Tollgate is built phone first. Your questions, answers, stats, streaks, and settings live in a local database on your device, and the interesting stuff never leaves. Here is the complete accounting, the same one as the privacy policy, in plain words.
Stays on your phone, always
- Which apps you guard. This one is stronger than a promise: Apple never tells Tollgate which apps you picked, so there is nothing to send.
- Your app usage. When you scrolled, for how long, when shields fired. All of it stays local.
- Which questions you saw and how you answered. The database that powers your stats never syncs anywhere.
Leaves your phone
- Four aggregate numbers, at most once every 20 hours: questions answered, correct count, minutes converted, current streak. They are keyed to a random ID, not to you, and they exist so we know whether Tollgate works in general.
- Anonymous analytics and crash reports, so we learn that a button is confusing or the app crashed, never what you were scrolling. Anything resembling an identifier or URL is scrubbed before sending.
- Topic requests and question flags, since those have to reach our editorial queue to be useful. Send only what you would put in a suggestion box.
- Subscription status, handled by Apple and our payment processor (RevenueCat). Tollgate never sees a card number.
The parties involved
Exactly three: Apple (payments, App Store), RevenueCat (subscription records), PostHog (anonymous analytics). No data brokers, no ad networks, no selling, renting, or trading, and no ad identifiers anywhere.
Want it all gone? Deleting your data covers both the phone side and the little that reached us.