carry part of them to our server: "Find my state", only when you press it (no answers in it; our server reads the approximate country and state of the request's internet address and sends them back), and, once, when you press Continue on "About you", the request for the starting table for your answers (your country, state, age group and gender, as codes, and only the ones you gave). Every app makes this second request, signed in or not. Our server answers both and stores nothing for them; only its access log records each request, as it does every request (with the internet address and never your answers; sections 5 and 5a).
4.2 Your devices
| Data | Why | Kept for |
|---|---|---|
| Name, type, model, system version, app and engine versions, public key, first and last seen | Sign-in on several devices, checking that requests really come from your device | Until the device is removed |
| Protection status (on, off or partly on), the reason, which protection layers are working (proxy, certificate, hosts, firewall, DNS), when it last changed, the time of the last check-in | "Protection off" warnings on your other devices; support; whether protection was on all day, for the daily score, and the check that a device whose self-check fails does not report zero use (section 4.10) | Until the device is removed |
| Push-notification token (Apple or Google) | Telling your phone that something changed | Until the device is removed, the token stops working, or account deletion |
| Live Activity tokens (iPhone and iPad): the token Apple gives the app to start the paid-time display on the Lock Screen, and the token of a display that is running, with the paid time it shows (YouTube, Instagram or Verticals, never a block-list site) and when it ends | Showing paid time you spent on another device on this iPhone or iPad (only while we switch this on) | Until the device is removed; a running display's token 1 day after its paid time ends; a token Apple no longer accepts, 30 days |
| Removal requests on computers (requested, window open, cancelled, completed, with times) | Warnings on your other devices; the daily score (section 4.10) | 1 year |
| Support removal keys (device, who issued it, why, how we checked it was you, when used) | Accountability for a support action | 1 year |
4.3 Your rules and settings
| Data | Why | Kept for |
|---|---|---|
| Daily limits (one for YouTube, one for Instagram), a pending raise of each and when it takes effect, and the day's adjustment our server sets (section 4.10) | The same limits on every device | The limits until account deletion; the day's adjustment for that day only |
| The sites on your block list: each domain, until when, the 5-minute peek choice, a scheduled removal, the last peek day | The same block list on every device | Until the site is removed or the account is deleted |
| Adult filter and strict mode for each device (on/off, a scheduled switch-off, since when) | Applying and scheduling them; the daily score, where a switch-off you ask for counts (section 4.10) | Until the device is removed |
| Focus Lock: when it started and when it ends | Locking every device | [13 months] |
| Your setup answers: how strict (Light, Balanced, Strict or Max), a level from 0 to 5 for each of Social media, Movies & series, Shopping, Gaming, Betting & gambling and News & browsing, the version of our suggestion table the sliders started from, and when you answered. Never a level for adult sites: they are always blocked | Setting up TrapFree from your answers, the same on every device; suggesting settings | Until you change them or delete the account (then they are removed at once) |
| Your category rules: for each of the six categories, its level (0 to 5), a looser level that is waiting and the day it applies, the version of our level table, and the opens of the current day or week (when each started and when it ends). Never which site or app you used | Keeping each category closed or open at the same times on every device | The levels until you change them or delete the account; the opens of the current day or week only (older ones are never used again and are removed with the category's next change, or with the account); the live updates that carry them to your devices, 7 days (section 4.9) |
4.4 Your usage and progress
| Data | Why | Kept for |
|---|---|---|
| Usage reports: sector (YouTube, Instagram, or Shorts + Reels), seconds, start and end time, device, sequence number (iPhone and iPad: see below) | One shared daily budget; the daily score, and the checks that a device's reports arrive in order and are not zero while its protection self-check fails (section 4.10; never from an iPhone or iPad) | 30 days |
| The current 24-hour window per sector (start, seconds per device, when it was blocked) | Blocking at the limit on every device; whether a limit was reached before 12:00, for the daily score (section 4.10) | The current window |
| Daily totals: minutes per sector per day, that day's limits, whether a device had protection off that day, and the number of stopped Shorts/Reels/TikTok pages | Progress, streak, focus score, weekly report, the daily score (section 4.10) | 13 months |
| Stopped counts from each device: how many Shorts, Reels and TikTok pages that device stopped on a day (one running number per device and day, and when it last arrived; never which pages, and never when each one was stopped. An iPhone or iPad sends it at most once an hour, so from it we can tell roughly the hour, never the minute) | Adding each device's count to the daily total once, even if it is sent again | 16 days |
| Door uses ("3 min now", "2 min later"): which door, which target (YouTube, Instagram, Shorts + Reels, or a block-list site), when asked, when open, whether granted offline | Applying the door rules on every device; the daily score (section 4.10) | 13 months |
| Weekly report choices: email on or off (Pro, off until you turn it on), the last week sent, your first-week baseline | The weekly report and "time reclaimed" | Until account deletion |
On iPhone and iPad: [chosen option A/B/C sentence from APP-STORE-PRIVACY-LABEL section 3, word for word in substance (APP-REVIEW-NOTES section 3.3). Option A (recommended) reads: "The app sends your TrapFree account two numbers for each day, at most once an hour: the budget minutes used on this iPhone so far, to keep one daily budget across your own devices, and how many Shorts, Reels and TikTok pages Safari stopped, for your own progress and weekly report. Never which app, site or page. Nothing is used for analytics, advertising or anyone else." Option C (the default while the server's `ios_budget_sync` is off) reads: "Nothing derived from Screen Time leaves the device: the iPhone keeps its own daily budget."]
