Privacy Policy
Last updated: 15 November 2026
CapyUnlock is an app that locks chosen apps on a phone until the user passes a short quiz. This policy explains what data the CapyUnlock app, website and Telegram bot collect, why, and what you can do about it. In short: we collect only what is needed to run the app, we don't show ads, and we never sell data.
Who is responsible
CapyUnlock is run by ITPM GROUP IT Tanácsadó és Fejlesztési Kereskedelmi Kft. (the “controller” under the GDPR):
- Registered office: 2131 Göd, Termál fürdő körút 4. fsz. 9., Hungary
- Company registration number: 13-09-177477
- Tax number: 25390652-2-13
- Email: hello@capyunlock.app or info@itpmgroup.com
What we collect and why
| Data | Why | Kept |
|---|---|---|
| Waiting list: email, the phone you're waiting for (iPhone or Android), language, whether you'd use it for yourself or your family, and your country (worked out from your connection; your IP address is not stored) | To tell you when CapyUnlock is available for your phone, possibly invite you to try it early, and decide which platform and markets to launch first | Until you unsubscribe, or 12 months after launch |
| Account via Telegram: your Telegram user ID, chat ID and first name; a salted hash of your PIN (never the PIN itself) | To create your account, link phones and send you reports and alerts | While your account exists |
| Linked phone: a name you give the phone's user (first name only), device model, app version | To show you which phone a report is about | While the phone is linked |
| Content you add: question sets, questions, photos and voice messages you send to the bot | To show these questions in the quiz | Until you delete them or your account |
| Quiz results: which question was answered, the answer given, right or wrong, time; lock and unlock events | Progress reports, and asking already-mastered questions less often | While your account exists |
| Settings and status: time limits and quiz rules, whether the needed permissions are on and the lock is running (your list of locked apps stays on the phone) | To apply your settings and warn you if the lock stops working | While your account exists |
| Diagnostic logs: app events (e.g. “lock shown”, “service restarted”) and the package names of apps opened (e.g. com.example.game). No screen content, no typed text | To find and fix bugs | 7 days on the phone, 14 days on our server |
We do not collect your contacts, location, photos (other than those you send to the bot), call or message content, or advertising IDs.
Android permissions
- Accessibility service: used only to detect which app is in front, so the quiz can appear when a locked app is opened. CapyUnlock is configured so it cannot read what is on the screen, and it does not see what you type.
- Usage access: a backup way to see which app is in front and to count screen time. Processed on the phone.
- Display over other apps: to show the quiz on top of a locked app.
- Device admin (only when you turn on PIN protection): to stop the app being force-stopped or uninstalled without the PIN.
- Notifications, start at boot, ignore battery optimisation: so the lock keeps working after a restart.
iPhone
On iPhone, CapyUnlock uses Apple's Screen Time framework. Apple does not tell CapyUnlock which apps you chose or how long you use them – the app only learns when your time limit is reached. This data stays on your iPhone.
Legal basis
- Running the app and your account: performance of our agreement with you (GDPR Art. 6(1)(b)).
- Diagnostic logs and security: our legitimate interest in a working, safe app (Art. 6(1)(f)).
- Waiting-list e-mails: your consent (Art. 6(1)(a)), which you can withdraw at any time.
Using CapyUnlock on someone else's phone
If you set up CapyUnlock on a family member's phone, for example a child's, you must be their parent or legal guardian or have their permission. The only personal detail we store about the phone's user is the first name you enter. Questions and answers on that phone are visible to you in your account. We don't knowingly let children create accounts themselves.
Where data is stored and who processes it
- Railway – our server and database, hosted in the EU (West Europe).
- Cloudflare – this website and the waiting list.
- Telegram – when you use the CapyUnlock bot, messages pass through Telegram under its own privacy policy.
These providers process data only on our behalf. Where data leaves the EU, it is protected by the European Commission's standard contractual clauses.
No ads, no selling, no tracking
CapyUnlock shows no ads and contains no advertising or analytics trackers. We never sell or rent personal data.
Your rights
You can ask to see, correct, export or delete your data, object to processing, or withdraw consent. Email hello@capyunlock.app and we'll reply within 30 days. Deleting your account deletes your questions, linked phones, results and logs. You can also complain to your data protection authority – in Hungary, the National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).
Security
Data travels over encrypted connections (HTTPS). Phones authenticate with a secret key stored only as a hash on our server, and PINs are stored only as salted hashes.
Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app or by email.