What an app blocker can see on your iPhone

· 4 min read

When you choose apps to block in Offhours, the list on your screen is drawn by iOS. Apple’s name for it is FamilyActivityPicker. Its documentation describes a view for choosing apps “without revealing their choices to the app.”

Tokens in place of app names

When you confirm your choice, iOS gives Offhours opaque tokens that stand for the apps, categories and websites you picked. Offhours saves them and hands them back to iOS to say what to block. It can’t turn a token into a name. In the app itself, Apple says, a chosen app’s display name and bundle identifier come back empty.

The extension that configures the blocked screen does get names, so that it can draw that screen. Apple runs it in a sandbox that stops it making network requests or moving sensitive content out. Offhours’ extension works out its words by checking which of your blocks lists a token.

If you remove Offhours’ Screen Time access, Apple says the tokens are voided.

Usage stays inside an extension

The Notifications and Screen Time cards on Today show real app names, icons and counts. iOS produces those through a report extension. Offhours asks for a report, and the result appears on screen without the data reaching the app. Apple says this extension runs in the same kind of sandbox.

You can see the effect on a limit’s row, which can’t show how many minutes you have left. Offhours never receives usage numbers. iOS wakes a small extension when a limit’s time has been reached and, on a limit of 15 minutes or more, five minutes before. That is all Offhours learns about your usage.

What stays on your iPhone

As the app is built today, your schedules, limits, Always blocked list, Important apps, saved app lists, Zen history and task list are stored on the phone only. So is anything you write for a journal or plan task. Tasks checked with Apple Health are read on the phone, and the readings never leave it.

What goes to the server

Your Offhours account is made with Sign in with Apple. The server holds the email address it receives, an account ID and a Sign in with Apple token, which lets Offhours disconnect your Apple ID when you delete your account. It also holds a device key for recognising the app, and its logs record your account ID, which task was checked and the result, until they expire.

Task photos are the only content that goes up, and only for tasks checked by photo, after you have allowed it. You can withdraw that permission in Account. The path of a photo is:

  1. You take it with Offhours’ own camera. There is no way to choose one from your photo library.
  2. The app shrinks it and removes location and camera details.
  3. It is uploaded to storage at Supabase, on AWS in Europe.
  4. The server sends it to Anthropic, where an AI model checks it against the task. Anthropic stores API data in the United States and may run the model in other countries.
  5. Offhours deletes its copy once a result is recorded. If a check doesn’t finish, a cleanup job removes the copy, with a final pass shortly after the two-hour upload window ends.

Anthropic handles its copy separately. Its policy is to delete API inputs and outputs within 30 days, unless it needs them longer to enforce its Usage Policy or the law requires it, and it keeps them for up to 2 years, and trust and safety classification scores for up to 7 years, if its automated systems flag a violation.

Offhours keeps which task it was, the time, the result and a short explanation for 180 days. It also keeps a non-image identifier for 90 days, used only to spot the same photo being reused. Deleting your account removes these records. It doesn’t change Anthropic’s retention. The app includes no analytics or advertising kit.

No VPN and no configuration profile

Some blocking tools work through a VPN, and Apple’s App Review Guidelines allow parental control and content blocking apps from approved providers to use its VPN interface. Others use device management. In 2019 Apple warned that a management profile can give a third party control of a phone and access to its location, app use, email accounts, camera permissions and browsing history. Guideline 5.5 now allows this for parental control only in limited cases.

Offhours uses neither. Its blocks go through Apple’s Managed Settings framework. Once the app is out, you can check this yourself: installed profiles appear in Settings, under General, then VPN & Device Management, and Offhours adds nothing there.

What this doesn’t cover

The limits on the extensions are Apple’s, and we rely on its description of them. Offhours is still being built. Its privacy policy is the full list of what it handles. This article describes the app’s code, including server changes that aren’t live yet, and its Data & privacy page on the date above.

Sources