At Spool, we believe your privacy is fundamental. This Privacy Policy explains how we collect, use, and protect your information when you use our app and services.
Last Updated: October 12, 2026
This policy covers Spool on iOS and Android. Apple-specific tracking and refund information applies to iOS; Android-specific information is described below.
1. Information We Collect
Information You Provide
Account Information: Information you provide when creating or using an account, such as your name and email address, or your phone number if you choose phone sign-in. Downloading the app alone does not supply us with your email address or phone number
App Usage Data: Screen time metrics and app usage patterns to help you reduce screen time
Settings & Preferences: Your app settings, notifications preferences, and goals
Automatically Collected Information
Device Information: Device type, operating system, and app version
Usage Analytics: How you interact with Spool to improve our services
Purchase and Refund Information: Subscription and transaction identifiers, purchase and access status, consent records, and relevant feature-use or support information used for purchase management and refund assessment (see Section 5)
Performance Data: Crash reports and performance metrics to ensure app reliability
Advertising & Device Identifiers
If you grant permission through Apple's App Tracking Transparency prompt (see Section 3), we also collect:
Device Identifier (IDFA): Your device's Identifier for Advertisers, used to measure and attribute app installs and in-app events
Product Interaction Events: Actions such as installs, key in-app interactions, and purchases, used to measure and optimize our advertising
Consistent with our Apple App Privacy disclosures, Device ID and Product Interaction data may be linked to your identity and used to track you across apps and websites owned by other companies. See Section 3 for details and how to opt out.
Spool on Android
Account and reflections: We use Firebase to store your account, questionnaire answers and app activity, such as completed onboarding, walk-away events, focus activities, rewards and streaks. Reasons you submit, recent reflection context and the requested app's display name may be sent to Spool's online analysis service, which uses OpenAI, to evaluate a request or generate insights. Confirmed reflections, requested minutes, timestamps and generated insights can be saved to your account. Online processing can also leave service logs; see data retention.
Onboarding chat analytics: We use PostHog to understand and improve onboarding. During the chat, Spool sends events when you start, complete a section, skip or finish, including selected preset responses, time spent in chat sections, app and device technical information, and an anonymous installation identifier. This chat reporting does not include your entered name, account identifier, typed reflections or microphone audio. Android session replay and automatic screen and tap recording are disabled. Skipping the chat sends a skip event; it does not opt you out of analytics. This reporting is separate from account, reflection and subscription processing.
App blocking and Usage Access: With your permission, Spool uses Android Accessibility events and Usage Access to identify the foreground app, apply your blocking rules and measure time used. Spool can display a blocking screen and return you to the Home screen when you leave a blocked-app request. The installed-app list, selected package identifiers and raw usage events are processed on your device, rather than uploaded as an inventory or usage log. The requested app's display name can be included in a saved reflection. The Accessibility service does not read screen text or passwords, capture screenshots or record what you type.
Voice input: If you choose voice, Android's selected speech-recognition provider receives microphone audio and may process it on remote servers under that provider's privacy policy. Spool receives the transcript and does not save an audio recording itself. Text you submit is processed as a reflection. You can use typed input instead.
Camera and exercise: Mirror displays a local camera preview; exercise features analyze camera images on your device using Google ML Kit. Spool does not upload those images or pose coordinates. Earned minutes and completion records may be saved to your account. ML Kit also collects installation identifiers and technical information, such as device, app, performance and error data, to operate and improve its services.
Friends: If you use friend features, the email address you search for, friend requests and relationships are processed through Firebase. Adding or accepting friends lets those friends access permitted profile and reflection history, including reason text and app names. Spool does not read your device's address book.
Focus Web: Websites opened inside Spool receive browsing requests and information you enter or choose to upload. Spool applies supported filters and navigation controls inside this browser. Site sign-in, cookies and user-approved camera, microphone or file sharing are subject to the site's own privacy practices. Local camera processing described above does not apply to media you choose to share with a website.
