Healthy Stuff First Get notified

Privacy policy

Healthy Stuff First is a screen time app, which necessarily means that it tracks you, to an extent. However, your data is not our business.

Last updated: 13 October 2026

1. Who is responsible

The controller within the meaning of Art. 4 (7) GDPR is:

Alexander Knemeyer
Feldhoopstücken 39b
22529 Hamburg
Germany
alknemeyer@hey.com

Write to the address above with anything to do with your data.

2. What this policy covers

  • the Healthy Stuff First app for Android and iOS,
  • the Healthy Stuff First extension for Firefox and Chrome,
  • this website, healthy-stuff-first.alknemeyer.xyz.

3. What stays on your device

By default the app is offline software. Your habits, the apps and sites you block, how many minutes each habit earns, and how much time you have used today are written to a single file in the app's own private storage. Nothing in that file is sent anywhere unless you sign in (section 4).

To enforce a block, the app needs to know which app is in front of you. On Android that is the accessibility service you grant permission to; it reads the package name of the app currently on screen, compares it against your own blocked list, and forgets it. On iOS the blocking is done by Apple's Screen Time framework, which hands the app opaque tokens rather than app names, so it never learns what you picked. In neither case does that information leave the device, and in neither case is any of it sent to me.

On Android you can also grant Usage access, which is optional. With it, the list you pick blocked apps from is sorted by how long you spend in each app on an average day, and shows that number. It is read from the phone when you open that list and used only to sort it: it is not stored, not synced, and never leaves the device.

The app reads no contacts, no location, no photos, no messages, no browsing history, and no content of any kind from the apps it blocks.

4. If you create an account

Accounts exist for one reason: to let a phone and a browser draw from the same daily budget. It is entirely optional and the app works fully without one. If you make one, the following is stored on the server:

  • your email address, used to sign in and to reset your password,
  • your password, stored only as a salted hash,
  • your habits, how many minutes each earns, and which ones you have completed today,
  • the apps and websites you have chosen to block,
  • how many seconds you have spent on them today, per device, so the devices can subtract each other's usage,
  • a device name and a random device identifier generated by the app.

Legal basis: Art. 6 (1) (b) GDPR, because this processing is what performing the sync service you asked for consists of. The data is used for nothing else. It is never sold, never shared with advertisers, and never used to build a profile.

The server is a PocketBase instance I run myself at api.healthy-stuff-first.alknemeyer.xyz, hosted in Germany. All traffic to it is encrypted with TLS. There is no transfer of this data to a country outside the EU or the EEA.

5. The browser extension

The extension blocks websites on the same earned budget as the app. It stores the list of sites you chose to block, the number of seconds you have spent on those sites today, and a session token in your browser's extension storage. It does not record browsing history, page contents, keystrokes, searches or form data, on blocked sites or anywhere else. Without an account it syncs nothing.

6. This website

This site sets no cookies, runs no analytics, and contains no tracking pixels, share buttons or embedded videos. There is nothing here to consent to, which is why you were not asked. You're welcome!

These pages are served by DeployBase (deploybase.eu), a static host running on European infrastructure, out of Scaleway's Paris datacenter. Per DeployBase's own privacy policy, it logs visitors' IP addresses for up to 30 days, which is what makes delivering the page and fending off attacks possible. Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in a working and reasonably secure website.

The two typefaces on this site are loaded from api.fonts.coollabs.io and cdn.fonts.coollabs.io, a font hosting service run by coolLabs that sets no cookies. Your browser does make a request to it, which necessarily discloses your IP address. Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in consistent typography. If you would rather this did not happen, a content blocker will stop it and the site will fall back to a system font.

7. Email

If you write to me, I process your address and whatever you put in the message in order to answer it. Legal basis: Art. 6 (1) (b) GDPR where your message is about the service, otherwise Art. 6 (1) (f) GDPR, my legitimate interest in answering people who contact me. Email reaches me through my mail provider's servers, which are outside the EU, as is the case with most email. Correspondence is kept for as long as I use this email account; write to me if you would like a specific message deleted sooner.

8. How long any of it is kept

  • On-device data lives until you delete it in the app or uninstall the app, which removes it with everything else the app stored.
  • Account data lives until you delete your account. Daily usage figures are day-scoped and are overwritten as the days pass.
  • To delete your account and everything the server holds for it, use Settings → Account → Delete account in the app. It takes effect immediately. Without the app, email alknemeyer@hey.com from the address the account uses; I do that by hand, so allow a few days. More on deleting your account.

9. Your rights

Under the GDPR you have the right to:

  • access the data held about you (Art. 15),
  • have inaccurate data corrected (Art. 16),
  • have your data erased (Art. 17),
  • have processing restricted (Art. 18),
  • receive your data in a portable format (Art. 20),
  • object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21).

Do that by sending an email. You also have the right to complain to a supervisory authority. The one responsible for me is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7. OG
20459 Hamburg
datenschutz-hamburg.de

You may also complain to the supervisory authority where you live or work, if that is somewhere else in the EU.

10. Automated decisions and children

There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR. The app is not directed at children under 16, and I do not knowingly collect data from them.

11. Changes

If the app starts doing something this page does not describe, this page changes first. The date at the top says when it last did.