Brickify — Privacy Policy

Last updated: May 2026

Short version: Brickify stores as little as possible. Your passcode is never stored in plain text — only a one-way hash. We do not track you, sell your data, or show adverts.

Who we are

Brickify is developed by Rain or Shine Apps (Anne Mundy, independent developer, UK).
Contact: brickify@rainorshineapps.com

What data we collect and where it lives

Stored only on your device

Passcode hash — a one-way SHA-256 hash of your 4-digit PIN. The original PIN is never stored.
Second factor configuration — which 2FA method you chose (Parent PIN hash, TOTP secret, or recovery email address).
Recovery code hashes — SHA-256 hashes of your 3 backup codes. The original codes are not retained on-device after display.
Block list — which apps you have chosen to block.
Bricked state — whether the phone is currently in bricked mode.
Notification email — the parent email for new-app install alerts, if provided.
Device ID — a randomly generated identifier used only for support recovery lookups.

Stored on our server (Supabase)

Recovery codes (plaintext) — your 3 backup codes are stored in our Supabase database, associated only with your device ID. This allows support to retrieve a code if you lose all three.
Trial start date — associated with your device ID, so a reinstall can't reset your free trial.
Heartbeat status — your device ID, platform, brick status, and last-active time, so we can alert your notification email if a bricked device goes silent or has its admin permissions revoked. Includes your notification email and push token if you provided them.
Account — if you choose email as your second factor, Supabase creates a login-style record for that email address so we can verify one-time codes. There is no password and no separate profile beyond this.

We use Supabase as our database provider. Supabase's privacy policy applies to data held on their infrastructure.

Not collected

No analytics or usage tracking
No advertising identifiers
No crash reporting services
No data about which apps you actually use

Email notifications

If you provide a notification email address during setup, we send an email when a new app is installed on the device. These emails are sent via Gmail from rain.or.shine.apps@gmail.com. You can remove your notification email at any time in Brickify's Settings screen.

Children's privacy

Brickify is a parental control tool intended to be set up by a parent or guardian. The app does not knowingly collect personal data from children. The only data stored is configuration chosen by the parent during setup.

Request account & data deletion

In the app: Setup → "Delete my account & data" — requires your passcode and second factor, and removes all server-side data (recovery codes, trial record, heartbeat history, and any email account) immediately.

Without the app installed: email brickify@rainorshineapps.com with your device ID (shown on the recovery screen, or in any alert email you've received) and we'll remove your data manually.

Data retention

On-device data is deleted when the app is uninstalled. Server-side data is only ever deleted via one of the two methods above — we don't automatically expire it while an account is active.

Your rights

Under UK GDPR you have the right to access, correct, or delete the data we hold. Since we hold almost no identifiable data (only a device ID and recovery codes), most requests can be fulfilled by emailing us your device ID.

Changes to this policy

If we make material changes we will update the date above. Continued use of the app constitutes acceptance of the updated policy.

Contact

brickify@rainorshineapps.com