Who is responsible
SelfSafe is provided by Sergejs Bogdanovs, an individual based in Latvia, using the developer name Aurora_Borealis. Contact: aurora_borealis@inbox.lv.
What stays on your phone
App selections, app usage ordering, chosen contact names and numbers, call rules, scenarios, schedules, session timing, text reminders and user-recorded voice reminders are processed on your device. Accessibility window events are used locally to identify opened apps and enforce your restrictions. SelfSafe does not upload these events, contact lists, recordings, notification contents or protection reports to its account server. You can choose to include information when emailing support.
Microphone access is used for reminders you choose to record, not call recording. Contact access helps you select call rules. Call screening/redirection handles supported cellular calls locally. Notification access can temporarily snooze notifications from restricted apps. Usage access orders frequently used apps. Exact alarms and boot handling support scheduled sessions. Android permissions can be managed in system settings; changing permissions can affect protection.
The backup allowlist includes selected settings, blocked-app selections and voice reminders. Android or your chosen backup provider may store these separately. Active-session state, authentication cleanup state, access confirmations and deletion receipts are excluded from the app's backup allowlist. Clearing device data does not itself delete backup-provider copies.
Google sign-in and access confirmation
If you choose to sign in, Google and Firebase Authentication process your Google identity and profile information, including your email, name and identifiers supplied by Google, Firebase user identifier, authentication tokens and security/network metadata such as IP address and user-agent information. SelfSafe requests Google sign-in, not access to Gmail, Google Drive or your Google contacts.
Our server verifies authentication and stores the minimum trial/access record. It uses a pseudonymous account binding and a purpose-specific keyed representation of your Google identity for purchase ownership. These are personal data, not anonymous data. A 30-day trial begins when the server accepts the first eligible protection start; signing in or installing does not start it. Signing out or uninstalling does not delete the server account.
Signed access confirmations are cached in app-private, no-backup storage protected with Android Keystore. Offline confirmations last at most seven days for trial access and thirty days for purchased access. A device reboot requires fresh online verification before another full session. Expiry of access does not interrupt a protection session already running.
Purchases and refunds
Google Play processes purchases and payment details. SelfSafe does not request your card or bank credentials. The server processes purchase proof tokens to verify purchases with Google Play, acknowledge eligible purchases and handle refunds. Its account records hold proof hashes, ownership links and access/revocation state rather than a raw-proof archive. Google Play notifications may temporarily contain purchase tokens in restricted processing queues. Queues have a 24-hour message-retention setting; dead-letter handling can extend total processing residence across separate queues. Application code does not intentionally write proof tokens or request bodies into logs.
Deletion removes SelfSafe purchase claims and owner links. It does not cancel your Google account, erase Google's payment records or issue a refund. A valid Google Play purchase can be restored explicitly after signing in again with the same verified Google identity. Purchases are not transferred to a different person or identity.
Retention and account deletion
Use Settings → Account → Delete account and confirm the same Google account. SelfSafe saves a read-only status receipt on your phone before committing the request. An accepted request is pending, not proof of completed deletion. You can explicitly check its status even after signing out. Losing the receipt can prevent checking that request; its request number alone is insufficient.
The worker removes the Firebase user, trial/access data and SelfSafe purchase links. A purpose-specific anti-repeat-trial marker is retained for twelve UTC calendar months from the immutable acceptance date, to prevent repeated free trials. It does not contain an email address or device fingerprint. The completion receipt is retained for thirty days after completion so its holder can verify the outcome. Expired records are removed in bounded cleanup batches; expiry and physical cleanup are distinct. Pending/problem requests are not presented as completed.
Local rules, scenarios, reminders and any running protection session remain after account deletion. Remove local items inside SelfSafe, clear app storage or uninstall to remove them. Manage backup copies separately.
To request account deletion without reinstalling the app, visit https://selfsafe-legal.pages.dev/delete-account and confirm the same Google account. Prepare the request, keep the read-only receipt, review the consequences and explicitly confirm Request account deletion. Signing in or preparing a receipt alone does not request deletion. Use Check status to distinguish pending, attention-needed and completed processing. The website does not need access to your local phone settings or reminders.
The website stores the read-only receipt in your browser's local storage before enabling the final request. You can download it and import it later to check status without signing in. It contains a secret status credential, not a Google password. Keep it private. Clearing browser/site data or private browsing can remove the browser copy; removing that copy does not cancel a server request. Google sign-in state on this website is held in memory rather than deliberately persisted by SelfSafe between browser sessions.
For help with access or requests concerning support correspondence, email aurora_borealis@inbox.lv. Proportionate identity verification may be needed before handling personal data. Never email passwords, sign-in codes or the secret receipt credential. A support message is not itself confirmation that an account has been deleted.
Ordinary support correspondence is retained for up to twelve months after closure, unless particular records are needed for a specific legal obligation or legal claim. Only the necessary records are retained for that purpose. We cannot remotely erase copies held by your email/backup provider.
Providers, locations and security
Google Cloud/Firebase operate account infrastructure. Firestore and functions are configured in europe-west1 (Belgium). This is not an EU-only processing promise: Firebase states that Authentication runs in US data centers. Google may process service/security metadata under its applicable terms and transfer safeguards. Google's own retention/deletion processes are separate from SelfSafe's completed application job. Firebase currently describes removal of other authentication information from live/backups within 180 days after customer-initiated user deletion, and logged-IP retention of a few weeks.
Support mail passes through the selected email providers, including Google Groups and Inbox.lv as applicable. No advertising SDK, remote analytics SDK, hidden device fingerprint or sale of personal data is part of this release. Operational platform logs can contain request/network metadata despite application-level token redaction. Access to server records is restricted; no client Firestore read/write access is enabled. No system can guarantee absolute security.
Cloudflare Pages hosts the public website and processes network/request metadata to deliver and protect it. The account-deletion page loads Google's Firebase Authentication libraries when you choose to start Google sign-in. Authentication and deletion requests go to Google/Firebase and the SelfSafe account API over HTTPS; Cloudflare is not used as a database for account deletion records. We do not add advertising or analytics scripts to these pages. Provider processing may occur internationally under the relevant provider terms and transfer safeguards. See https://www.cloudflare.com/privacypolicy/ and https://firebase.google.com/support/privacy for provider information.
Your rights and intended audience
Necessary authentication, access and purchase verification are used to provide the service you request. Proportionate support, service security and bounded trial-abuse prevention are based on legitimate interests in operating and protecting the service; legally required processing follows the relevant legal obligation. Where consent is required for optional processing, you can withdraw it. Android permissions are not blanket consent to unrelated processing.
Where applicable, you can request access, correction, deletion, restriction and portability, object to legitimate-interest processing and withdraw consent where consent is the basis. Contact the address above. Applicable requests are normally answered within one month; lawful extensions or exceptions will be explained. You can complain to your competent data-protection authority.
SelfSafe is intended for adults and teenagers aged 13 and over, not children under 13. It helps manage your own device use; it is not parental monitoring of communications. Local requirements for authorization by a parent/guardian and for purchases still apply. We do not collect a date of birth in the app.
Changes
Material changes to these practices will be reflected in the policy and, where appropriate, in the app. The public page identifies its effective date.