4.5 Wallet and purchases
| Data | Why | Kept for |
|---|---|---|
| Wallet: minutes bought, minutes spent, on what (YouTube, Instagram, Shorts + Reels, or a site on your own block list), when | The wallet itself, your purchase history | 13 months for spends; purchases as tax law requires |
| Purchases: pack, price, tax, currency, payment status, the payment provider's reference, and any first top-up bonus minutes given with it | Delivering what you paid for, refunds, tax | As tax law requires (about 6–8 years in India) |
| What you were shown and agreed to before paying (button text, price, disclosures, versions, time, your IP country) | Proof of consent | At least 3 years |
| First top-up bonus marks (only when first top-up bonuses are switched on; they are off today): when an account is given the bonus minutes of a first top-up, a keyed one-way code (a hash made with our secret key) of each of its phone number, email mailbox (ignoring "+" tags and, for Gmail, dots) and device keys, with only which kind it is and when it was made. Never the phone number, email address or device key itself, and no link to the account | One first top-up bonus per person: a new account with the same phone number, email mailbox or device gets no second bonus | 1 year after the bonus was given, also after you delete your account (otherwise deleting it would give a new bonus). Your data download lists the marks that match your account (kind, when made, kept until; never the code itself) |
4.6 Pro plan and subscriptions
| Data | Why | Kept for |
|---|---|---|
| Your plan: Free or Pro, where Pro comes from (website, Apple, Google, trial, referral, promotion, support), status, period end, whether it renews, trial end | Unlocking Pro on every device | Until account deletion; paid records as tax law requires |
| Free trial marks: when an account starts the 7-day free Pro trial, a keyed one-way code (a hash made with our secret key) of each of its phone number, email mailbox (ignoring "+" tags and, for Gmail, dots) and device keys, with only which kind it is and when it was made. Never the phone number, email address or device key itself, and no link to the account | One free trial per person: a new account with the same phone number, email mailbox or device gets no second trial. (We also check, from the device records we already keep, whether one of its devices is on another account that had the trial.) | 1 year after the trial started, also after you delete your account (otherwise deleting it would give a new trial). Your data download lists the marks that match your account (kind, when made, kept until; never the code itself) |
| Subscriptions: provider (Razorpay, Paddle, Apple, Google), the provider's subscription and customer reference, status, period dates, cancellation | Renewals, reminders, cancelling, refunds | As tax law requires |
| What you were shown and agreed to before subscribing (plan, price with tax, renewal date, how to cancel, trial end, refund link, versions, time) | Proof of consent (California requires it for automatic renewals) | At least 3 years |
| Reminders and notices we sent (renewal reminders, the yearly reminder for monthly plans, price-change notices, pre-debit notices, trial ending, cancellation confirmations, withdrawal confirmations, receipts, notices of changed terms or privacy notice, protection alerts, weekly reports): kind, channel, when, delivered or not | Sending each one once; proof that we sent it | [13 months] |
4.7 App Store and Google Play purchases
| Data | Why | Kept for |
|---|---|---|
| Apple: transaction id, original transaction id, product, quantity, purchase and refund dates, environment, the verified transaction record (it contains no name, email or card) | Crediting wallet packs and Pro once, handling refunds | As tax law requires |
| Google: order id, purchase token, product, quantity, purchase and refund dates, the verified purchase record | Same | As tax law requires |
With Google purchases we give Google a coded, one-way version of your account id so a purchase can be matched to your account. It contains no phone number or email.
