Privacy Policy — Uzak

Last updated October 12, 2026.

Uzak has no account and no server of its own. It never sees which apps you use, and nothing from Apple's Screen Time system — no app names, no usage figures, nothing about the apps you block — is ever sent anywhere. A few outside services do receive a small amount of data from the app. Every one of them is listed below, with what it gets and why.

What stays on your phone

Your focus sessions and the city you've grown are stored only in the app's own storage on your device. That storage is shared with the parts of the app that keep working when it isn't open — the shield shown over a blocked app, the button that lifts it, and the piece that ends a session on schedule — so they can act without you reopening the app. That sharing is Apple's ordinary way for an app's own components to see the same data, not a network connection, and none of it is visible to us.

While a session runs, a Live Activity shows its progress on your lock screen. It is drawn on your phone from the session already stored there; it is not sent to us or to Apple, and the app does not ask for a push token to update it.

Blocking apps

To lock your screen during a session, the app uses Apple's Screen Time system (Family Controls). It asks Apple's system to shield your apps as a whole — it does not ask which apps you actually have, and it never receives a list of them. You approve this once, in a system dialog. Every session unlocks on its own after four hours at the latest, and you can end one at any time in the app.

Who receives data, at a glance

• Apple — takes the payment when you buy Uzak Pro. Always. Apple's privacy policy.
• RevenueCat — checks your purchase so Pro unlocks and restores. Always. RevenueCat's privacy policy.
• Google Firebase (Crashlytics and Remote Config) — crash reports and the app's settings. Always. Firebase privacy and Google's privacy policy.
• Amplitude — usage statistics and an approximate location (country or city, from your IP address). Always. Amplitude's privacy policy.

RevenueCat, Firebase Crashlytics and Amplitude all file what they receive under one random ID that the app makes the first time it opens: the app ID. It is not your name, your email, your Apple Account or Apple's advertising or device identifiers. It is stored in your phone's Keychain, only on this device: it stays the same if you delete and reinstall Uzak, it is not synced to your other devices, and a second phone gets its own. Because the same ID is used in all three services, we can see, for example, that a crash happened to someone who had bought Pro.

Nothing in any of the sections below comes from Screen Time: the app never receives the list of your apps, and it never sends the name of an app, how long you use anything, or anything you did in another app.

Purchases (Apple and RevenueCat)

If you buy Uzak Pro, Apple's own purchase system handles the payment. We never see your card, your name, your email or your Apple Account. The purchase is then verified through RevenueCat, a purchase-management service, so the app can unlock Pro and restore it on your other devices. RevenueCat receives the purchase record Apple issues — which product, when it was bought, whether it is still active or in a free trial — along with basic technical details such as your iOS version, the app version and your App Store country. All of it is filed under the app ID described above. That ID is not tied to your name or your Apple Account; at RevenueCat it only keeps your purchases together. This is needed for Pro to work.

Usage statistics (Amplitude)

Uzak sends Amplitude, an analytics service, the events below and nothing else. They are sent from every install: the app does not ask first and has no switch for them. No event ever says which apps you have, which you chose to block, or which one you tried to open.

• When you open and close the app (Amplitude's own session start and end).
• onboarding_step_viewed — which setup screen you reached (the welcome screen, how it works, each of the three questions, your first week, the Screen Time permission, your city rising, your town) and its place in that order.
• onboarding_completed — that you finished setup.
• permission_result, permission_skipped — whether you allowed Screen Time, declined it, the request failed or you skipped it, and whether that was during setup or later.
• paywall_shown — that the Pro offer appeared, why (during setup, after a session, when the app opened, or because you opened it, and from which screen), whether the one-time purchase was offered, and, when known, whether it was our standard offer or another one.
• paywall_plan_selected — which plan you picked on the offer.
• close_shown, close_tapped, paywall_dismissed — that the offer's close button appeared, that you tapped it, and that you left the offer without buying, with how many seconds it was open (counted up to 120).
• purchase_started, purchase_completed, purchase_cancelled, purchase_failed — which product (weekly, yearly, monthly or one-time) and its type, whether a completed purchase started a free trial, and for a failure a general reason (pending, network, not verified, or other). Never a price or an amount.
• restore_completed — whether restoring found a purchase.
• session_started — the planned length of a focus session, rounded up to 15, 30, 60, 120 or 240 minutes, and whether it is your first.
• session_completed — the planned and actual length in those same steps, whether the session was long enough to count, whether your city grew from it, whether it was your first, and the time it ended (to the second, in UTC).
• session_broken — for a session that ended early: how long it ran (in those steps), how it ended (you ended it in the app, or you broke the seal on a shielded app), whether it was your first, and the time it ended.
• population_milestone_reached — that your city passed one of a few fixed sizes, whether you have Pro, and how many days it has been since you installed the app.
• screen_viewed — which of the app's own screens you opened (home, session, reward, statistics, passport, cities, settings) and from where.
• reward_action, landmark_tapped, settings_action — which button you chose after a session, which of the city's landmarks you tapped (its name in the app's fixed list), and which Settings row you opened (support, terms or privacy).
• review_prompt_requested — that the app asked iOS to show the rating prompt, which it does at most once. The app cannot tell whether the prompt appeared or what you rated.

