Privacy Policy

The short version: Benji is a paid Android app that runs locally. Your routines, journal entries, sparks balance, and the apps you’ve chosen to block all live in a database on your phone. There’s no account, no email, no password. The only thing that leaves your device is anonymous usage events — an install-scoped anonymous identifier, used for analytics only, wiped when you uninstall. No personal data attached. See Section 1 for the honest details.

1. What we collect (and what we don’t)

Benji uses PostHog to count how features are being used and catch bugs. The setup is deliberately minimal:

• Anonymous install identifier. PostHog stores a random, anonymous id on the device so events from the same install can join (onboarding through overnight wakes). It is analytics only. It is not your name, email, advertising ID, or Android ID. Uninstalling the app wipes it.
• No identification.We never call PostHog’sidentify()or set person properties. There is no person record in PostHog tied to you.
• No IP-based location. GeoIP enrichment is disabled. Your IP address is not stored alongside events.

The events Benji sends to PostHog are limited to:

• Feature flags — that something happened: completing onboarding, an alarm firing, the blocker intercepting an app, a routine step being checked off, the journal being completed.
• Counts — number of apps in your block list, number of routine steps, total sparks earned or spent in a session, number of journal tags selected.
• Bucketed values— your bedtime and wake-up time grouped into broad ranges (e.g. “before 22:00 / 22:00–24:00 / after 00:00”), routine duration as short / medium / long, sleep-baseline self-rating as poor / okay / good.
• Predefined enums— your sleep goal from the fixed onboarding list, predefined library task IDs (any custom task you create is reported only as “custom”), permission-grant booleans.

We use this data to find bugs, see which features are useful, and decide what to build next. We do not sell it, share it with advertisers, or use it for cross-app tracking. PostHog’s privacy policy is at posthog.com/privacy.

We do not send to PostHog: your name, email address, phone number, contacts, photos, location, biometrics, advertising identifiers, browsing history, device fingerprint, IP address, the precise time you set as your bedtime or wake-up, the package names of any apps you’ve added to your block list, the names of any apps the blocker intercepts, the names of any custom routine steps, the text content of your journal entries, the specific mood or dream tags you select, or your sleep-baseline numeric rating. Benji has no crash-reporting service installed.

2. What stays on your device

• The name you give Benji during onboarding (used for the bear’s greetings).
• The free-text body of your journal entries — only your selected mood/dream tags ever leave the device, never the words you wrote.
• Your bedtime and wake-up time.
• Your routines and custom routine steps.
• Which apps you’ve chosen to block.
• Your sparks balance, transaction history, and streak count.
• Android usage-stats data the blocker reads to detect when a blocked app opens. The detection happens entirely on-device. We send PostHog a singleblocked_app_detectedevent when an interception occurs, with no app name or package name attached.

This data lives in a local SQLite database (benji.db) and Android SharedPreferences. It is removed when you uninstall the app.

3. Permissions Benji asks for (Android)

• Notifications (POST_NOTIFICATIONS) — to ring your alarms and show the foreground-service indicator while the blocker is running.
• Schedule exact alarm (SCHEDULE_EXACT_ALARM, USE_EXACT_ALARM) — so alarms fire at the time you set, not when the OS feels like it.
• Full-screen intent — so the alarm screen can take over the display when an alarm rings.
• Wake lock + boot completed — to keep alarms playing if the device sleeps and reschedule them after a phone restart.
• Usage access (PACKAGE_USAGE_STATS, granted in Settings) — to detect when a blocked app is opened. Benji never reads the contents of those apps; only that one of your blocked apps came to the foreground.
• Display over other apps (SYSTEM_ALERT_WINDOW, granted in Settings) — to show the blocker overlay on top of a blocked app.
• Foreground service — Android requires a visible notification while the blocker watcher is running.
• Battery exemption (optional) — to keep alarms and the blocker reliable on aggressive OEM battery savers (Samsung, Xiaomi, OnePlus, Huawei).

When Benji ships on iOS, this section will be updated with the equivalent iOS authorizations (Notifications and Apple’s Family Controls / Screen Time framework).

4. Third parties

• PostHog — analytics, as described in Section 1. PostHog processes the anonymous events on its US infrastructure. Events carry an install-scoped anonymous identifier (wiped on uninstall) and no name, email, or person profile. There is no account-level record tied to you.
• Google Play (and, when Benji ships on iOS, the Apple App Store) — handles your subscription purchase, billing, and refund flow per their own policies. Benji does not see your card or billing details.

We do not use ad networks, fingerprinting SDKs, attribution services, push-marketing platforms, or remote crash-reporting services.

5. Children’s privacy

Benji is intended for users 13 and older. We do not knowingly collect data from children under 13. If you’re a parent or guardian and your child under 13 has installed Benji, uninstall the app to remove every local trace, including the install-scoped analytics id. After uninstall we cannot target that device for deletion because the id is gone with the app. If you have a question or concern, email kbantadevelopment@gmail.com.

6. Your rights

Benji doesn’t collect names, emails, or accounts. Analytics uses an anonymous install-scoped id (not a hardware or advertising ID) so events from the same install can join. Uninstalling the app wipes that id along with the local SQLite database and Android SharedPreferences. We do not call identify() or build a person profile. There is therefore no named record on our side that maps to you as an individual to download, correct, or delete.

If you live in a jurisdiction with specific data-protection rights (GDPR, UK GDPR, CCPA/CPRA, Quebec Law 25, LGPD, etc.) and you still have a question or a request, email kbantadevelopment@gmail.com and we’ll honor any rights granted by your local law.

7. Changes to this policy

If this policy changes in a way that affects what we collect or how it’s processed, we’ll notify you in the app before the change takes effect. The “Last updated” date at the top of this page tracks the most recent revision.

8. Contact

Privacy questions, deletion requests, or anything that smells off: email kbantadevelopment@gmail.com.

~ ✦ ~