4.8 Referrals
| Data | Why | Kept for |
|---|---|---|
| Your invitation code; which account used whose code; status (pending, qualified, rewarded, refused); dates | Giving both people 30 days of Pro | Your code until your account is deleted. A referral until both accounts are deleted; when only one is, the referral is kept without that account's details (internal ids, code, status, dates) and deleted at most 1 year after the reward is given or refused, so the other person's reward and yearly reward limit stay right |
You see only how many people used your code and how many rewards you earned. We never show your friend's phone or email to you, or yours to them. To check that a new account kept protection on for 3 days, we use that account's device check-ins (section 4.2).
4.9 Support, consent and security
| Data | Why | Kept for |
|---|---|---|
| What you agreed to (terms, privacy notice, product emails, purchase disclosures, a changed version of the terms or privacy notice) and when, with your IP country | Proof of consent | Account life + 3 years |
| Pressing Install on a Mac or Windows PC: the version of the Terms of Service and of the install screen you agreed to, when you pressed Install, the device, when we recorded it and your IP country (sent by the device while you are signed in) | Proof of consent | Account life + 3 years (after a deletion, without the device) |
| Support messages and feedback you send: your text, the site you name, app and system versions, an anonymous install id, an optional reply email (encrypted, with a keyed one-way lookup hash of it) and, when an app signed in to your account sends it, your account | Support | 2 years. Deleted within 7 days of deleting your account when sent from your account's email address or linked to your account; until then we keep only the lookup hash of that address (never the address) to find them. If you change your account's email address, the messages already sent from the old address are linked to your account. Sooner if you ask us (section 13) |
| Complaints you make: ticket number, when received, what it is about, what you told us, your name if you gave it, how to reach you, a receipt or ticket number if you gave one, our answer and the reasons, and your account if you were signed in | Handling the complaint; proof that we answered in time | What you told us, your name, how to reach you, the reference, our answer and the link to your account: until at most 90 days after the complaint is closed. The rest (ticket, dates, category, our decision): [3 years after the complaint is closed] |
| Security logs (sign-ins and account events, with the country of your IP address; sign-ins and attempts to sign in to our staff pages, with their IP address) | Security and the law (CERT-In) | 1 year. An IP address in them is cut to its network after 180 days (the first three parts of an IPv4 address, the first three groups of an IPv6 address) and removed after 1 year |
| Account events (sign-in, device added or removed, phone number or email added or changed, setup answers saved (when, from which device, and whether the name was set or removed; never the answers or the name), "Adjust my limit to how my days go" turned on, asked to turn off and turned off, a review flag raised or cleared (when, the kind of flag, and which staff member cleared it, with their note), plan change, deletion, support removal key) | Security and support | 1 year; the records of a charge, a refund or a dispute among them as long as the purchase they belong to (section 4.5) |
| Sign-in codes: the code (only as a hash), the phone number or email it was sent to (encrypted), for a phone number its country, and the IP address the code was asked from (for IPv6, only its first half) | Checking the code; limits against misuse of codes and SMS fraud | The code works for 10 minutes. The record is deleted within 25 hours. If the month and year of birth you give at sign-up say you are under 18, or Apple's age check on an iPhone or iPad says so (section 14), the phone number or email, the code and the IP address are erased at once from it and from every other code sent to that phone number or email (unless it belongs to an account) |
| Codes to add or change your phone number or email address: a code sent to the new phone number or email and, to replace one, codes to the contacts you already have: when your account has both a phone number and an email address, a code to the email address to replace the phone number, and a code to the email address and one to the phone number to replace the email address (otherwise a code to the one it has), recorded like a sign-in code and tied to your account and to the change you asked for | Proving that the new phone number or email is yours and that you asked for the change | Deleted with the code, within 25 hours |
| Sign-in sessions (refresh tokens stored only as a hash) | Staying signed in | 60 days |
| Live updates sent to your devices | Keeping devices in step; telling when a filter switch-off was asked for, for the daily score (section 4.10) | 7 days |
4.10 The daily score and adjustments
"Adjust my limit to how my days go" is on for every account, and you can switch it off (below). Each night at 04:00, in your account's time zone, our server marks the day that has just ended as good, hard or neither. After 3 good days in a row it gives you a reward for the next day (10 more minutes on YouTube and on Instagram); after 2 hard days in a row it makes the next day stricter (5 minutes less on each, never below 5 minutes, and door 1 closed for the day if a limit is already 5 minutes). Either lasts from 04:00 until midnight. "How TrapFree works" explains the rules in full; the numbers are our settings (a reward of at most 15 minutes, a stricter day of at most 10 minutes less), and the app shows the ones in force. For this we keep:
| Data | Why | Kept for |
|---|---|---|
| Day scores: for each day, good, hard or neither, the reasons as codes (for example "YouTube limit reached before 12:00", "a pass was used", "protection off on one device"; never a site, a page or what you watched), the adjustment in force that day and the one decided for the next day, and when the day was scored | Counting runs of good and hard days; showing you how your days counted | [13 months], like the daily totals |
| Run counts: how many good days and how many hard days in a row, the last day scored and the last adjustment decided | Deciding the next day's reward or stricter day | Until account deletion (updated every night) |
| The day's adjustment: a reward or a stricter day, its minutes, whether door 1 is closed, and the line the apps show | Applying it on all your devices for that day | That day only; the live updates that carry it to your devices, 7 days (section 4.9) |
| Your switch: on or off, and a switch-off that is waiting, with its day | Applying your choice | Until account deletion |
| Checks against faked reports: when a device reports no use while its protection self-check fails, sends its reports out of order, or a grant is used twice: the device, what was noticed, the evidence (report times and sequence numbers, the self-check result, the grant's id; never a site, a page or what you watched), when it was noticed, and when and by which staff member it was cleared; and whether your account is under review | Keeping rewards fair and TrapFree secure. While your account is under review it gets no rewards (stricter days still apply, and a reward earned meanwhile is not given later), and our support team looks | A flag until support clears it, then [1 year] |
| First use of each grant by each device: which grant, which device, which use (for example the paid-time display on an iPhone), when | Seeing the same grant used twice (the check above) | 30 days |
All of it is deleted with your account, within 7 days (section 13).
Where the score comes from. Only data we already keep for the reasons in sections 4.2 to 4.4 and 4.9: the minutes your devices report and the current window (4.4), your door and pass uses (4.4), protection status and removal requests (4.2), and the filter switch-offs you ask for (4.3, with the live updates of 4.9). Never your wallet spends (paying is a choice, so the minutes you paid for never make a day good or hard), never your setup answers, never your browsing (we have none), never diagnostics (section 6), and on iPhone and iPad nothing from Screen Time: the minutes an iPhone or iPad counts stay on it, so for those devices only doors, passes and protection count. Nothing new is sent for the score (section 5).
Your choice. Switch it off in Settings › Daily limits. Because it can make a day stricter, turning it off is a looser change and waits a random 3 to 4 days (72 to 96 hours), like raising a limit; until then your days keep counting. Turning it on is at once. While it is off, our server scores none of your days and keeps no new day scores, and your runs of good and hard days start again from 0. The day scores already kept stay for the time above unless you ask us to delete them (section 13).
Automated scoring (EU and UK). Scoring your days is profiling: an automatic evaluation of how a day went. It makes no decision with legal or similarly significant effects about you: it changes only your own TrapFree limits, by a few minutes, for one day; it never costs money, never changes your wallet and never closes more than door 1 for a day; and you can switch it off. A review flag only pauses rewards, and a person in our support team checks every flag. You can ask a person to look at a day's score or a flag, give your view, and object to the score (section 13).
We never collect: your browsing history, page addresses, video titles, searches, page contents, screenshots, contacts, precise location, or card and bank details.
5. What your devices send, and where
Everything goes over encrypted connections to server.ascendify.pro, mostly only while you are signed in. Even when you are signed out, the app checks for settings and updates (app version and platform; an update check may add the install id, used only to choose a staged release and never stored), sends feedback only when you press Send, and test builds send diagnostics. The first install on a Mac also downloads the filter engine (below).
- Sign-in and account: the code you type, your device's public key and the device details above.
- Setup answers: what you chose in the setup (section 3) and, only if you gave them, your gender, your age group, where you live and your name: at sign-in, at once if you are already signed in, and again when you change them in Settings (sections 4.1 and 4.3). Until you sign in they stay on the device.
- Find my state (only when you press it, signed in or not): a request to our server, which reads the approximate country and state of the request's internet address from Cloudflare and sends them back. Our server stores nothing for it; the web server's access log keeps the address as for every request (section 5a). The answer becomes part of your setup answers only if you keep it. To show the state picker, the app also fetches the list of states for a country (only the country's code is sent).
- The setup table: to start your sliders, the app fetches the starting table for your answers once, when you press Continue on "About you", signed in or not (your country, state, age group and gender, as codes; nothing else, and only the answers you gave). Every app does this, also before you sign in. Our server answers from the same table for everyone with those answers and keeps no record of who asked; the web server's access log records such a request without your answers (section 5a).
- Every 5 minutes while signed in: app and engine versions and whether protection is on (and which layers are working).
- Usage: every 15 seconds while you use YouTube, Instagram or Shorts + Reels, and when you open or close one: the sector, seconds used, start and end time (at most 4 reports a minute, each under 200 bytes). On iPhone and iPad: [the same chosen sentence as in section 4.4].
- Rules: door requests, Focus Lock, changes to the YouTube and the Instagram limit, block-list changes (including the site names you add), filter switches, category level changes, and opening or closing a category (which category and when; never which site or app you used).
- For the daily score: nothing more. Our server works it out from what your devices already send (above), and your devices receive the day's adjustment with your rules. Turning "Adjust my limit to how my days go" on or off sends only that choice. On iPhone and iPad nothing from Screen Time is sent for it (section 4.10).
- Wallet: your balance, packs and history are fetched; when you spend minutes, the target (for example "YouTube" or a site from your own block list) and the number of minutes are sent.
- Settings and updates: the app's platform and version, to get settings and the minimum supported version. On Mac, an hourly update check carries the app version only; on Windows and in TrapFree Test it also carries the install id, which our server uses only to choose a staged release and never logs or stores.
- Phones: a push token, and purchase receipts from Apple or Google for checking. On iPhone and iPad, while we switch the paid-time Live Activity on, also its tokens (section 4.2).
- Installing on a Mac or Windows PC: with your sign-in and the check-ins after it, until our server has stored them, the versions of the Terms of Service and of the install screen you agreed to by pressing Install, and when you pressed it (section 4.9).
- Diagnostics: only while switched on (section 6).
- Feedback (only when you press Send): your text, the site you named, the app/engine/system versions, an optional email (with a keyed lookup hash of it), an anonymous install id (a one-way hash) and, when the app sends it signed in, your account.
- First install on a Mac: the filter engine is downloaded from downloads.mitmproxy.org (pinned version, checksum verified).
5a. Our website and pay pages
- Server logs: the web server in front of our server records each request's IP address in its access log, kept 180 days. For the setup's two requests (the starting table for your answers, and "Find my state") it records the IP address and the time, never your answers or the place found. Our server's own logs carry no IP address, except a refused attempt to open our staff pages from outside the networks allowed for them (the address it came from; for IPv6, its first half). Our database keeps your IP address only with a sign-in code (at most 25 hours), and the country of your IP address with your sign-ins and agreements (section 4.9).
- Account page: the account page (ascendify.pro/trapfree/account) uses one sign-in cookie (
tf_account, at most 12 hours) to keep you signed in after you enter your one-time code, and, on the sign-in form only, one short-lived security cookie (tf_account_login, 1 hour). We use no analytics or advertising cookies, and the other pages of the website set no cookie at all. - Pay pages: when a pay page opens, it loads Razorpay's (India) or Paddle's (outside India) payment script, so that company receives your IP address and browser details and may set its own cookies or similar storage. Their payment window opens when you press Pay (section 8).
- The cookie notice (ascendify.pro/trapfree/legal/cookies) lists every cookie.
6. Diagnostics
To find and fix problems on every kind of device, the TrapFree apps can send technical diagnostics to our server. We switch diagnostics on or off from our server, for each platform, and for a single device or account when you ask support for help.
What a diagnostic event contains: the time and a sequence number; a session id, your device id and an install id; platform, real or test build, app, engine and system versions; the kind of event (start, stop, update or install step; error; how long an operation took; a call to a TrapFree server route with its status, timing and size; a rule decision such as "R2 YouTube blocked"; a self-check result; a log line), its level, the part of the app, a name and a short message; and only these details: sector, rule, target kind, server route, method, status, bytes, error code, site category (YouTube, Instagram, Facebook, TikTok, TrapFree server, block list or other), an address pattern with ids removed (such as /shorts/:id), protection layer, self-check name and result, a count, screen, widget, store and payment provider. Error reports may include a cleaned technical trace.
