Decafly / Your space, respected

Privacy Policy — Decafly for iPhone

Last updated: 2026-10-08

Decafly for iPhone has two halves. It puts a block screen in front of the apps you choose, and it can open a clean version of Instagram or YouTube — the official web site, without Reels, Shorts or Explore — inside Decafly itself. This policy explains what the app can see, what it keeps, and what ever leaves your device.

Decafly is not affiliated with, endorsed by, or sponsored by Google, YouTube, Meta, or Instagram.

The short version: Decafly has no account, no analytics, no advertising, and no crash-reporting SDK. Every decision it makes, it makes on your iPhone. The one outside service is RevenueCat, which keeps the record of a Decafly Pro subscription (section 4). Decafly's own server receives only feedback you choose to send, when you tap Send (section 5).

1. Blocking apps: what Screen Time gives Decafly, and what it withholds

Decafly blocks apps with Apple's Screen Time APIs (Family Controls, ManagedSettings, DeviceActivity), for your own device only. It does not manage anyone else's device and does not use Family Sharing.

When you choose apps in the system picker, iOS does not hand your choice to Decafly as a list of names. It hands back opaque tokens: values iOS can match back to an app, and that an app cannot read, print, or turn into a name, bundle identifier, or icon. Decafly stores those tokens and, beside each one, a slot — a short SHA-256 digest of the token, used as a stable internal key so the rest of the app never has to touch the token itself.

There is exactly one place an app name is visible: the block screen. iOS draws that screen in a separate extension and gives the extension the app's display name so the title can say which app you just opened. That extension cannot hand the name back to Decafly — shared preferences, files, and system notifications between the two processes do not carry it, and we measured this before relying on it. Nothing Decafly records — the event log, the diagnostics channel, the lock activity list — contains an app name or a token.

Screen Time data does not leave your device. Decafly cannot see your screen: it uses no Accessibility API, no screen recording, and no other way to look inside another app. On iOS, no such way exists.

2. The clean version: the official site, in an in-app browser, with hide-only rules

The clean version is not a copy of Instagram or YouTube and it is not a proxy. It is an in-app browser (WKWebView) that loads the platform's own web site — instagram.com or m.youtube.com — directly from the platform, over HTTPS. Only hosts on a fixed list built into the app can load inside it: that platform's own domains, the servers it serves images and video from, and its sign-in pages. A link to anywhere else opens outside Decafly, in the system browser.

Inside that page, Decafly applies a rule set: a list of URL paths to refuse and CSS selectors to hide, so the Reels tab, the Explore grid, the Shorts tab, and the Shorts shelf do not appear. Hiding happens on your device, in your browser view, the same way a Safari content blocker works. Decafly does not change what the platform sends, does not automate anything on your behalf, does not bypass a login, and does not disguise which browser you are using.

The rules are data, not code: a JSON file with paths and selectors, checked against a fixed schema the app understands. Decafly never downloads JavaScript and never builds a script out of downloaded text. The only script that runs inside your logged-in session is one small file bundled inside the app, and it is published unchanged at https://decafly.com/ios/clean/, with its SHA-256 checksum, so anyone can read exactly what runs.

That bundled script:

• applies the hide rules, and sends a tapped link to its cleaned destination;
• never reads document.cookie, never reads a text field, a form, or anything you type;
• never makes a network request of its own — it has no fetch, no XMLHttpRequest, no beacon, no image ping;
• reports exactly four kinds of message back to the app, and nothing else: the current page path, a one-word ready signal, up to eight tap-timing measurements (four numbers each, used to find slowness), and one rule-count message per page (two numbers: how many rules the browser engine kept, and how many still match something). No element, no text, no URL, and no identifier is attached to any of them.

Your Instagram or YouTube password and session go only to Instagram or YouTube. Decafly has no account of its own and nothing to sign into, and no code in it reads a cookie. Cookies the sites create are held by iOS in the app's own website data store, inside the app's sandbox on your device. Clear browsing data in the Clean settings removes that site's cookies and caches; deleting the app removes everything.

