Privacy Policy

Last updated: April 16, 2026

Your Privacy Matters

Detour is designed with privacy as a core principle. We believe your personal data should stay personal. This policy explains what data Detour handles, what permissions the app requires and why, how the optional Accountability Connections feature works, and your rights under applicable privacy laws.

Data Collection

Detour does not collect, transmit, or share any personal data. All information — including your challenge history, streak data, learning progress, and app preferences — is stored exclusively on your device.

Users who never enable the Accountability Connections feature generate zero network activity. The app functions entirely offline by default.

What Detour Does NOT Do

For clarity, Detour does not:

Collect, store, or transmit personal information of any kind
Record, log, or report which apps you use, how often, or for how long
Monitor, read, or access content within any app (messages, emails, passwords, etc.)
Share any data with advertisers, data brokers, or analytics services
Use advertising identifiers, device fingerprinting, or tracking pixels
Send your data to any server (unless you explicitly enable Accountability Connections)
Access your contacts, photos, camera, microphone, location, or files
Run in any invisible or hidden mode — a visible notification is always shown when monitoring is active

App Usage Monitoring (Prominent Disclosure)

This section serves as the prominent in-app disclosure required by Google Play.

Detour monitors which app is currently in the foreground on your device. This monitoring is used solely to determine whether you have opened one of your self-selected restricted apps, so that a learning challenge can be presented. Detour does not record, store, or transmit your app usage history. The foreground app check happens entirely on-device, in real time, and the result is discarded immediately after the check.

Detour uses Android's UsageStatsManager API to detect when you open a restricted app. The foreground app name is checked in real time and is never stored, logged, or transmitted. A foreground service runs with a visible notification to perform this check. When you open a restricted app, a full-screen challenge activity is displayed. After the challenge is completed or dismissed, only the challenge result (type, difficulty, correct/incorrect, response time) is stored locally for your personal statistics.

Permissions Explained

Detour requests only the permissions necessary for its core functionality. Each permission, why it is needed, and what data it accesses is explained below.

Permissions

Permission	Purpose
Usage Access (PACKAGE_USAGE_STATS)	Detects when you open one of your self-selected restricted apps. Used solely for real-time foreground app detection. No usage history is stored or transmitted.
Display Over Apps (SYSTEM_ALERT_WINDOW)	Allows Detour to present the challenge screen from a background service when a restricted app is opened. The challenge is shown as a full-screen activity. No content is drawn over other apps.
Foreground Service	Runs a persistent background service (with a visible notification) to monitor which app is in the foreground. This is required on Android to perform real-time app detection.
Boot Completed	Restarts the monitoring service after device reboot so that challenges continue to appear without requiring you to reopen Detour.
Notifications	Displays a persistent notification while monitoring is active, and a daily reminder if enabled. Required on Android 13+.
Battery Optimization Exemption	Requests exemption from battery optimization to prevent the operating system from killing the monitoring service. You can revoke this at any time in system settings.
Vibrate	Provides haptic feedback during challenges (success, error, and button taps). Can be disabled in Detour's settings.
Internet	Used only for (1) the optional Accountability Connections feature and (2) subscription verification via Google Play Billing. No data is sent over the network unless you enable Connections or purchase a subscription.

Detour does not request access to your contacts, phone, SMS, camera, microphone, location, files, or any other sensitive device data.

Firebase & Authentication (Connections Only)

The optional Accountability Connections feature uses Firebase Anonymous Authentication and Cloud Firestore. When you enable Connections:

An anonymous identifier is created — no email, no password, no personal information
Only aggregate progress stats are stored in Firestore (see "Data Shared via Connections" below)
If you never use Connections, no Firebase services are activated and no data leaves your device

Data Shared via Connections

When using Accountability Connections, the following aggregate statistics are shared with your connected partners:

Current streak and longest streak (consecutive active days)
Weekly challenge count and accuracy percentage
Total challenges completed
Daily challenge counts and accuracy (last 7 days)
Challenge type breakdown (attempts and accuracy per type)
Time-of-day activity distribution
Number of active days, average response time
Number of restricted apps and their display names
Per-app challenge attempts and accuracy
Recent activity log (last 10 entries: timestamp, challenge type, app name, result, response time)
A user-chosen nickname (up to 20 characters)
Last update timestamp

The following are never shared: app package identifiers, app usage duration or frequency, specific challenge answers, personal information, device identifiers, location data, or any data beyond the aggregate statistics listed above.

Data Storage & Retention

All data is stored locally using Room (SQLite) and DataStore on your device. This data never leaves your device.

You can export a visual PDF report of your statistics from the Insights tab at any time. You can delete all data using the Reset function in Settings. On-device data persists until you choose to delete it or uninstall the app. Firestore data (Connections only) is deleted when you remove a connection or delete your account.

Security

On-device data is stored in private app storage, protected by the operating system
Firestore data is protected by security rules that restrict access to authenticated connection participants only
Anonymous authentication means no passwords, no email addresses, and no personal identifiers are ever created or stored
All network communication uses TLS 1.3 encryption
Release builds are signed with a dedicated release certificate and protected by code obfuscation (R8/ProGuard)

Third-Party Services

Detour integrates the following third-party services:

Firebase (Anonymous Auth and Cloud Firestore) — used solely for the optional Accountability Connections feature. No data is sent to Firebase unless you explicitly enable Connections. See Firebase Privacy Information.
RevenueCat — manages optional Detour+ subscriptions. RevenueCat communicates with Google Play to verify subscription status. It receives only an anonymous app user ID and subscription state. See RevenueCat's Privacy Policy.

No analytics, advertising, crash reporting, or telemetry services are integrated. Detour does not use Google Analytics, Firebase Analytics, Facebook SDK, Crashlytics, or any similar service.

Cookies & Tracking

The Detour app does not use cookies, web beacons, tracking pixels, or advertising identifiers. No analytics SDKs or crash reporting services are integrated. This website does not use cookies or tracking of any kind.

Children's Privacy (COPPA)

Detour is not directed at children under the age of 13. No personal information is collected from anyone, regardless of age. The app does not contain advertising or in-app purchases directed at children.

GDPR Compliance (EU/EEA Users)

For users in the European Economic Area, Detour complies with the General Data Protection Regulation:

Lawful basis: Legitimate interest (providing the service) and consent (opt-in to Connections)
Data minimization: Detour collects no personal data by default. The optional Connections feature shares only anonymous aggregate statistics, the minimum necessary for the feature to function
Right of access: You may request a copy of any data associated with your anonymous identifier
Right to rectification: You may correct inaccurate data via the app's settings
Right to erasure: You can delete all on-device data from Settings. Firestore data is removed when you disconnect or delete your account
Right to data portability: You can export a PDF report of your statistics from the Insights tab at any time
Right to restriction: You may disable Connections at any time to stop data syncing
Right to object: You may object to processing by disabling Connections or uninstalling the app
Data retention: On-device data persists until you delete it. Firestore data is deleted when you remove a connection or delete your account
Cross-border transfers: No personal data is transferred across borders. Only anonymous statistical summaries are synced via Firestore (hosted in Google Cloud)
Data Protection Officer: Not required, as Detour does not process personal data at scale

To exercise any of these rights, contact us at xaesionai@gmail.com.

CCPA Compliance (California Users)

For users in California, Detour complies with the California Consumer Privacy Act:

Right to know: You may request details about what data is collected. Detour collects no personal information; Connections share only anonymous aggregate stats
Right to delete: You can delete all on-device data from Settings. Firestore data is removed when you disconnect or delete your account
Right to opt-out of sale: Detour does not sell, rent, or share personal information with third parties for monetary or other valuable consideration
Right to non-discrimination: You will not receive different service quality or pricing based on exercising your privacy rights

Data Breach Notification

In the unlikely event of a breach affecting Firestore data, users will be notified via an app update and a notice on this website within 72 hours of discovery, in accordance with applicable data breach notification laws (including GDPR Article 33 and 34).

Changes to This Policy

If we make changes to this privacy policy, we will update it on this page and within the app, noting the date of the last revision. Material changes will be communicated through an app update notice. We encourage you to review this page periodically.

Data Controller

Detour is operated by an independent developer. For the purposes of GDPR and other applicable data protection laws, the data controller is:

Aras Atakligan
Oslo, Norway
xaesionai@gmail.com

Contact

If you have questions about this privacy policy, please contact us at xaesionai@gmail.com.