BlokPrivacy Policy
Last updated 14 October 2026
Blok locks your child's phone, and that's it. We only collect what the lock needs to work, and never what your child does on the phone.
Who we are
Blok is developed and run by the app's developer, who is the data controller under the GDPR. Contact: eliastestdev@gmail.com.
What Blok does
A parent uses Blok on their own iPhone to lock and unlock their child's iPhone. The lock is enforced by Apple's Screen Time technology on the child's phone.
What we process and why
| Data | Why | Kept |
|---|---|---|
| Parent sign-in identifier (Sign in with Apple; the email is only an Apple relay address if you chose to hide it) | To know which parent may control which phone | Until you delete the account |
| The child's phone: a name you choose, iPhone model, iOS version, pairing time, last sync and whether Screen Time is approved | To show the phone in your app and send the lock to the right phone | Until you remove the phone or delete the account |
| Lock settings (locked/unlocked, timer, schedules, time zone), the phone's actual state and the number of apps set to lock | To enforce and show the lock | Until you remove the phone or delete the account |
| Parent PIN recovery code | So you can get back in if you forget the PIN. Only the parent can read it. | Until you remove the phone or delete the account |
| The child's phone push token and notification setting | To tell the phone the lock has changed | Until you remove the phone |
| Subscription status | To know whether the subscription is active | As long as the subscription exists |
What we never collect
Which apps are on the child's phone or which apps you chose to lock (that choice stays on the child's phone; only the number is reported), what the child does on the phone, location, messages, contacts or any other content. The app contains no analytics or advertising tools.
Processors
- Google Firebase (sign-in, database, server functions, push). Data is stored in the EU: the database in Europe (eur3), the server functions in Belgium (europe-west1).
- RevenueCat (subscription status, an anonymous user id only).
- Apple (Sign in with Apple, push and purchases).
They process the data only on our instructions and under their data-processing terms.
Legal basis and children
We process the data to perform the contract with the parent (Art. 6(1)(b) GDPR). Data from the child's phone is processed on the parent's instruction as the holder of parental responsibility. The child never creates an account and is never asked for personal data; the phone is identified by an anonymous technical id.
Security
All traffic is encrypted. The child phone's credential is stored in the iOS Keychain. Each phone can only read its own records, and every change goes through server functions.
Your rights
You have the right to access, rectification, erasure, restriction, portability and to object. Deleting your account in the app, or emailing us, removes all the data above within 30 days. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Email usChanges
If we change this policy, we update this page and the date at the top.