Never in diagnostics: full web addresses or query strings, video or page titles, searches, page content, phone numbers, emails, tokens or keys, IP addresses, contacts, location, or file paths in your home folder. The app removes such things before sending, and our server rejects any event with details not on the list above. On iPhone and iPad, diagnostics never include anything taken from Screen Time (app choices, minutes, thresholds or rule decisions based on them).
Levels:
| Level | What | Your choice |
|---|---|---|
| Essential | Errors, self-check results and how fast our server answers | Part of running the service (described here) when we switch diagnostics on |
| Standard and detailed | Also timings of operations, rule decisions and log lines | Only if you switch on "Help improve TrapFree by sharing technical diagnostics" in Settings or on your account page. It is off until you turn it on, and you can turn it off at any time with one tap. Switched off on your account page, our server keeps only essential diagnostics from all your devices, even one whose app still has its own switch on. |
Self-checks run when the app starts and every 6 hours while diagnostics are on (for example "engine running", "certificate trusted", "Accessibility service on", "Screen Time authorised").
On your device: the app keeps a small local record (at most 5 MB; only errors while diagnostics are off). "Send a diagnostic report" in Settings sends it when you choose, even with diagnostics off.
Kept for: 30 days on our server, then deleted. Your wallet and every paid feature work the same with diagnostics off.
7. The 3-day test program
Testers get a separate app, "TrapFree Test", through the testing page ascendify.pro/trapfree/test (downloads for Mac and Windows, a Google Play testing link for Android, TestFlight for iPhone) after agreeing to the tester agreement. In the test program:
- the tester signs in to a separate test account (the same phone or email can have a real and a test account; they never mix);
- each test account has ₹100 of test money with no value; "payments" happen on a TEST page and no payment provider or store is contacted;
- detailed diagnostics are always on (that is what testers agree to), with the same contents and limits as section 6, kept 30 days;
- each install has a 3-day licence (device id, install id, start and end time; the device's key, platform, model, operating-system and app versions, and the tester agreement version accepted in the app — never the device's name), deleted [N days] after the licence ends;
- test accounts and their data (including that the tester agreement was accepted and when) are kept until [N days] after the tester's last licence ends, then deleted; an app still connecting after its test does not extend this;
- test data is kept apart from real accounts and left out of our revenue and usage figures.
8. Payments
Wallet minutes and subscriptions bought on our website are paid through Razorpay (India) or Paddle (outside India, as the seller of record). They receive what they need to take the payment (for example your card or UPI details, and your phone or email for the receipt). Razorpay also sends the RBI pre-debit notices for recurring payments. We never see or store card or bank details. On Android, Google Play takes the payment; on iPhone, Apple does. To show the right EU/UK withdrawal box, the pay page uses the country of your IP address (not the full address).
9. Who processes data for us
| Company | What for | What it receives |
|---|---|---|
| Hosting [provider; before public launch: managed PostgreSQL in Mumbai, India] | Running our server and database, backups | The data in section 4 |
| Cloudflare [in front of our server from public launch] | The network in front of our server: protection against attacks, and the country and the state or region of the internet address a request comes from (for prices, and for "Find my state") | Every request to our server, with your IP address; it tells our server only the country and the state or region |
| SMS: [MSG91 (India) / Twilio] | Sending sign-in codes | Phone number and the code |
| Email: [SMTP provider / Resend] | Codes, receipts, reminders, weekly report | Email address and the message |
| Razorpay | Payments and recurring mandates in India | What it needs to take the payment |
| Paddle | Seller of record outside India | What it needs to sell to you, take payment and charge tax |
| Apple | App Store payments and refunds; push notifications to iPhone and iPad (APNs); TestFlight for testers | Store transaction data; push tokens and message content |
| Google Play payments and refunds (Play Developer API); purchase notifications (Cloud Pub/Sub); push notifications to Android (Firebase Cloud Messaging) | The coded account id, purchase tokens and order data; push tokens and message content | |
| [Error tracking provider, if used] | [Crash reports] | [Diagnostics as in section 6] |
| [Anti-fraud check before sending a code: Apple App Attest / Google Play Integrity / CAPTCHA provider, if used] | Stopping SMS fraud | [Device attestation result / CAPTCHA data] |
Each of our processors has a written data-processing agreement with Ascendify. Razorpay, Paddle, Apple and Google also handle payments under their own privacy notices. None of them receives your browsing. Push messages carry as little as possible (usually only "something changed — sync now"; alerts carry short text such as "Office PC: protection off since 18:05"). A Live Activity push to an iPhone or iPad carries which of YouTube, Instagram or Verticals has paid time, its times, your time zone and a short alert; never your wallet balance and never a site from your block list.