3. What is stored on your device

All of it stays on your iPhone, in the app's own storage:

• Your settings: the Screen Time tokens for the apps you chose, your limits (opens per day, minutes per open, wait length), your schedules, which platform a blocked app is linked to, your theme, and the per-item switches for the clean version.
• An event log: what happened and when — a block screen shown, a wait started or cancelled, an open ended, the lock changed. Each line carries a slot, not an app name, and never any page content.
• A diagnostics channel: technical lines used to explain a failure. Each entry has only a timestamp, which part of the app wrote it, what kind of event it was, a slot, a number of seconds, and a short system error name. No tokens, no app names, no URLs.
• The clean-version rule file and the website data (cookies, caches) of the sites you open in it.
• The PIN lock record, if you set one (section 6).

Deleting Decafly deletes all of it. None of it is copied to a server, so there is no copy anywhere else to delete. The only thing Decafly's server holds is feedback you sent yourself (section 5).

4. What ever leaves your device

Three things:

• The web pages you open in the clean version. These are ordinary requests from your iPhone to Instagram or YouTube, made by the system browser engine, with the session you signed into. Decafly adds nothing to them and receives nothing from them.
• Anything you deliberately send. Feedback you send from the app, the layout report, the event log, and the feedback email, all in section 5.
• The record of Decafly Pro. Decafly Pro is an optional subscription bought with Apple's In-App Purchase. To know whether you have it, the app uses RevenueCat, a subscription service that keeps the record of the purchase. When the app opens, and when you buy or restore Pro, the RevenueCat library inside the app talks to RevenueCat's servers over HTTPS, even if you never buy anything. It sends a random ID it creates for this installation (not linked to your name, email or Apple Account), the App Store purchase records for Decafly (what was bought, when, and whether it renews), the identifier iOS gives Decafly's developer on this iPhone (the "identifier for vendor", not the advertising identifier), and technical details: the app version, the iOS version, the iPhone model, your language and your App Store country. It sends nothing from Screen Time, no app names or tokens, no settings, no event log and nothing from the clean version. The library runs only in the main app, never in the block screen or the other Screen Time extensions. Once per installation it also sends an Apple Ads attribution token that iOS gives the app; RevenueCat hands it to Apple, and Apple answers only whether Decafly was installed from an Apple Ads ad in the App Store and, if so, which campaign, ad group and keyword. This is Apple's standard attribution: it needs no tracking permission, uses no advertising identifier, and tells Decafly nothing about other apps or websites. It lets us see which App Store ads lead to a Decafly Pro purchase. RevenueCat processes this only to provide the subscription to Decafly and these purchase reports; see its own privacy policy at https://www.revenuecat.com/privacy. Payment itself is handled by Apple; Decafly never sees your card or your Apple Account. To have your purchase record at RevenueCat deleted, write to feedback@decafly.com.

One more automatic request is planned but is not in this version: an update check for the clean-version rule file, a plain HTTPS GET of a signed, encrypted rule file on decafly.com. It will carry no account identifier, no device identifier, no advertising identifier, and no usage data — only the standard HTTP ETag so the server can answer "not modified". Until it ships, the app uses only the rule file bundled inside it. If anything about that changes, this policy changes first.

Apart from the feedback you send yourself (section 5), there is no other network code in the app: no analytics endpoint, no crash upload, no remote configuration, no ad request, no telemetry of any kind.

5. Diagnostics, the event log, and feedback

When the clean version hides too much or too little, you can send a layout report from its menu. It captures the shape of the page — tag names, roles, link paths on the same site, whether something is already hidden, and the outline of any bar pinned to the screen — plus the rule version. It never captures text, images, what you type, or class values, and an account or channel name inside a path is replaced with a placeholder before you ever see the report. A page that is a conversation is refused outright: on a messages page, and on any page with a live message region, no report is produced at all. Decafly does not send the report; it hands it to the iOS share sheet and you choose where it goes.

The event log can be exported the same way, as JSON through the share sheet.

