Who is responsible
The controller is Vinicius Araujo da Silva, Rua José Augusto Coelho, 2925-542, Portugal (NIF 322607680). Contact for privacy and support: help@doitfirst.app. Apple, RevenueCat and the hosting provider process some data under their own terms, described below.
Missions and progress (on your device)
Mission names, goals, schedules, commitment settings, confirmations, timers, history, XP, levels, medals, companion choices and onboarding answers are stored locally on your iPhone, in the app and its Apple App Group container. We do not receive them. Device backups follow your Apple and iCloud settings.
Proof photos
When you confirm a mission with a photo, the photo is saved in the app’s local storage on your iPhone together with its time. Photos are not uploaded to us. Avoid photographing other people or sensitive documents. Deleting the app removes its local files; system backups can keep copies according to your settings.
Screen Time and app selection
Blocking uses Apple’s Screen Time API (FamilyControls, ManagedSettings and DeviceActivity) and needs your permission. Apple’s picker gives the app anonymous tokens for the apps and categories you choose. We cannot see which apps they are, read your messages or see what you do inside other apps.
Location, notifications and widgets (optional)
Focus places need location permission. The places you save (centre, radius and schedule) stay on your device and are used only to apply protection. When you search for an address on the map, the search text is sent to Apple Maps. Reminders are local notifications; widgets and Live Activities use data on your device.
Purchases
Apple processes payments; we never receive card details. RevenueCat manages subscription status using an anonymous identifier, the product and transaction details, so you can buy, restore and unlock Pro.
Subscription events we store
RevenueCat sends us authenticated subscription events. We store only the event identifier and type, store and environment, product and entitlement identifiers, event and expiry times and a pseudonymous purchase reference. We do not store your name, email, missions, photos or location. These records are kept for 365 days and then deleted.
Website
This website has no advertising, no tracking cookies, no analytics and no contact forms. The hosting provider keeps short-lived technical logs (such as IP address and request time) to run and protect the service.
Why we process data (legal bases)
To provide the app and subscriptions you ask for (performance of a contract, GDPR art. 6(1)(b)); to keep the service secure and fix problems (legitimate interests, art. 6(1)(f)); and to meet legal obligations such as accounting rules (art. 6(1)(c)). Optional permissions such as location and notifications can be turned off at any time in iOS Settings.
Service providers and transfers
Apple (distribution, payments, Maps), RevenueCat (subscription status, United States) and Railway (hosting of the website and subscription-event database). Where data leaves the European Economic Area we rely on the EU-US Data Privacy Framework when the provider is certified, or on the European Commission’s Standard Contractual Clauses.
How long we keep data
Data on your device: until you delete it or the app. Subscription events: 365 days. Hosting logs: as briefly as the provider allows, usually up to 30 days. Purchase records that Apple or RevenueCat must keep follow their own legal duties.
Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, objection and portability, and withdraw consent at any time. Write to help@doitfirst.app; we answer within one month. You can also complain to a supervisory authority: in Portugal, the CNPD (www.cnpd.pt); in Brazil, the ANPD; or the authority where you live.
Security
Subscription events arrive over HTTPS with authentication, are limited to the fields above and are written with protections against duplicates. No system is perfectly secure, and we review these measures as the service evolves.
Children and changes
Do It First is intended for people aged 16 and over. It is not a parental-control or child-monitoring product. If we change this policy we will update the date above and, for important changes, tell you in the app before they apply.