Separately: while the adult filter or strict mode is on for a computer (the setup turns the adult filter on, because adult sites are always blocked; the install screen shows both, and you can change them later in Settings), or when you set up Private DNS on Android, your device sends its DNS lookups (the names of sites it connects to) directly to Cloudflare for Families, not to us, under Cloudflare's privacy policy.
10. Where your data is kept
Our server and database are in [India, Mumbai region, from public launch]. Some processors above work from other countries (for example the United States or the EU). We send data abroad only where the law allows, with the protections it requires (for EU and UK data, standard contractual clauses).
11. How we protect it
- Encrypted connections everywhere (TLS 1.2 or newer).
- Phone numbers and emails encrypted in the database (AES-256-GCM), with a separate lookup key; backups encrypted and kept with a different provider.
- Each device has its own key; important requests are signed by it. Short-lived access tokens; sign-in sessions renewed and checked on every use.
- Staff admin panel with two-factor sign-in, an IP allow-list and a log of every action. Our logs carry account ids, never phone numbers or emails.
- An external security test before public launch.
- If a breach affects you, we tell you and the Data Protection Board of India without delay and send the Board a full report within 72 hours; we report cyber incidents to CERT-In within 6 hours; we tell EU authorities within 72 hours if EU users are affected.
12. Why we may use your data (legal basis)
- India: we use your personal data with your consent, which you give when you create your account by ticking the unticked box, and for the purposes in this notice only. Product emails and detailed diagnostics need a separate yes. Your gender, your age group, where you live and your name are optional: we keep them only if you give them, and you can remove them at any time in Settings. The daily score (section 4.10) is one of the purposes in this notice: you can switch it off in Settings (it waits 3 to 4 days, as section 4.10 explains), and deleting your account ends it at once. Where the law requires us to keep or share data (for example tax records or a lawful order), we do so.
- EU and UK: your account, setup answers, rules, sync, wallet and plan — to provide the service you asked for (contract); the daily score and the day's adjustments, which are part of the rules TrapFree keeps for you and which you can switch off (section 4.10) — to provide the service you asked for (contract); invoices and tax records — legal duty; security logs, fraud prevention and the checks against faked reports (section 4.10) — legitimate interest; product emails, detailed diagnostics, and your gender, age group, where you live and name (all optional) — consent; answering "Find my state" when you press it, and the starting table for your answers — to provide the service you asked for (contract); essential diagnostics — [legitimate interest / consent].
13. Your rights
- See and download everything your account holds on your account page, your setup answers, gender, age group, where you live, name, day scores, run counts, the adjustments switch and any review flags included: ascendify.pro/trapfree/account/data (sign in with a one-time code). In TrapFree on Android, Settings → Account → Download my data opens it.
- Change your setup answers, or remove your gender, your age group, where you live or your name, at any time in the app's Settings.
- Your daily score (section 4.10): switch it off in Settings › Daily limits (it waits 3 to 4 days). To have a person look at a day's score or a review flag on your account, to give your view, to object, or to have your day scores deleted early, write to [email protected].
- Correct your phone number or email address, or add one, on your account page: ascendify.pro/trapfree/account/contact. We send a code to the new one. To replace one you already have, we first check it is you. If your account has both a phone number and an email address: to replace the phone number, with a code to your email address; to replace the email address, with a code to that email address and a code to your phone number (signing in with one of them in the last 10 minutes counts for that one). If you no longer have the email address, write to [email protected]: we check that the account is yours first. If your account has only one of them, sign in again first if it has been more than 10 minutes. A phone number or email address of another TrapFree account cannot be added. After you replace one in the app or on the website, an account that has both can be deleted only after 7 days (sooner through support, once we have checked it is yours), so that whoever replaced it cannot delete the account at once. To correct your time zone or language, write to [email protected] (the time zone can change once every 7 days).