Feedback you send from the app. Decafly offers a short feedback form in three places: right after you turn blocking off in the app, once as a card on Today that you can dismiss, a day or more after you first open the app, and in Settings, "Send feedback". Nothing is sent unless you tap Send. When you do, the app sends over HTTPS to Decafly's own server (https://decafly.com/api/feedback, run on Cloudflare): where the form was opened, the reasons you tapped, the text you wrote, if any (up to 1,000 characters), the app version, that the phone is an iPhone and which iOS version it runs, the iPhone model code (such as iPhone16,1), the app's language, and whether you use Decafly free, on a trial, with Pro or with Lifetime. It sends no account, no install ID, no RevenueCat ID, no event log, no app names or Screen Time tokens, no "Why I block" line, no web address, and nothing from the clean version. The server stores those fields in a database and posts each message, through a Telegram bot, to a private Telegram group that only the developer reads. Cloudflare sees your IP address, as it does for any website, and uses it only to limit how often one address can send; it is not stored. Cloudflare (which runs the server and the database) and Telegram (which delivers the message to the developer) handle it on Decafly's behalf; no one else receives it. See https://www.cloudflare.com/privacypolicy/ and https://telegram.org/privacy. Write only what you are happy for the developer to read. The database deletes each message automatically 12 months after it arrives; the copy in the developer's Telegram group stays until the developer deletes it, and is deleted on request (section 11).

The feedback email. If the form cannot reach the server, it offers "Email it instead", and "Report a problem with this page" in the clean version's menu always uses email. Either one prepares an email to the address at the bottom of this page in the system mail sheet, or in your default mail app. Decafly does not send it — it writes a draft and stops, and you send it. The draft contains a space for your message and a removable diagnostic block: app and build version, iOS version, device model, theme, clean-version rule version, and — only when you report a page — which site. Attaching your event log is off by default; when you turn it on, the app shows you the exact lines before the mail sheet opens.

The system review prompt, if it appears, is Apple's own and sends nothing from the app.

6. The PIN lock

If you set a PIN, Decafly stores it in the iOS Keychain as a salted hash — a random 16-byte salt plus a PBKDF2-HMAC-SHA256 digest at 20,000 rounds — and does the same for your recovery code. The PIN itself and the recovery code itself are not stored anywhere, which is also why there is no way to look up a recovery code you have already seen. The record is marked as available only on this device after first unlock, so it is not included in backups and does not sync.

Two deliberate exceptions, both stated in the app at the moment you choose them: the optional PIN hint is stored as you typed it, because you have to be able to read it, so anyone holding your phone can read it too; and the recovery code is shown once and can be copied only through the iOS share sheet — Decafly never sends it anywhere.

The lock's Activity list holds a time and a type of change (lock turned on, PIN changed, wrong PIN entered, and so on). It contains no app names, no tokens, and no digits of your PIN.

7. Notifications and Live Activities

Decafly's notifications are local: they are scheduled by the app on your device. There is no push service, no device token, and no server that could send you anything. They are used only for an open in progress — a wait that has started, a wait that is ready, a session about to end — for telling you when blocking has stopped working, and, only if you ask for it right after starting a Decafly Pro free trial, one reminder the day before the trial is charged. iOS cannot let the app check the subscription when that reminder appears, so it says what happens if the trial is still on; the app withdraws it as soon as it learns the trial was cancelled. The Live Activity that appears during a wait is also updated locally, never by push.

8. Camera, microphone, and photos

Decafly asks for the camera, the microphone, or your photo library only at the moment a web page in the clean version asks for it — posting a picture, recording audio, a call. Decafly never answers for you: it passes the request to iOS, which asks you. The app itself contains no camera, recorder, or photo-picker code at all. It does not ask for location, contacts, Bluetooth, local network, or tracking permission, and it does not use the App Tracking Transparency framework, because there is nothing to track.

9. What Decafly does not do

Decafly has no user accounts and no sign-in of its own, no analytics SDK, no advertising, no advertising identifier, and no crash-reporting SDK. Its own server receives only feedback you choose to send (section 5). The one third-party library that sends anything is RevenueCat, only for the Decafly Pro record in section 4. Decafly does not sell your data. Feedback you send reaches only the developer, through Cloudflare and Telegram (section 5); nothing else is shared.

10. Children

Decafly is not directed at children under 13 (or the applicable minimum age in your country). It does not knowingly collect data from children, and it has no age-gated feature or data. Decafly manages only the device it is installed on; it is not a parental-control product and cannot be used to supervise another person's device.

11. Changes to this policy, and contact

If this policy changes, the "Last updated" date at the top will change, and any change that adds a new kind of data collection will appear here before it ships. Questions or requests: feedback@decafly.com. Feedback sent from the app carries nothing that identifies you, so to have it deleted, tell us roughly when you sent it and what it said.