Legal
Privacy Policy
Last updated: July 21, 2026
This Privacy Policy explains how Impulse handles your information across both of its products: the Impulse app for iOS and the Impulse browser extension (the “widget”, for Chrome). Impulse helps you control your screen time by blocking distracting apps and websites and adding impulse-control friction.
Impulse is local-first: the core blocking and screen-time features run entirely on your device and don’t require an account. Some features do communicate with a small, fixed set of external services — and this policy explains exactly what data leaves your device, where it goes, and why.
Impulse (“Impulse”, “we”, “us”) is the data controller for the processing described here. Throughout this policy we use App for practices specific to the iOS app and for practices specific to the browser extension; unlabelled items apply to both.
Contents
- 1. Data stored on your device
- 2. Analytics (Mixpanel)
- 3. Optional account & sync (Supabase)
- 4. Supervisor / protector emails
- 5. Physical (NFC) unlock
- 6. QR code generation
- 7. Our website (install / uninstall)
- 8. Browser permissions
- 9. What we do NOT collect
- 10. Third-party processors
- 11. Legal basis
- 12. Data retention
- 13. Your rights & choices
- 14. Security
- 15. Children’s privacy
- 16. Changes to this policy
- 17. Contact & open source
1. Data stored on your device
Most of what you do with Impulse is stored only on your device and is used solely to enforce the rules you configure, show your statistics, and remember your settings.
App On iOS
The app uses Apple’s official FamilyControls, DeviceActivity and ManagedSettings frameworks with individual authorization. The apps and websites you choose to restrict are stored as opaque, system-managed tokens that are not readable by us and never transmitted to any server — not even the names of the apps you block leave your device. Your schedules, limits, preferences, app-lock PIN, streaks and Screen Time report are stored locally (SwiftData, AsyncStorage and the system keychain) and are deleted when you uninstall the app.
In the browser
The extension stores your data with Chrome’s chrome.storage.local (and chrome.storage.sync for the optional password lock). This includes:
- Blocking rules: the sites/URLs you block, schedules, difficulty levels (Easy, Medium, Hard, Physical) and rule names.
- Impulse controls & limits: per-site open/time/scroll limits and impulse-countdown settings.
- Screen-time data: time spent per site and visit/open counts, tracked locally to power the statistics views and heatmaps.
- Preferences: Quick Focus settings, theme and locale.
- Password protection (optional): a salted SHA-256 hash of your password (never the plaintext).
- Verified protector emails, physical-card bindings and emergency-escape state are kept locally for the features described below.
- A random installation ID used to group analytics events (see below).
2. Analytics (Mixpanel, EU)
Both products send product-usage analytics to Mixpanel, hosted in the European Union (api-eu.mixpanel.com), to understand which features are used and improve Impulse. Events are anonymous or pseudonymous and are tied to a random installation ID, not to your name.
- Event names describing interactions (onboarding steps, creating a rule, activating Quick Focus, reaching a limit, completing/failing an unlock challenge, viewing stats, joining a squad).
- A random installation ID (a UUID generated on your device), not by itself tied to your name or email.
- Standard technical properties: app/extension version, a generic browser/OS label and timestamps.
- Aggregate profile counts such as number of controls/blocking periods/squads, whether you are signed in, locale and theme.
Analytics never include the content of your blocks or which apps you use. Some extension events include a Domain / Site property with the address of a site where the extension acted (for example when a limit is reached or a warning is shown); in a small number of events this may include the page path, not only the domain. Some events also include names you chose (a control’s or squad’s name). When you sign in or register, the event includes only the domain part of your email (e.g. gmail.com), not your full email. Analytics are governed by Mixpanel’s privacy policy.
3. Optional account & sync (Supabase, EU)
Accounts, authentication, sync and shared groups are handled by Supabase, hosted in the European Union (eu-central-1). None of this data leaves your device unless you choose to use these features.
App On first launch an anonymous identifier is generated to save your progress. You are only asked to create a permanent account (email + password) if you choose to create or join a group or challenge.
The extension offers an optional account so you can sync across devices and back up your statistics. Sign-in uses your email address plus a one-time code (OTP) emailed by Supabase (you can set a password afterwards).
When you use these features, we process, on Supabase:
- Account & authentication: email, encrypted password, optional display name, plan, and a user/device identifier to sync your progress.
- Rule & settings sync: your blocking periods and impulse controls, including the site URLs/hostnames you configured and the rule names you gave them.
- Daily statistics backup: once a day the extension uploads the previous day’s aggregated per-site stats — for both configured and other visited (“uncontrolled”) sites: hostname, time spent, visit counts, blocks triggered, challenges completed/failed, session durations and hourly breakdowns.
- Groups / squads: nickname and group role, streaks and compliance status, a verification status (✅/⚠️), the group rules you create (app/site names you type manually) and a timestamped violation log to compute streaks and rankings. We never share your list of blocked apps — only your verification status.
4. Supervisor / protector emails & verification
For “Hard” difficulty and Supervision mode, Impulse can involve a supervisor / accountability partner (“protector”) identified by an email address. Before an email can be saved as a protector, its owner must prove control of the inbox by entering a code we send them.
- Verification and unlock codes are handled by a serverless Supabase Edge Function (
supervisor-code). The server generates the code, stores only a hashed version, emails it, and enforces limits (code expires in ~5 minutes, max 3 attempts, single-use). The extension never receives the code — it only forwards what you type back. - App The app uses EmailJS to send the verification code to the supervisor email you configure.
- Emergency escape (72h): Hard rules include a single-use emergency unlock that takes effect after 72 hours (it degrades the rule to Easy). When you request it, we email a heads-up to the configured protector(s); this sends the protector’s email address to our backend.