Alongside the events, Amplitude keeps a few facts about your install, updated when they change: whether you have Pro (is_pro), whether Screen Time is allowed (screen_time_authorized), the app's language (app_locale), and your answers to the three setup questions, as the daily goal in minutes and the number of the option you picked (onboarding_daily_goal_minutes, onboarding_usage_answer, onboarding_trigger_answer). Nothing you type is sent; the app has no text fields. Each event carries the app ID, a second random ID that Amplitude makes on your phone, your language, phone model, iOS version and the app version. Neither ID is Apple's advertising or device identifier.

Amplitude also receives the IP address the statistics are sent from, and uses it to estimate an approximate location: your country, region or city. The app never asks for location permission and never sends your precise location.

We use these statistics to see where people get stuck during setup, whether focus sessions work as intended, and which offers people choose. They can't be switched off in the app; they stop when you delete it.

Crash reports and settings (Google Firebase)

If the app crashes, Firebase Crashlytics receives a crash report: the technical state of the app when it failed, details about the phone such as its model and iOS version, the app ID and a Firebase installation ID. Firebase also notes each time the app starts, so crash rates can be counted. When the app opens it asks Firebase Remote Config for settings we can change without a new release (today, when the offer to upgrade appears, whether it can be closed, what it shows and when a launch offer ends); that request carries the installation ID, your country code, language, time zone, iOS version and the app's identifier. This is how we find and fix crashes. It can't be switched off from inside the app. Uzak does not include Google Analytics for Firebase or any advertising product. Crashes in the parts of the app that run outside it (the shield and the session timer) are not reported to Firebase.

Separately, if you have turned on sharing with app developers in iOS Settings (Privacy & Security, Analytics & Improvements), Apple may pass us crash reports it collected. That is Apple's setting, not the app's.

What the outside services may do with it, and for how long

Amplitude, Google and RevenueCat receive this data only to run the features described above. We don't sell it, use it for advertising, or combine it with data from other companies to follow you across other apps or websites. The app ID links the records of these three services to each other only; it is never shared with other apps or with advertisers. Uzak does not track you in the sense Apple's App Tracking Transparency defines, and never asks for that permission. Each service processes the data for us under its own data processing terms, which commit it to security measures and hold it responsible for the companies it uses.

How long it is kept: Crashlytics crash reports are kept for 90 days. The Firebase installation ID used for settings requests is kept until we delete it, and Google then removes it within 180 days. RevenueCat does not publish a fixed retention period; it keeps purchase records for as long as they are needed to provide your purchases. For usage statistics, the plan we use shows us one year of Amplitude data.

Asking for deletion

Usage statistics, crash reports and purchase checks can't be turned off in the app; they stop when you delete it.

To have data deleted, open Settings in Uzak and tap "Support". That starts an email to support@uzak.city that already carries your app ID (the line "User ID"), your phone model, iOS version and app version; send it and say you want your data deleted. Because none of these services knows your name, the app ID is the only way we can find your records.

With that ID we delete your user in Amplitude and your customer record in RevenueCat within 30 days of your email. Amplitude accepts new events even from a user whose records were deleted, so delete the app first if you want nothing more to be sent. Deleting the RevenueCat record does not take away what you bought: the purchase itself is Apple's, and "Restore" on the Pro offer gets Pro back from Apple at any time. Crash reports at Google (Firebase) expire on their own after 90 days. The settings requests Firebase received are filed under an installation ID the app does not show, so we cannot pick yours out to delete them. Purchase records held by Apple are handled through your Apple Account. Deleting the app deletes your sessions and your city, but not what was already sent, and not the app ID: it stays in your phone's Keychain so a reinstall keeps the same ID.

Backups

The app does not mark its data to be skipped by device backups. So if you back up your phone to iCloud or a computer, that backup most likely includes this small amount of local data, the same as it would for most other apps' local storage. We could not confirm Apple's exact current policy on this from their own documentation while writing this page, so treat this as our honest best understanding rather than a guarantee.

Links that leave the app

A few places in the app hand a link to your browser or mail app: this policy, Apple's standard terms, and the address below. Opening one is a request made by that other app on your behalf, not by us, and we see nothing of it.

Questions

Write to support@uzak.city — that reaches a person, not a team.