Last updated: October 12, 2026
1. Introduction
Grounded ("we", "our", or "us") is a screen-time management and app-blocking application for Android. This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data.
By using Grounded you agree to the practices described in this policy. If you do not agree, please do not use the app.
2. Age requirements
Independent accounts are intended for users aged 16 or older (or 13 or older outside the European Union). A parent or legal guardian may create a child profile and link a supervised device using a pairing code. In that case, the account belongs to the adult. Child-device monitoring is only for a parent or legal guardian supervising their own child, not for monitoring another adult. The adult is responsible for obtaining any legally required parental consent. Location sharing and pre-approved listening require a separate approval on the child device and can be disabled there.
If you believe a child under the applicable age has created an account, please contact us at info@grounded-app.es and we will delete the account promptly.
3. Data we collect
| Data | Why we collect it | Stored where |
|---|---|---|
| Email address | Account identity, password reset, account-related notices | Our server |
| Password | Authentication | Stored only as a bcrypt hash — the plain-text password is never saved |
| Device fingerprint hash | Silent re-login after reinstall without storing raw device identifiers | Our server — a one-way SHA-256 hash only; the original device ID is never saved |
| App usage minutes (per app, per day) | Enforcing daily time budgets you set for apps | Our server |
| App package names you choose to block | Applying your blocking rules | Our server |
| Blocking group settings & schedules | Applying your blocking configuration | Our server |
| Tasks & reward history | Tracking task completion and credit rewards | Our server |
| Credits balance & transaction history | Managing your in-app credits | Our server |
| Purchase records & add-on subscriptions | Verifying purchases and unlocking features | Our server; also held by Google Play under their own policy |
| Parental PIN | Protecting settings from being changed by the supervised user | Stored only as a bcrypt hash on our server |
| Child profile name and linked devices | Identifying the supervised profile and authorising only its linked parent | Our server |
| Child-device app inventory, icons and status | Letting the linked parent choose remote blocking rules and check device status | Child device and our server |
| Location, accuracy, timestamps and visited places | Optional live location sharing and history of places observed for more than 30 minutes, including when the app is closed or not in use | Child device's offline queue and our server; rolling 30-day retention |
| Live microphone audio | Optional, visibly indicated one-way listening by the linked parent after child-device approval | Encrypted live WebRTC transmission, directly or through our relay; not recorded or stored by Grounded |
| Live camera video and shared screen content | Optional live viewing by the linked parent. Camera requires separate child-device approval; screen sharing requires child acceptance and Android approval for each session. | Encrypted live WebRTC transmission, directly or through our relay; not recorded or stored by Grounded. Available with the camera and screen-sharing release. |
| Sharing session and referral records | Consent, connection status, usage billing, purchase verification and preventing duplicate referral awards | Our server; no audio, video or screen content in session records |
4. Device permissions used
| Permission | Purpose |
|---|---|
| Usage Access | Reads how many minutes you have used each app today to enforce time budgets |
| Display over other apps (overlay) | Shows a blocking screen when a time budget is exhausted or a schedule is active |
| Query all packages | Lists installed apps so you can select which ones to block |
| Foreground Service (special use) | Keeps the blocking monitor running in the background so rules are enforced even when the screen is off |
| Receive boot completed | Restarts the blocking service automatically after the device reboots |
| Internet access | Communicates with our server to sync settings and verify subscriptions |
| Location and background location | Optional approved sharing and place history when the app is closed or not in use. Android's Allow all the time permission supports recovery after a restart. |
| Microphone and microphone foreground service | Optional approved one-way listening with a visible notification and Stop action. Listening pauses to release the microphone when another app or a call needs it. |
| Camera and camera foreground service | Optional approved live front/rear camera sharing, with a visible Grounded notice and Stop control. Standby does not capture images. |
| Media projection foreground service | View-only screen sharing after Android's per-session approval. Protected content may be blank. Screen lock or Android's Stop control ends sharing. |
| Notifications and media playback foreground service | Identifying active monitoring and keeping approved listening playback running with the screen off |
No permission is used to collect data beyond what is described in Section 3.
5. How we use your data
- To operate and synchronise your blocking rules and settings across reinstalls
- To enforce daily time budgets and blocking schedules
- To manage your account, credits, and purchased add-ons
- To send a one-time password reset code when you request it
- To respond to support or account-deletion requests
- To let a linked parent manage child-device groups, tasks and screen-time rewards
- To provide separately approved child-device location sharing and live listening
We do not use your data for advertising, profiling, or any purpose beyond operating the app.
6. Data sharing and third parties
We do not sell or rent your personal data. The following recipients are involved in providing the service:
- Google Play (Google LLC) — processes payments for in-app purchases and subscriptions. Google may retain transaction records under their own Privacy Policy. Grounded has no control over records held by Google Play.
- Your linked parent receives the supervised device's app information, task submissions, approved location and approved live audio, camera video or shared screen content. Only the linked account is authorised.
- Hetzner hosts our API, database and live-audio relay in EU data centres.
- OpenStreetMap tile servers receive the requesting phone's IP address and the requested map area to display maps. We do not send child names, account details or full location history to them. See the OpenStreetMap Foundation privacy policy.
We may disclose data if required by law or to protect our legal rights, but only to the minimum extent required.
7. Data security
- All communication between the app and our server uses HTTPS (TLS).
- Passwords and PINs are stored exclusively as bcrypt hashes — they cannot be reversed.
- Device identifiers are stored only as a one-way SHA-256 hash.
- Our server infrastructure is hosted on Hetzner (EU data centres, Germany/Finland).
8. Data retention
Account settings and associated service records are retained while your account exists. Location points and place history have a rolling 30-day retention period. The child or linked parent can disable sharing and delete location history without deleting the account. Live audio, camera video and shared screen content are not recorded or stored. Account deletion removes associated personal data from the live application database; restricted operational backups may contain older copies until those backups expire. Payment providers may retain records under their own legal obligations. Limited hashed account/device tombstones and pseudonymous purchase/referral ledgers are retained to prevent repeated trials, purchase replay and referral abuse, and to reconcile refunds. These records do not contain live audio or location history. Contact us with retention or erasure requests concerning these restricted records and backups.
See our Account Deletion page for full details and in-app instructions.
9. Your rights
Under the GDPR (EU/EEA users) and applicable data protection laws, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and all associated data at any time (in-app or by email)
- Withdraw consent — you may stop using the app and request deletion at any time
- Lodge a complaint with your national data protection authority
To exercise any of these rights, contact us at info@grounded-app.es.
10. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions or requests, contact us at info@grounded-app.es.