If you only use “Easy” or “Medium” difficulty and don’t use Supervision, no email data is sent by this feature.
5. Physical (NFC) unlock
The “Physical” difficulty lets you require tapping a physical NFC card/tag to unlock a rule. This requires an account.
- App The NFC card is paired and scanned using the iOS app, which performs the live NFC read on your phone.
- The browser extension does not read NFC hardware and requests no NFC permission. It only checks your account status, lists your linked cards (returning the card labels you set and a masked form of your email) and requests/verifies a short unlock code generated when the card is scanned on your phone. This is handled by a Supabase Edge Function (
physical-unlock); which card unlocks which rule is stored only locally and is not synced.
If you never use “Physical” difficulty, none of this is sent.
6. QR code generation
When you open the “get the mobile app” screen, the extension renders a QR code by loading an image from api.qrserver.com, passing only the public App Store link as the data to encode. No personal or browsing data is sent — only that static, public URL (plus the IP/user-agent metadata inherent to any image request).
7. Our website (install / uninstall)
The extension opens a page on impulsecontrolapp.com in two situations: an onboarding page on install, and an uninstall page (via chrome.runtime.setUninstallURL) that may offer a feedback survey. As with any website visit, this exposes your IP address and user-agent to our web server; no blocking rules, statistics or account data are attached to these navigations.
Any request to an external service inherently exposes your device’s IP address and browser user-agent to that service, as with any normal web request.
8. Browser permissions
The extension declares the following Chrome permissions:
| Permission | Why it is needed |
|---|---|
| storage | Persist your rules, limits, statistics and preferences locally (and the password hash in sync storage). |
| tabs | See which site is active in order to apply blocking rules, track screen time and run Quick Focus. |
| webNavigation | Detect navigation events so rules can be evaluated as you move between pages. |
| alarms | Schedule timed tasks: reset daily counters, check schedules and pauses, run Quick Focus timers, refresh data. |
| windows | Track the focused window so screen time is measured only for the window you are using. |
| tabGroups | Read/update Chrome tab groups used by the focus/organization features. |
| notifications | Show system notifications (e.g. when a Quick Focus session finishes). |
| idle | Detect when your device is idle or locked so idle time is not counted as active screen time. |
| <all_urls> (host) | Inject blocking/warning overlays and evaluate your rules on sites you configure. The content script runs on pages but only acts on sites that match your rules. |
<all_urls> is broad, the extension uses it only to check whether a page matches your rules and to display overlays. It does not read page content for other purposes, intercept forms, or access your passwords. The extension’s content security policy restricts outbound connections to exactly api-eu.mixpanel.com, *.supabase.co and api.qrserver.com. Impulse’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.9. What we do NOT collect
- We do not collect your location, contacts, photos or messages.
- We do not read page content, form inputs or passwords, and we do not log your general browsing history for advertising.
- App We do not log which apps you actually use; we only manage the ones you choose to restrict, and that selection stays on your device as opaque tokens.
- We do not sell your data or use it to build advertising profiles.
10. Third-party processors
| Provider | Role |
|---|---|
| Apple | App Screen Time frameworks and App Group. Data is handled on-device. |
| Supabase (EU, eu-central-1) | Accounts, authentication, sync, groups/squads, supervisor & physical-unlock functions. |
| Mixpanel (EU) | Anonymous / pseudonymous usage analytics. |
| EmailJS | App Sending supervisor verification emails. |
| api.qrserver.com | Rendering the “get the app” QR code from a public URL. |
These providers process data only to provide the features above. We do not sell your personal data.
11. Legal basis
Where applicable law (e.g. the EU/EEA GDPR) requires it, we process your data based on performance of a contract (delivering the service you request, such as groups and sync), your consent (analytics), and our legitimate interest in keeping Impulse secure and improving it. You can withdraw consent at any time.
12. Data retention
- Local data stays on your device until you delete it or uninstall the app/extension. Some local counters are pruned automatically after a rolling window (about 14 days for certain metrics).
- Account & sync data in Supabase is retained while your account exists. When you request deletion, we remove the server-side copy.
- Analytics sent to Mixpanel is retained according to Mixpanel’s policies and our account configuration.
- Verification codes are short-lived server-side (~5 minutes) and single-use.
You can request deletion of your account or of specific data at any time on our account & data deletion page.
13. Your rights & choices
Depending on where you live (e.g. the EU/EEA under GDPR), you may have the right to access, correct, export, delete or port your data, to object to or restrict certain processing, and to lodge a complaint with your data protection authority. You can:
- View your data — your rules, limits and statistics are visible in the app/extension interface.
- Export your data as a JSON file from Settings.
- Delete local data by uninstalling the app or extension.
- Delete account data or specific data via our deletion page.
- Contact us at hello@impulsecontrolapp.com to exercise any of these rights.
14. Security
- Encrypted transport: all external communication uses HTTPS/TLS.
- Local storage: your password, if set, is stored only as a salted SHA-256 hash, never in plaintext.
- Authenticated backend: account, sync, group, supervisor and physical-unlock requests are authenticated with your Supabase session and protected by Row-Level Security.
- Restricted connections: the extension’s content security policy limits outbound connections to the specific services listed here.
No method of transmission or storage is completely secure; we cannot guarantee absolute security.
15. Children’s privacy
Impulse is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
16. Changes to this policy
We may update this Privacy Policy to reflect changes in functionality or legal requirements. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, through the app or extension.
17. Contact & open source
Data controller: Impulse. For any privacy question or request, contact us at hello@impulsecontrolapp.com.
The extension’s source code is available for review on GitHub.