Subscriptions and support: Google Play and RevenueCat process subscription and transaction information, with your Spool account identifier used to connect access to your account. External support services receive the messages and information you submit to them. Their privacy policies also apply.
You can disable Spool's Accessibility service and Usage Access in Android Settings, and revoke microphone or camera permissions through Android's app permissions. Features that require those permissions will no longer work until you enable them again.
2. How We Use Your Information
We use your information to:
Provide personalized screen time insights and recommendations
Help you track and achieve your digital wellness goals
Send you important updates about Spool (you can opt out anytime)
Improve our app's features and performance
Measure, attribute, and optimize our advertising campaigns (with your permission — see Section 3)
Ensure the security and proper functioning of our services
3. Tracking & Advertising
App Tracking Transparency (ATT)
The first time it is relevant, Spool presents Apple's App Tracking Transparency (ATT) prompt asking for your permission to track. We only access your device advertising identifier (IDFA) and share data for cross-app advertising measurement if you grant this permission. If you decline, we do not access the IDFA or use it for advertising attribution.
Cross-App & Cross-Website Tracking for Ad Measurement
When you grant permission, we use the IDFA together with mobile measurement and advertising partners to understand which ads led to app installs and which product interactions and purchases followed. To do this, product-interaction and purchase events are shared with our advertising partners for advertising measurement and optimization. This activity may involve tracking you across apps and websites owned by other companies, as reflected in our Apple App Privacy label.
How to Opt Out
At the prompt: Select "Ask App Not to Track" when the ATT prompt appears.
Anytime in Settings: Go to iOS Settings → Privacy & Security → Tracking and turn off tracking for Spool (or disable "Allow Apps to Request to Track" for all apps).
Effect: When tracking is off, Spool does not access your IDFA or share advertising identifiers for cross-app measurement. Core app features continue to work.
You can also limit Meta's use of advertising data through your Meta ad settings.
4. Third-Party Service Providers
We work with trusted third parties who process data on our behalf to operate, secure, and improve Spool and to measure our advertising. These providers are permitted to use your information only to perform services for us. We encourage you to review their privacy policies:
AppsFlyer — mobile measurement and attribution (device identifiers, install and in-app events). Privacy Policy
Meta (Facebook) — advertising attribution and optimization (product-interaction and purchase events). Privacy Policy
Providers vary by platform and feature. Android voice input uses the speech-recognition provider selected on your device; websites and external support services have their own privacy practices.
5. Information Sharing
We do not sell or rent your personal information. We share information only in these limited circumstances:
Service Providers: Trusted partners who help us operate, secure, analyze, and advertise Spool (see Section 4), under agreements that limit their use of your data.
Advertising Measurement: With your permission, we share advertising identifiers and product-interaction and purchase events with our measurement and advertising partners to attribute and optimize campaigns (see Section 3).
With Your Consent: When you explicitly agree to sharing.
Legal Requirements: When required by law or to protect our users' safety.
Business Transfers: In the unlikely event of a merger or acquisition.
Refund requests and sharing with Apple
When Apple assesses an App Store refund request, Spool may provide relevant purchase and app-use information, directly or through its subscription service provider, and a recommendation. This may include purchase and subscription identifiers, purchase dates and access status, whether content or features were delivered or used, and relevant setup, usage, or reported-failure information. Apple makes the final refund decision under its policies and applicable law.
Any required affirmative consent for refund-data sharing is separate from acceptance of these Terms or this Privacy Policy. Signing up, paying, using the app, or requesting a refund does not by itself establish that consent. Accepting Terms, configuring blocking, or briefly using a feature does not automatically remove refund eligibility.
To withdraw refund-data-sharing consent, email team@thespoolapp.com. Withdrawal concerns future sharing; it does not itself cancel a subscription, delete an account, or reverse information already sent. Email requests require support handling; sending an email is not confirmation that processing is complete.
