The short version
- Your reflections stay on your device. Gratitude entries, journal entries, mood logs, letters to yourself, and your sanctuary state are written to local app storage. They are not synced to our servers.
- We don't sell your data. Ever. There are no third-party advertisers, ad SDKs, or marketing trackers in the app.
- We do collect anonymized usage events. Taps, screen views, and gate fires flow through a privacy-respecting analytics service so we can improve the app. The content of any reflection you write is excluded.
- You can opt out. Analytics can be turned off in Settings, and uninstalling the app removes the local data.
1. What we collect, and where it lives
Pax Gate is built to be a quiet, local-first app. The vast majority of what you generate inside it never leaves your phone. Here's the full inventory.
Reflection content Local only
The text you write in the gate prompt, in the home reflection composer, in the widget reflection sheet, and in Month-in-Review / Letter-to-Self entries. Also mood tags (Calm, Grateful, Anxious, etc.) and their intensity (Lightly / Clearly / Deeply).
Stored in an encrypted local database (Room) on your device. Never transmitted off-device.
Pause Plan configuration Local only
Which apps you've added to a gate, your unlock-window durations, friction level, prompt style, frequency (every open / once per hour / once per day), and any active gate rules.
Stored in DataStore Preferences on your device.
Progress and streak data Local only
Your presence chain (consecutive days with a reflection), Bambu currency, achievements unlocked, sanctuary room ownership, and milestone progress.
Stored in DataStore Preferences on your device.
App usage events Anonymized analytics
We send anonymized event metadata to PostHog, a self-hosted-friendly product analytics service. Events include things like "gate fired", "reflection saved", "settings opened", and rough metadata such as which gate type was used or which mood category was selected.
What's never included: the text of your reflections, the names of friends or family you mentioned, or any identifying information you typed.
This data helps us understand which features are useful so we can focus engineering effort on what matters. You can turn analytics off in Settings → Privacy → Analytics.
Crash and stability reports Anonymized analytics
If the app crashes, we log a stack trace and the device's Android version / model to help us fix the bug. We do not log the contents of any text fields or the names of any apps you've gated.
Subscription receipts Only if you purchase
Premium features are processed through Google Play Billing (Android). When you purchase, Google passes us a signed receipt so the app can verify your premium entitlement. We never see your card number or billing address; those stay with Google.
2. Permissions the app requests
Some of Pax Gate's features depend on Android system services. Here's what we ask for and why.
Accessibility Service
The accessibility service is how Pax Gate detects when you've just opened a gated app, so it can show the gate screen before you start scrolling. The service reads only the foreground app's package name. It does not read the content of any screen, does not log keystrokes, and does not transmit anything off your device.
Usage Access
Used in tandem with the accessibility service to detect cold-start launches (i.e., the difference between minimize-then-resume vs. close-then-reopen). This lets the "every open" gate rule fire correctly only when you actually open the app fresh.
Battery optimization exemption
Optional. Android's battery saver will occasionally stop the accessibility service in the background, which causes gates to silently stop firing. The exemption keeps the service alive so your gates remain reliable. You can revoke it at any time in your phone's system settings.
Notifications
For milestone celebrations and presence-chain reminders. You can mute notifications individually inside the app, or in your phone's system settings.
Microphone (only on speech-to-text)
When you tap the "Speak instead" button inside a reflection, the system's speech recognizer captures audio locally and returns the transcribed text. Audio is handled by the Android Speech Recognizer service; Pax Gate only receives the resulting text. We never record audio in the background.
3. Third parties we use
Where we depend on outside services, we choose ones with strong privacy postures and we minimize what they see.
- PostHog — anonymized product analytics events. Configured to scrub personal identifiers and to never collect reflection content.
- Google Play Billing — subscription processing. Handles all card data; we only see the entitlement verdict.
- Android Speech Recognizer — a system service for voice input. Operates within Android's own privacy boundaries.
We do not use third-party advertising networks, social-login providers, retargeting pixels, or marketing automation platforms.
4. Your data, your controls
Turn analytics off
Open the app, go to Settings → Privacy → Analytics, and toggle it off. From that moment on, no further events are sent to our analytics service.
Delete your data
Uninstall Pax Gate. Because your reflections and configuration live in local app storage, removing the app removes the data along with it. Android's standard Apps → Storage → Clear data action does the same without uninstalling.
Export your journal
Open the journal, tap the share icon, and choose your preferred format. Your reflections never leave your device unless you initiate this export yourself.
Children's privacy
Pax Gate is intended for users aged 13 and older. We do not knowingly collect data from anyone younger.
Data retention
Your reflections stay on your device until you delete them, clear the app's data, or uninstall the app. Analytics events stored with PostHog are retained for a maximum of 24 months before automatic deletion.
5. Changes to this policy
If we update what we collect, what we do with it, or which third parties we use, we'll update this page and bump the "Last updated" date at the top. Material changes (anything that meaningfully expands data collection) will be surfaced inside the app the next time you open it.
Questions or requests?
If you'd like a copy of any data we have associated with your install, want to delete an analytics record, or have any other privacy question, write to us:
We aim to respond within five business days.