Most privacy claims are promises. This one is a wall.
When you pick apps to guard, the picker you use belongs to Apple, not Tollgate. And when you tap Done, Apple does not hand Tollgate a list of app names. It hands over an opaque token, a sealed envelope that iOS itself can read but the app cannot. Tollgate passes that envelope back to iOS when arming the guard, and iOS does the shielding.
The result:
None of this rests on a promise written into the app’s copy. The token never leaves your phone because there is nothing readable to send, Tollgate cannot turn it into app names even on the device itself, and analytics cannot leak it by accident: any token-shaped value is stripped out of an event before that event is sent.
Whatever you guard, a dating app, a gambling app, a competitor’s app, an ex’s feed you check too often, is nobody’s business, including ours. Because the names never enter Tollgate’s process, they cannot leak in a crash report, cannot be subpoenaed from us, cannot appear in analytics, and cannot be mishandled by a bug. The strongest data protection is not storing the data at all.
This is why Tollgate’s own copy always says “your guarded apps” and never names one, and why stats are never broken down per app. The shield’s second button looks like an exception, because it does carry the app’s name, but Tollgate only supplies a placeholder there. iOS fills in the name as it draws the shield, and the app never sees what it wrote. A small price for a promise with no fine print.
More on the overall picture in What data leaves your phone.