Offhours privacy

Enfinitive AB (org. no. 559601-4109), C/o Enfinitive AB, Klockaregatan 5b, 711 31 Lindesberg, Sweden, makes Offhours and is the controller of the personal data described here. Email: contact@enfinitive.se.

• The apps you choose and how you use them stay on your iPhone. Apple’s Screen Time gives Offhours private tokens instead of app names, and Offhours never receives usage figures.
• Your schedules, limits, tasks and history are stored on your iPhone. The exception is a record of each photo check, which our server keeps for 180 days.
• You need an account to use Offhours. Our server holds your Sign in with Apple account.
• A task photo leaves your iPhone only after you allow photo verification. An AI model from Anthropic checks it, and we delete our copy once a result is recorded.
• Offhours has no ads or tracking and includes no analytics kit, and we don’t sell your data.
• You can delete your account in the app at any time. Deleting the app alone doesn’t delete your account.

The app stores these on your iPhone and doesn’t send them to us:

• the apps, categories and websites you choose, held only as Apple’s private tokens
• your schedules, limits, Always blocked list, Important apps and saved app lists
• your Zen history, activity and streaks
• your task list, apart from the records of photo checks described below
• anything you write for a journal or plan task
• the name and picture on your profile, and your app color

Screen time. The Notifications and Screen Time cards on Today are drawn by an iOS extension that Apple keeps in a sandbox, so the figures reach neither the app nor us. All Offhours learns about your usage is when a limit’s time has been reached and, on limits of 15 minutes or more, when five minutes are left.

Apple Health. If you choose a task checked with Apple Health, Offhours asks to read your steps, workouts and mindful minutes. It reads them on your iPhone to check the task and never sends them anywhere. It doesn’t write to Health.

Notifications. These are created on your iPhone. Offhours doesn’t use a push service.

Backups. If you back up your iPhone, this information can be part of that backup. Apple or your computer handles it, and we have no access to it.

You need an account to use Offhours, and you create it with Sign in with Apple. Photo checks are optional. Our server holds:

• an account ID, and the identifier Apple gives us for you
• the email address Apple shares with us, which is a private relay address if you choose to hide yours
• a Sign in with Apple token, so that we can ask Apple to disconnect Offhours from your Apple ID when you delete your account
• from your first photo check, a device key that lets us confirm requests come from the app on your iPhone. This check isn’t switched on yet, so the key is stored but not used.

If Apple shares your name when you sign in, your first name is saved on your iPhone as what the app calls you. It isn’t sent to our server. We don’t use your email address for marketing.

Legal basis: providing the service you asked for (Article 6(1)(b) GDPR), and our legitimate interest in keeping the service secure for the device key (Article 6(1)(f)).

Task photos are the only thing you create that leaves your iPhone, and only for tasks checked by a photo. With each one, the app tells our server which built-in task it is for. Offhours asks your permission first and names Anthropic when it does. You can withdraw that permission at any time under Photo verification in Account, and you can still complete tasks without a photo.

This is what happens to a photo:

1. You take it with Offhours’ own camera. It can’t come from your photo library, and Offhours doesn’t save it there.
2. The app shrinks it and removes location and camera details.
3. It is uploaded to storage at Supabase, on AWS in Stockholm.
4. Our server sends it to Anthropic with the task’s name and what the task asks for. We don’t send your name, email address or account ID with it.
5. An AI model answers pass, fail or unclear, with a short explanation. That explanation can mention what the model saw in the photo.
6. We delete our copy once a result is recorded. If a check doesn’t finish, a cleanup job removes the copy, with a final pass shortly after the two-hour upload window ends.

Whatever is in the picture goes with it, so keep other people and anything private out of the frame. We don’t look at your photos, and under Anthropic’s commercial terms it may not train its models on what we send.

The check is automatic, no person reviews it, and it can be wrong. It decides only whether that task counts as done in Offhours, which can keep a block running. After a fail you can take another photo. If the check can’t run or stays unclear, you can mark the task done without verification, in some cases after another try. Your iPhone notes it as unverified, and nothing about that is sent to us.

Our server keeps a record of each photo check: the task, the time, the result and its explanation, how confident the model was, whether it suspected a photo of a screen, and technical details such as the model used. We use these records to see how well the checks work and to look into misuse. The app shows you the result at the time of the check. For each accepted photo we also keep a non-image identifier, used only to spot the same or a very similar photo being used again.

