Rocco

Privacy Policy

Last updated: 20 July 2026 · Controller: DigITup GmbH

This Privacy Policy explains how DigITup GmbH (“we”, “us”) processes personal data when you use the Rocco iOS app and related web pages (for example buddy approval links).

1. Controller

DigITup GmbH
Königsallee 27
40212 Düsseldorf
Germany
Email: kontakt@dig-it-up.de
Phone: +49 211 23855-142

2. What Rocco does

Rocco is a self-blocking Screen Time tool. You choose which apps or categories to limit (“venues”). Blocking selections and most usage progress stay on your device. We do not need to know which apps you block in order to run analytics.

3. Data we process

3.1 On your device (not sent to us as app lists)

• Your Screen Time / Family Controls selection (opaque tokens managed by Apple)
• Door hours / schedules, door policy settings, house rules
• Local streaks, pins, shift reports, and related on-device progress
• Temporary unlock state while the door is open

These data remain in the app and its App Group on your iPhone. We do not receive the names of the apps you selected.

3.2 Account & subscription

• Sign in with Apple via Supabase Auth (EU-hosted Supabase project). We receive an Apple user identifier and, if you share it, your email address (or Apple’s private relay email).
• Purchases are processed by Apple. We use RevenueCat to manage entitlements (for example whether Rocco Pro is active). RevenueCat and Apple process payment data under their own terms; we do not receive your full card details.

3.3 Product analytics & crash reports (PostHog, EU)

We use PostHog (EU Cloud) for product analytics and error tracking. Events are business metrics only, for example app opens, onboarding steps, paywall views, purchases (product id / trial flag), shield shown, let-ins completed or denied, streak held/slipped, and similar. We intentionally do not send app names, selection tokens, venue labels, or custom schedule names.

Crash and uncaught exception reports may include technical stack traces, device/OS metadata, and app version so we can fix bugs.

Host: https://eu.i.posthog.com · Provider privacy info: posthog.com/privacy

3.4 Buddy (“second key”) links

If you use buddy approval, we store short-lived approval requests (for example request id, PIN hash/code state, expiry, approve/deny result) in Supabase so a buddy can open a web link and respond. Share links may be opened in a browser. Do not put sensitive content in messages you send with those links.

3.5 Website

Our public pages (including this policy) are hosted on GitHub Pages. GitHub may process connection data (IP address, user agent) as described in GitHub’s privacy statement.

4. Purposes & legal bases (GDPR)

• Provide the app and subscription — Art. 6(1)(b) GDPR (contract / pre-contract)
• Security, fraud prevention, abuse of buddy links — Art. 6(1)(f) GDPR
• Product analytics & crash diagnostics — Art. 6(1)(f) GDPR (improve reliability and UX)
• Legal obligations (for example accounting) — Art. 6(1)(c) GDPR

5. Recipients / processors

• Apple Inc. / Apple Distribution International (Sign in with Apple, App Store, Screen Time APIs)
• Supabase (auth and buddy request backend)
• RevenueCat (subscription entitlement status)
• PostHog (analytics and error tracking, EU)
• GitHub (hosting of this site)

Where we use processors, we rely on appropriate contracts / SCCs as applicable.

6. Retention

• On-device data: until you delete the app or clear local progress in settings
• Account data: for as long as your account exists, then deleted or anonymised within a reasonable period
• Buddy requests: short-lived; expired or completed requests are cleaned up according to our backend retention
• Analytics/crash events: retained according to our PostHog project settings (typically limited rolling windows)
• Billing-related records: as required by commercial/tax law

7. Your rights

Under GDPR you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority (in Germany typically your state data protection authority; DigITup GmbH is based in North Rhine-Westphalia).

Contact: kontakt@dig-it-up.de

8. Children

Rocco is intended for adults managing their own Screen Time. It is not directed at children. Do not use the app if you are under 16 (or the higher digital-consent age in your country), unless a parent/guardian has consented where required by law.

9. International transfers

We prefer EU hosting for analytics (PostHog EU). Some providers (Apple, RevenueCat, GitHub) may process data in the US or other countries with safeguards required by applicable law.

10. Changes

We may update this policy. The “Last updated” date will change. Material changes may also be noted in the app or on the site.