- Delete your account in the app (Settings → Account → Delete account) or at ascendify.pro/trapfree/delete-account. Your setup answers, gender, age group, where you live and name go at once, with your phone number and email. Deletion completes within 7 days; only what the law requires is kept (invoices, consent records, security logs, complaints you made (section 4.9) and, for [1 year], wallet and door records). The free trial marks (section 4.6) are kept too, until 1 year after the trial started, so that one person gets one free trial. When first top-up bonuses are switched on, the first top-up bonus marks (section 4.5) are kept too, until 1 year after the bonus, so that one person gets one bonus. Deleting your account does not uninstall protection; the app keeps its last rules on this device. Deleting your account cancels a Pro subscription bought on our website (no further payment); App Store and Google Play subscriptions must be cancelled with Apple or Google first (see "How to cancel").
- Withdraw consent as easily as you gave it: product emails and the weekly email have an off switch and an unsubscribe link; detailed diagnostics have an off switch; your gender, your age group, where you live and your name are removed in Settings; withdrawing consent to the account as a whole means deleting it, which also ends the daily score at once.
- Support messages: the ones sent from your account's email address, or linked to your account, are deleted within 7 days of deleting the account (section 4.9). To have any message deleted before its 2 years are up, write to [email protected] and tell us when you sent it and from which email address.
- Name someone to use your rights for you if you die or cannot act yourself.
- EU and UK: also restrict or object to some uses (for example the daily score and the checks against faked reports, section 4.10), ask a person to look at an automated result, and take your data to another service.
- Complaints: make a complaint with the complaint form (ascendify.pro/trapfree/legal/complaint, or from your account page), to our grievance officer Aman Krishna Gupta, [email protected], Block No. 13, Phase 2, Maa Narmade Nagar, Bilhari, Jabalpur, Madhya Pradesh 482020, India (also on the contact page, ascendify.pro/trapfree/legal/contact) or in the app (Settings → Support → Make a complaint). The form gives you a ticket number and a copy of your complaint as we recorded it at once; by email you get them within 48 hours. We resolve every complaint within one month (90 days at most under the DPDP Rules). If you are not satisfied with our answer, you may complain to the Data Protection Board of India [link to the Board's complaint page, once the lawyer confirms the official address], or in the EU or UK to your data protection authority.
14. Children
TrapFree accounts are for people aged 18 and over. If the month and year of birth you give us say you are under 18, we create no account and keep nothing: we erase the sign-in code we sent you, with your phone number or email, at once, and every other code we sent to that phone number or email. The setup's age question has no group under 18 and says "For adults (18+)"; the month and year of birth at sign-up stay the age check.
The app may also ask your app store for your age range: on Android, Google Play; on iPhone and iPad, Apple, where Apple says the law requires an age check. We never receive the age range itself.
- On iPhone and iPad, if Apple says you are under 18, the app tells our server only that, and we create no account and erase the sign-in code with your phone number or email at once, as for a birth date under 18. If the app cannot reach our server, it forgets what you typed, and the code is deleted with your phone number or email within 25 hours, like every sign-in code (section 4.9).
- On Android, Google Play's answer stays on your phone; our server is not told. If it says you are under 18, we create no account and the app forgets what you typed; the sign-in code is deleted with your phone number or email within 25 hours (section 4.9).
- If Google Play must first confirm your age in the Play Store, or, on iPhone and iPad, you decline Apple's check or it does not answer, we create no account yet: the screen keeps what you typed, so that you can try again, and our server is not told, so the sign-in code is deleted with your phone number or email within 25 hours.
The test program is for adults only too.
15. Removal
On computers, the built-in uninstaller has a cooling-off period (a random 14–23 hour wait, then a 90-minute window). Removal deletes every file, service, certificate, hosts entry, firewall rule and DNS setting TrapFree added, and restores your original network settings. On Android and iPhone you can delete the app or switch off its access at any time.
16. United States and California
We do not sell or share personal information, show no ads and do not track you across other companies' apps or websites, so browser "Do Not Track" signals change nothing here. TrapFree is not for anyone under 18.
17. Changes to this notice
Before a change that matters to you, we tell you at least [30] days ahead: by email if your account has an email address, and on your account page (ascendify.pro/trapfree/account). The account page shows "We have updated our privacy notice", one line on what changes and the date it applies, with a link to read the notice, then Not now and Agree (the same size). The app will show the same. If we want to use your data for a new purpose, we ask for your consent to that purpose first. Until you agree, nothing new is done with your data. Your protection, your rules and the free doors keep working either way.
18. Contact
Ascendify (proprietor: Aman Krishna Gupta), Block No. 13, Phase 2, Maa Narmade Nagar, Bilhari, Jabalpur, Madhya Pradesh 482020, India · [email protected] · Data protection contact: Aman Krishna Gupta, [email protected].