Legal

Privacy Policy

Last updated: 18 September 2026

DoomBlock is a screen-time, app and website blocking app for Android, published by Bros Dolz LLC. This policy explains what data the app handles, why, and the choices you have. Questions? Email support@brosdolz.com.

Data we collect

Data	Why	Where it goes
A random account ID. Created when you create an account or sign in — or, if you redeem an unlock code while signed out, at that moment, because the code has to be granted to some account. Redeeming a code is the only thing that ever creates an account with no email address and no password on it. Nothing else creates one — not choosing Continue without an account, not subscribing, not simply using the app. Without an account, nothing is uploaded and we hold no record of you at all.	To have something for your backup, your subscription and any redeemed code to belong to, so they survive an app update and can be restored.	Created and stored by our authentication and database provider, Supabase. It is a random identifier generated on our side — not your advertising ID, not your Android ID, and not derived from your device or phone number. On its own it identifies nobody.
Email address, if you create an account or add one later	To sign you in, to secure your cloud backup, and to confirm that a deletion or export request really is yours.	Stored by Supabase. Optional: the app is fully usable without one.
Password, if you create an account with email and password	To sign you in.	Stored by Supabase only as an irreversible bcrypt hash. Your actual password is never stored. If you sign in with Google, no password is stored at all.
Google account (email & basic profile), only if you sign in with Google	To authenticate you without a separate password.	Provided by Google Sign-In; used to create or identify your account with Supabase.
Your DoomBlock setup and history: Block groups: the apps, websites, keywords and short-form content you chose, and their schedules. Session limit and cooldown settings: pause duration, warning countdowns, PIN attempt limits. Your statistics counters: blocks today, focus time today, total override count, and the last app you overrode. Your override history: timestamp, which app, which group. How you have labelled apps in statistics (productive / neutral / distraction). App preferences: default redirect site, tip amount, and which screens you turned the PIN off for. The SHA-256 hash of your PIN.	To back up your setup and sync it across your devices.	Stored in your account with Supabase — including an account with no email address attached, which is how a backup can exist for someone who never signed in but did redeem a code. With no account at all, none of this is uploaded: it stays on your device and there is no cloud copy to delete. Your PIN itself is never stored or transmitted, only an irreversible hash of it.
Subscription data: your Google Play purchase token, the product you bought, your current subscription status, and — if you used one — your beta code and the date you redeemed it	To confirm your subscription is genuine and still active, and to unlock the features you are entitled to.	The purchase token is sent to our server function, which verifies it with Google Play; the resulting status is stored in your account with Supabase. The token is also kept on your device, because Google Play re-delivers it to the app on every launch — that is what lets a subscription keep working offline and before you have an email on your account. Google Play handles the payment; we never see your card or payment details.
On-device app-usage data (which app is in the foreground, time spent in each app)	To enforce your blocks and limits, and to show you your own statistics.	The raw usage data stays on your device. It is not uploaded, not sold, and not used for advertising. Only the aggregated counters and override history listed above are backed up to your account.
Web addresses and in-app page text	To detect a blocked website or keyword and show the block screen.	Compared against your block list on your device and discarded straight after the check. Never stored, never transmitted.

What DoomBlock does not do

No advertising. DoomBlock shows no ads, contains no advertising SDK, and does not collect a device advertising identifier.
No analytics. There is no analytics SDK and no automatic crash-reporting service in the app, and no tracking SDK of any kind.
No access to your camera, microphone, location, contacts, SMS or call logs, or your files and photo storage. DoomBlock never requests these permissions.
We do not sell your personal data, and we do not share it for advertising or marketing.
Problem reports are yours to send. If you use the in-app "report a problem" option, it opens your email app with a message you can read and edit first. It contains the app version, your device model and Android version, and a short log of recent in-app events. Nothing is sent unless you send it.

Permissions the app requests

DoomBlock is an app blocker, so it asks for some sensitive permissions. Each is used only for the purpose below, and each is requested in context — at the point a feature you are using needs it — with the app telling you whether that feature is broken without it or merely better with it.

