Privacy policy

Dwindle is made by Boundary Labs Inc., a Canadian company. This policy covers the Dwindle app and this site, dwindle.app. Anything you want to ask or change goes through the support page.

The decision to drain an app’s color runs entirely on your device. The apps you chose, your grace periods, your session history and your insights live in the phone’s own storage. To do its job the app reads which app is in front of you (Android’s usage-access permission), and that reading never leaves the phone. Nothing about your usage is uploaded: there is no sync today, and if one is ever offered it will be off until you turn it on.

Nothing you do in the app is tied to a name, an email or a login, and nothing identifies you to us unless you make an account on this site; the next point says what that account is for.

An account exists for one reason: buying Plus on this site and reading it back on your phone. When you sign in we keep what signing in needs: your email address, the identity your provider gives us (Google or Apple) or the code we emailed you, and when you signed in. Accounts are hosted for us by Supabase, in the United States. We use your address to sign you in and to answer you, not for a marketing list.

dwindle.app is hosted on Vercel, which keeps ordinary server logs (your IP address, your browser, the pages requested) for a short time to run the site. The site sets only the cookies signing in needs, and remembers your Plain/Evidence and Light/Dark choices in your own browser. There is no advertising SDK, no analytics that profiles you, and no tracking pixel.

If you write to us through the support page, the form sends the address you give, the topic, the subject and the message to our support channel on Discord, with the ticket id it shows you. The page loads a Cloudflare Turnstile challenge with the form, and when you send it reads your browser’s signals to tell a person from a script; it asks something of you only when it cannot tell, and it sets no cookie of ours.

Only the companies named on this page, each for its own part and each under its own privacy commitments, which meet or exceed this policy: Supabase (accounts), Stripe (web payments), RevenueCat (purchase records), Google and Apple (store purchases and sign-in), Vercel (hosting), Discord (the support conversations, which stay in our Discord until we delete them; a request through the support page deletes yours), and Cloudflare (the challenge on the support form). We do not sell personal data, and no one buys it from us.

Exporting everything Dwindle has stored on your phone, or deleting all of it, is always free and always available, not a paid feature, and not something we can hold back.

To delete your data (your account and the records that go with it), use Delete your data at the bottom of your account page: the account, its sign-in identities and its row go at once, and the payment records at Stripe or the stores and the purchase ledger’s rows, no longer tied to your account, stay as tax and payment law keeps them. A plan bought on the site is cancelled first in Manage billing on the same page. If you can no longer sign in, write to us through the support page giving the address the account was made with; we reply to that address to confirm the request is yours, and do the same within 30 days of your reply.

Dwindle is not directed at children under 13, and we do not knowingly collect personal data from them.

You can ask what we hold about you, have it corrected, or have it deleted, through the support page. Canadian privacy law applies; if we do not resolve a concern, the Office of the Privacy Commissioner of Canada can hear it.

When this policy changes, the new version appears here with its date. Effective September 17, 2026.