6. Your Privacy Rights
You have the right to:
Access: Request a copy of your personal information
Update: Correct any inaccurate information
Delete: Request deletion of your account and data
Opt-out of Tracking: Decline or withdraw tracking permission at any time via the ATT prompt or iOS Settings (see Section 3)
Opt-out of Marketing: Unsubscribe from marketing communications
Delete your Spool account and data
In Spool for Android, open Settings → Danger Zone → Delete Account and follow the prompts to verify ownership and confirm deletion. You can also request deletion without installing or signing in to the app: email team@thespoolapp.com with the subject Delete my Spool account. Include the email address or phone number linked to your account so support can verify ownership. Never send your password or a verification code.
If you cannot use the email button, send the request directly from any email service to the address above. The request does not require access to the app or a Spool sign-in. Support may ask you to verify ownership before removing account data.
Your request covers your Spool account and associated profile, questionnaire answers, reflection and walk-away history, insights, friend relationships and friend requests. Additional cleanup and separately held subscription, purchase, refund, consent or support records may require manual processing or retention as explained in Section 7. Contact support for the status of your request and information about any remaining records; sending a request does not mean processing is complete.
We retain information only as long as necessary for its purpose and applicable legal obligations. Deletion has different steps for different records:
Core account data: We keep account data while your account is active. Successful in-app deletion removes your Firebase authentication account and selected account data. On Android this includes your profile and questionnaire answers, saved reflections, walk-away history, insights, friend relationships and friend requests. The app also attempts to clear the account's saved questionnaire and pending reflections from that device; it reports a cleanup error if local removal fails. Additional data outside this flow can require manual cleanup.
Deletion-request records: A cleanup request containing your account identifier, email address, display name, request time and processing status can remain after account deletion so outstanding cleanup can be handled. These records have no configured automatic expiry and remain until separately removed; a fixed manual retention period has not been established in this policy.
Separately held billing and privacy records: Subscription, purchase, refund and consent records support billing, refund assessment and the record of your privacy choices. Spool's separate subscription-analytics and refund records have no configured automatic expiry. They require separate review and removal; we have not established a fixed retention period here. Deleting the Firebase account does not automatically remove records from RevenueCat, Apple or Google Play. The stores may keep transaction records under their own legal and accounting requirements.
Service and security logs: Our current Google Cloud service-log retention is 30 days; required audit logs are retained for 400 days. These logs support troubleshooting, security and auditing and may include information from online requests. Account deletion does not immediately erase these separate logs.
Firestore version history: The current database retains prior versions for one hour. Extended point-in-time recovery and scheduled Firestore backups are not enabled. This version-history period does not set a deletion deadline for live records or copies held by other services.
OpenAI processing: OpenAI's published API data controls describe abuse-monitoring logs, potentially including submitted content, retained by default for up to 30 days, with longer retention possible for legal or safety reasons. We do not promise zero retention or that deleting your Spool account erases those logs.
PostHog analytics and support: Analytics events and support messages require separate handling. PostHog's event-retention rules depend on the service plan and are not an automatic deletion tool. The project's replay retention setting is 30 days; Android session replay is disabled, and that setting does not describe Android onboarding-event retention. We have not confirmed a single fixed period here for analytics events, support messages, or all provider-held copies.
Contact team@thespoolapp.com for the status of your request, which records remain, why they are retained and any applicable retention period. We have not committed to a fixed email-request completion deadline in this policy. Support must confirm processing; sending a request or deleting an account does not immediately remove every provider copy. Account deletion does not cancel an App Store or Google Play subscription.
8. Children's Privacy
Spool is not intended for children under 13. We do not knowingly collect personal information from children under 13, and we do not knowingly track or use the advertising identifier of anyone we know to be under 13. If we discover we have collected such information, we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy occasionally. We will provide notice of material changes as required by applicable law. The revision date identifies this version; it does not establish that earlier customers accepted new wording or gave any required data-sharing consent.
Contact Us
If you have any questions about this Privacy Policy or your personal information, please contact us:
