OffCoin · Last updated: 3 August 2026
OffCoin rewards you for time spent away from your phone. This policy explains exactly what we store, why, and how to get rid of it. It is written to be read, not to be skimmed past.
The data controller is DEEPREST Sp. z o.o. (NIP 8133955245), ul. Stanisława Moniuszki 11, 35-015 Rzeszów, Poland.
Contact for any privacy matter: contact@offcoin.app.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address from Sign in with Apple. If you use Apple's Hide My Email, we only ever see the relay address. | To identify your account and let you sign back in. | Art. 6(1)(b) — performance of a contract |
| Display name you choose. | Shown to other people in shared rooms, duels and teams. | Art. 6(1)(b) |
| Session records: start and end time, planned and actual duration, and the short intent text you type (for example "Deep work"). | To calculate rewards, your streak and your Focus Level. | Art. 6(1)(b) |
| $OFF balance, transaction history, rewards and challenge results. | To keep your balance correct across devices and reinstalls. | Art. 6(1)(b) |
Your time zone offset (a number of minutes, e.g. +120). |
Rewards count only between 06:00 and midnight your local time. Without this we could not tell when your day starts. | Art. 6(1)(b) |
| Rate-limit counters (how many times an action was called in a minute). | To stop abuse and protect the reward pool. Deleted after ten minutes. | Art. 6(1)(f) — legitimate interest |
| Crash reports: the error itself, the app version and which screen it happened on. Sent only when the app breaks. | To find and fix faults we would otherwise never hear about. Deliberately stripped of personal data — no email, no name, no IP address, and never the text you type into a session. | Art. 6(1)(f) — legitimate interest |
No location. No contacts. No photos. No microphone or camera. No health or fitness data. No advertising identifier (IDFA). No browsing history. No list of apps installed on your device.
Importantly: we do not know what you do on your phone. OffCoin detects only whether the screen is locked, using an operating-system signal. It cannot see which apps you open, what you type or what you look at. That information never exists in the app, so it can never leave your device.
Our database and authentication run on Supabase (Supabase, Inc.), acting as our processor, in the AWS eu-west-1 (Ireland) region — inside the European Economic Area. Your data does not leave the EEA.
Sign in with Apple is handled by Apple Inc. under Apple's own privacy terms. Crash reports are handled by Functional Software, Inc. (Sentry) on its EU infrastructure, and are stripped of personal data before they are sent.
For as long as your account exists. Delete the account and it goes with it — see below. Rate-limit counters are removed automatically after ten minutes. Settled room records are removed after seven days; what remains is an aggregate count of how many people finished, which points to no individual.
Open Profile → Delete account. This is permanent and immediate. It erases your profile, session history, transactions, rewards and vouchers, and your unspent $OFF balance. Any stake locked in a room, duel or challenge is released first so that other players are not left waiting.
You do not need to email us, and we will not ask you why.
Under the GDPR you may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to contact@offcoin.app and we will answer within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
OffCoin is not intended for anyone under 16. We do not knowingly create accounts for children. If you believe a child has an account, write to contact@offcoin.app and we will remove it.
If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always reflects the current version.