Privacy policy

• Dwindle is made by Boundary Labs Inc., a Canadian company.
• This policy covers the Dwindle app, on Android and iPhone, and this site, dwindle.app.
• Anything you want to ask or change goes through the support page.

• The decision to flip an app to gray runs entirely on your phone.
• The apps you chose, your grace periods, your session history and your insights live in the phone’s own storage.
• On Android, the app reads which app is in front of you through Android’s usage-access permission.
• On iPhone, Dwindle learns which of your chosen apps opened or closed from the Shortcuts automations you add, on the phone.
• Nothing about your usage leaves the phone.
• There is no sync. If one is ever offered, it will be off until you turn it on.

• Nothing you do in the app is tied to a name, an email or a login.
• On Android, once your trial has started, the app sends our site, once, a scrambled, one-way identifier of your phone, so a reinstall does not restart the trial.
• We keep it for as long as it serves to stop a second trial on the same phone.
• We never join it to an account, an advertising identifier or anything about your use.
• It names the phone, not you.
• The iPhone app sends no such identifier.
• Nothing identifies you to us unless you make an account, on this site or by signing in in the app.

• An account exists for one reason: buying a plan and reading it back on your phone.
• You can sign in here, in the Android app or in the iPhone app. It is the same account either way.
• We keep what signing in needs: your email address, the identity your provider gives us (Google or Apple) or the code we emailed you, and when you signed in.
• Supabase hosts accounts for us, in the United States.
• We use your address to sign you in and to answer you, not for a marketing list.
• If you delete the account from an app, the app sends that one request to this site, which does the deleting. It carries your sign-in and nothing else.

• Vercel hosts dwindle.app and keeps ordinary server logs (your IP address, your browser, the pages requested) for a short time to run the site.
• The site sets the cookies signing in needs, and remembers your Plain/Evidence and Light/Dark choices in your own browser.
• Vercel Web Analytics counts visits and a few clicks, and Speed Insights measures how fast pages load, without cookies and without an identity.
• Google Analytics counts page views: the page’s address, the address that sent you to it and the page’s title. The addresses carry no query string, except the campaign tags an ad or a link adds (utm_ tags and Google’s click ids).
• The site sends one event of its own: opening the “Get Dwindle” dialog, with which button opened it and which store it opened on. Google adds a few of its own, such as the start of a visit.
• Google also receives what any web request carries: your IP address and your browser.
• Google keeps the detailed data for 2 months; its reports keep only totals.
• Google Analytics uses two cookies, _ga and _ga_<ID>, for up to 13 months. Google Ads may add its own, whose names begin _gcl_, under the same rule.
• In the European Economic Area, the United Kingdom and Switzerland, none of Google’s cookies is set until you choose Accept on the site’s banner. Until then, or if you choose Decline, Google receives measurements without cookies.
• Your answer is kept in one cookie of ours, dwindle_consent, for 180 days. “Cookie choices” at the foot of every page changes it, and Decline after Accept removes Google’s cookies.
• Elsewhere, Google’s cookies are set when a page loads. Your browser’s settings can block them.
• To know whether to ask, the site asks its own server for the country Vercel estimates from your IP address, and asks you whenever it gets none. Nothing is stored.
• We use Google Analytics with Google Ads: to see which of our ads bring visitors, and to show our ads to people who have visited this site.
• Google’s own ad settings (adssettings.google.com) control the ads Google shows you, including whether they are personalized.
• Dwindle never collects what you do on your phone.

If you write to us through the support page:

• The form sends the address you give, the topic, the subject and the message to our support channel on Discord, with the ticket id it shows you.
• The page loads a Cloudflare Turnstile challenge with the form. When you send it, the challenge reads your browser’s signals to tell a person from a script.
• It asks something of you only when it cannot tell, and it sets no cookie of ours.

Only the companies named here, each for its own part and under its own privacy commitments, which meet or exceed this policy:

• Supabase: accounts, and Android’s trial records.
• Resend: delivers the sign-in code email.
• Stripe: payments on this site.
• RevenueCat: purchase records for Android and this site.
• Google and Apple: store purchases and sign-in.
• Google: Google Analytics and Google Ads, for this site’s page views, the download dialog’s opening and our ads.
• Vercel: hosting, visit counts and page speed.
• Discord: the support conversations, which stay in our Discord until we delete them. A request through the support page deletes yours.
• Cloudflare: the challenge on the support form.

We do not sell personal data, and no one buys it from us.

• Exporting everything Dwindle has stored on your phone, or deleting all of it, is always free and always available, and we cannot hold it back.
• Deleting keeps what you bought and when your trial or plan ends, so deleting never starts a trial over.
• To delete your account and the records that go with it: Delete account in the Android app or the iPhone app (Settings, then Account), or Delete your data at the bottom of your account page on this site.
• The account, its sign-in identities and its row are deleted at once.
• The payment records at Stripe or the stores, and the purchase ledger’s rows, are no longer tied to your account and stay as tax and payment law keeps them.
• A plan bought on this site is canceled first, in Manage billing on your account page.
• If you can no longer sign in, write to us through the support page giving the address the account was made with. We reply to that address to confirm the request is yours, and delete the account within 30 days of your reply.

• Dwindle is not directed at children under 13.
• We do not knowingly collect personal data from them.

• You can ask what we hold about you, have it corrected, or have it deleted, through the support page.
• Canadian privacy law applies.
• If we do not resolve a concern, the Office of the Privacy Commissioner of Canada can hear it.
• When this policy changes, the new version appears here with its date.

Effective October 25, 2026.