GOOGLE PLAY DATA SAFETY FORM — ANSWERS

SECTION 1: DATA COLLECTION AND SECURITY

Question: Does your app collect or share any of the required user data types?
Answer: YES

Question: Is all of the user data collected by your app encrypted in transit?
Answer: YES

Question: Do you provide a way for users to request that their data is deleted?
Answer: YES
(Users can email supportmindlock@gmail.com to request full account and data deletion)

SECTION 2: DATA TYPES COLLECTED

For each category below, select exactly as shown:

PERSONAL INFO

Email address

• Collected: YES
• Shared with third parties: YES (Supabase for authentication, Razorpay for payment)
• Purpose: App functionality, Account management
• Optional or required: Required (for account creation; app works without account)
• Ephemeral (not stored beyond session): NO

FINANCIAL INFO

Purchase history

• Collected: YES
• Shared: YES (Razorpay processes payment; we receive confirmation token only)
• Purpose: Subscription management
• Optional: Required for paid plans only

Payment info (card/bank details)

• Collected: NO
• Note: Razorpay handles all payment data. We never see card numbers, CVV, or bank credentials.

APP ACTIVITY

App interactions

• Collected: YES
• Shared: NO
• Purpose: App functionality (tracking which apps user opens to enforce blocking)
• Optional: NO (core feature requires this)
• Ephemeral: NO (stored locally and summary synced to cloud)

In-app search history

• Collected: NO

Installed apps

• Collected: NO (we read which app is in foreground, not the full installed app list)

Other user-generated content

• Collected: YES (intent statements typed by user when opening apps)
• Shared: NO
• Purpose: App functionality (showing user their own stated purposes)
• Ephemeral: NO (stored locally only)

APP INFO AND PERFORMANCE

Crash logs

• Collected: NO (we do not currently collect crash analytics)

Diagnostics

• Collected: NO

Other app performance data

• Collected: NO

DEVICE OR OTHER IDs

Device or other IDs

• Collected: YES (device model and timezone, collected at account creation)
• Shared: YES (stored in Supabase)
• Purpose: Analytics, App functionality
• Ephemeral: NO

SECTION 3: DATA SHARING

Question: Does your app share user data with third parties?
Answer: YES

Third parties you share data with:

1. Supabase — Email address, device model, usage summaries, brain health scores
   Purpose: Cloud database and user authentication
   Privacy policy: https://supabase.com/privacy
2. Razorpay — Email address, subscription confirmation
   Purpose: Payment processing
   Privacy policy: https://razorpay.com/privacy

Question: Is the data shared for a purpose that is not stated in the Privacy Policy or not required for the app to work?
Answer: NO

SECTION 4: SECURITY PRACTICES

Question: Does your app use security measures?
Answer: YES

Measures used:

• Data is encrypted in transit (TLS 1.2+)
• You can request that data is deleted

SECTION 5: SPECIAL DATA HANDLING

Question: Does your app collect data from children?
Answer: NO (age requirement is 13+)

Question: Does your app include ads?
Answer: NO

SECTION 6: DATA SAFETY SUMMARY (shown to users on Play Store)

This is the public-facing summary. Fill it exactly like this in the form:

Data collected:

• Email address (required for account)
• Device ID and model (for account management)
• Purchase history (for subscription management)
• App interactions (for app blocking features)

Data not collected:

• Location data
• Audio/video data
• Contacts or call logs
• Messages or emails
• Browsing history
• Health and fitness data
• Financial payment details

Data shared:

• Email → Supabase (authentication), Razorpay (subscription)

Security:

• Data is encrypted in transit
• You can request deletion

Commitment: MindLock does not sell your personal data. Accessibility service data never leaves your device.

NOTES FOR GOOGLE PLAY REVIEW TEAM

Regarding Accessibility Service

MindLock uses Accessibility Service for the following specific purposes:

1. Detecting which app the user opens (TYPE_WINDOW_STATE_CHANGED events only) to enforce user-configured app blocks
2. Detecting scroll events within social media apps (TYPE_VIEW_SCROLLED) to implement the Doom Scroll Guard feature, which interrupts continuous short-video scrolling after a user-configured time threshold
3. Detecting private/incognito browser windows via window class name (not content) to enforce the user's content filter settings

The accessibility service with canRetrieveWindowContent=false is used for all blocking features. A separate, optional service with canRetrieveWindowContent=false is used only for incognito mode detection via class name.

No accessibility event data is transmitted outside the user's device. No screen content, passwords, messages, or personal communications are read.

Regarding VPN Permission

MindLock's Content Filter feature uses Android's VPN Service to create a local DNS filter that blocks requests to adult content domains. This VPN:

• Runs entirely on the device
• Does not connect to any external VPN server
• Does not route internet traffic through any external server
• Does not anonymize the user or hide their IP address
• Routes DNS to Cloudflare Family DNS (1.1.1.3) for adult content filtering
• Is completely optional and user-controlled

Regarding REQUEST_INSTALL_PACKAGES

MindLock distributes updates directly to users. The REQUEST_INSTALL_PACKAGES permission is used to install app update APKs that the user has explicitly chosen to download from within the app, after being shown version information and release notes. Users can decline the update at any time.