Legal basis: your consent for sending and checking photos (Article 6(1)(a) GDPR). Withdrawing it stops further photos but doesn’t undo earlier checks. Our legitimate interest in improving the checks and preventing misuse for the records and the identifier (Article 6(1)(f)).

When the app talks to our server, Supabase receives the technical information any server receives, such as your IP address and the time of the request. Its sign-in system keeps session records, which can include your IP address and device details. Server logs record your account ID, which task was checked and the result, but never task photos or the explanation. Deleting your account doesn’t remove log entries already written; they expire as shown below. Short-lived counters limit how many checks an account can ask for.

Legal basis: our legitimate interest in keeping the service secure and its costs under control (Article 6(1)(f) GDPR).

• Our copy of a task photo: until a result is recorded, or until the cleanup job described above removes it.
• Anthropic’s copy: Anthropic’s policy is to delete API inputs and outputs within 30 days. It can keep them longer to enforce its Usage Policy or where the law requires. If its automated systems flag a violation, it keeps them for up to 2 years and its safety classification scores for up to 7 years. See Anthropic’s retention policy.
• The record of each photo check: 180 days.
• The non-image identifier: 90 days.
• Request counters: about 30 days.
• Short technical records for setting up the device key and uploading photos: up to 7 days. An upload record containing your account ID can remain for about two and a half hours after you delete your account.
• Your account, email address, Sign in with Apple token and device key: until you delete your account.
• Sign-in records at Supabase: while your account exists. Some security entries can remain for a time after it is deleted.
• Server logs: up to 28 days.
• Backups of our database: up to 14 days.

If Apple can’t be reached when you delete your account, we keep trying to disconnect Offhours from your Apple ID for up to 30 days, using a copy of the token that isn’t linked to any account.

• Supabase runs our database and photo storage on AWS in Stockholm, on our behalf. The code that handles a request runs in the Supabase region closest to you and holds a photo only while it sends it to Anthropic.
• Anthropic checks task photos on our behalf. It stores API data in the United States and may run the model in other countries. See Anthropic’s data residency page.
• Apple provides Sign in with Apple, Screen Time, Apple Health, the App Attest service behind the device key, and the App Store, under its own privacy policy. Apple handles any purchase, and we never receive your payment card details.

Supabase and Anthropic are bound by data processing terms that limit what they may do with your data and require them to protect it. We don’t sell your personal data or share it for advertising. We share it with anyone else only if the law requires it.

If you email us for support, the website privacy notice explains how we handle your message.

Anthropic stores API data in the United States and may process it in other countries, and Supabase may handle data outside the EU and EEA. These transfers rely on the European Commission’s standard contractual clauses, which are part of the data processing terms of both companies. You can ask us for a copy of them.

You can ask for access to the personal data we hold about you and have it corrected or erased. You can also ask us to restrict how we use it and to receive it in a portable format where that applies. Where we rely on your consent, you can withdraw it at any time.

Your right to object. Where we rely on our legitimate interest, you can object at any time, and we will stop unless we have compelling grounds to continue.

In the app, under Account, you can:

• turn Photo verification off
• use Export activity data to save your activity totals, Zen sessions and journal entries
• use Delete activity history to clear your history from your iPhone
• use Delete account. This removes our stored task photos, your account and its verification records, and clears your profile, activity, schedules, tasks and app choices from your iPhone. It also asks Apple to disconnect Offhours from your Apple ID. If that doesn’t complete, or you choose to delete without confirming with Apple, you can remove Offhours yourself under Sign in with Apple in your Apple Account settings. Permissions in iOS and your Home Screen icon stay as they are. It doesn’t change Anthropic’s separate retention, and it can’t be undone.

Deleting the app from your iPhone doesn’t delete your account. For a copy of what our server holds, or for anything else, email contact@enfinitive.se and we will respond within the time the law requires. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

Offhours isn’t for children under 13. Photo verification is for people aged 18 or over, so please don’t turn it on if you are younger. If you think a child has given us personal data, email us and we will delete it.

If Offhours starts handling data in a new way, for example by backing up your settings to our server, we will update this page and the date at the top before that change reaches the app, and ask for your permission where the law requires it.