Tollgate is built phone first. Your questions, answers, stats, streaks, and settings live in a local database on your device, and the interesting stuff never leaves. Here is the complete accounting, the same one as the privacy policy, in plain words.
Stays on your phone, always
- Which apps you guard. This one is stronger than a promise: Apple never tells Tollgate which apps you picked, so there is nothing to send.
- Your app usage. Tollgate is never told which apps you opened or how long you spent in them. iOS only tells it that your allowance has run out.
- The database that powers your stats. Every question you saw, every answer, every shield, in one local file that never syncs anywhere.
Leaves your phone
- Four aggregate numbers, at most once every 20 hours: questions answered, correct count, minutes converted, current streak. They are keyed to a random ID, not to you, and they exist so we know whether Tollgate works in general.
- Anonymous analytics and crash reports, so we learn that a button is confusing or the app crashed, never what you were scrolling. That includes counting the moments themselves: a shield appeared, a question on a topic was shown, an answer was right or wrong. No app names and no question text, and anything resembling an identifier or URL is scrubbed before sending.
- Topic requests and question flags, since those have to reach our editorial queue to be useful. Send only what you would put in a suggestion box.
- Subscription status, handled by Apple and our payment processor (RevenueCat). Tollgate never sees a card number.
The parties involved
Exactly four: Apple (payments, App Store), RevenueCat (subscription records), PostHog (anonymous analytics), Convex (our own server, holding the four aggregate numbers and anything you write to us). No data brokers, no ad networks, no selling, renting, or trading, and no ad identifiers anywhere.
Want it all gone? Deleting your data covers both the phone side and the little that reached us.