Accessibility service. Core to how the app works. It is enabled only after you accept a separate on-screen disclosure, and you can turn it off at any time in Android Settings → Accessibility. It collects three things:
- Which app is currently in the foreground, so a block can be enforced the moment a blocked app opens.
- The web address (URL) currently open in your browser, so that blocked websites and keywords can be detected. It is read in the moment, compared against your block list, and discarded. No browsing history is built, kept or transmitted. Only a page you have actually opened is checked; what you type into the address bar is not.
- The text of web pages opened inside other apps — for example a link you open from within Instagram — if you turn on blocking inside other apps' built-in browsers, so the same block list applies there.
All three are used for one purpose only: to compare them against the apps, websites and keywords you chose to block, and to show a block screen when something matches. This happens entirely on your device and the data is discarded immediately after the check. We never store your browsing history, never transmit it off your device, and never share or sell it. The service does not read your messages, your passwords, or what you type.
Usage access (optional). Measures time spent in apps. Statistics cannot be calculated without it, so it is required there. Blocking and session limits do not depend on it — session time is counted from the accessibility service's own window events — so for those the app treats it as a recommendation that makes detection more resilient, and one you can dismiss for good.
Display over other apps. Core to how the app works. Shows the block screen on top of a blocked app so you can interact with it, and displays your session-limit timer.
Background running, and notifications (optional). The blocking service runs in the foreground with an ongoing notification, which Android requires and which also shows whether blocking is active. Beyond that, DoomBlock can tell you when blocking is paused and when session time is running out. Each of those is a separate notification with its own switch in your phone's notification settings, which Settings → Notifications in DoomBlock lists and links you straight to; blocking still works with every one of them off — you simply are not warned before a limit lands.
Battery-optimisation exemption (optional, strongly recommended). Stops Android from killing the blocking service in the background. Blocking may be unreliable without it.
Device admin (optional, only if you turn on Prevent Uninstall). Prevents DoomBlock from being uninstalled — by you or by anyone else — while a block is active. It is used for nothing else: DoomBlock never locks your device, wipes it, disables the camera, or otherwise controls it. You can turn it off at any time.

Third parties

We share data only with the service providers needed to run the app:

Supabase. Authentication and cloud database, for your account and your backup.
Google. Google Sign-In, Google Play services, and Google Play Billing for subscriptions.

How your data is stored

Your backup is a single JSON snapshot attached to your account, held in our Supabase database with row-level security enabled, so only your own account can read your row. That applies equally to an account with no email address: the row is protected the same way and reachable only by the account it belongs to. Data is encrypted in transit (HTTPS/TLS) and at rest by Supabase. Passwords are hashed with bcrypt and your PIN with SHA-256; neither can be recovered from what we store.

The websites and keywords in your account are the ones you chose to block — they are part of your block-group configuration. They are not a record of anything you visited. We never store the web addresses you open, the searches you run, or the pages you view, and we never store your interactions with apps or your browser in our database. Those checks happen on your device and the data is discarded immediately afterwards.

One internal record is worth naming. If you add an email address or Google account that already belongs to a different DoomBlock account, we create a single-use transfer token so the account you are signing into can claim the data from the one you were using. The token holds no personal data, expires fifteen minutes after it is created, and is deleted once it has been used.

Data retention & deletion

We keep your account data until the account is deleted. How you delete it depends on whether it has an email address attached — and there is only one way to end up with an account that has none:

An account with no email address and no password on it is created only when you redeem an unlock code while signed out, and by nothing else. Choosing Continue without an account during setup does not create one, subscribing does not create one, and using the app does not create one. If you have never redeemed a code without signing in, you have no account, no cloud backup, and nothing on our servers to delete.

An account you signed into. Delete it inside the app (Settings → your account → Delete account), which permanently removes the account and its cloud backup, and resets the app on your device.
An account with no email, created by redeeming a code while signed out. Delete it inside the app with Settings → Account → Clear data, which removes the account and its cloud backup and resets this device. It asks for no email address because there is none to verify — the app is already inside your account, which is the proof. You can instead add an email address and delete it as above, or write to us quoting the account ID shown on that same page. All three routes, and what we need in order to act on the last, are on the Account Deletion page.

One limit we would rather state than let you discover. An account with no email is reachable only from the app on your device, and so is the ID that names it. While DoomBlock is installed there is always a way through — Clear data does the whole thing yourself, and the account ID lets us find your record if you would rather ask. If you uninstall the app, or clear its data from Android's own app settings, before doing either, the backup it holds stays in our database, and there is nothing left in it — no email, no name, no phone number, no device identifier — for either of us to match it back to you by. The exception is a subscription: a Google Play purchase token is stored alongside it, so if you bought one, your Play order number can still be traced to that account and we can delete it on request. If you want the cloud copy gone, use Clear data rather than uninstalling, because it deletes the cloud side first.

Deleting your account does not cancel your Google Play subscription. Cancel that separately in the Play Store.

Your rights

You can access, correct, export or delete your data at any time from inside the app, or by emailing support@brosdolz.com. Depending on where you live, you may also have the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. For an account with no email address there is no address for us to verify a request against, so what identifies it instead is the account ID under Settings → Account — quote it and we can act on your request. Deletion needs no request at all: Clear data, on that same page, does it immediately. The Account Deletion page sets out every route and its limits.

Children

DoomBlock is not directed to children and is intended for users aged 18 and over.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

AI disclosure

DoomBlock was built with the help of AI-assisted development tools. This does not change what data the app collects or how it is handled; those practices are described above.

Contact

Email support@brosdolz.com.