Privacy Policy

1. Who we are

Prove/n is an Android app that locks the apps you choose behind short STEM questions, together with the website prove-n.app. Prove/n is run by MangoTree Productions, based in British Columbia, Canada ("we" and "us"). We're responsible for the personal information described here.

This policy covers:

• the Prove/n app,
• the website prove-n.app, including its contact forms, and
• the Prove/n beta test: registration, check-ins, tester payments and the prize draw.

The parts about the beta test apply only to people who applied for it or took part in it. We'll remove them once we no longer hold any beta test information.

Other companies' services that Prove/n works with, such as Google Play and Discord, have their own privacy policies.

2. What stays on your phone

To lock apps, Prove/n has to know what you do on your phone. That information is kept only on your phone and is never sent to us:

• which apps you open, when, and for how long,
• your usage patterns: reopen loops, long stretches of passive scrolling, your usual usage, and the break warnings and nudges you've had,
• your focus hours and how each one went, and
• your education and occupation answers from setup.

The accessibility service

Prove/n's lock uses Android's accessibility service, which you turn on yourself. It sees which app is open and how long you use the apps you've chosen to guard. If you turn on habit nudges (off by default), it also notices when you switch screens or tap into a text box in a guarded app. It can't read what's on your screen or what you type. You can turn it off any time under Settings > Accessibility.

Your installed apps

Prove/n lists the apps on your phone so you can choose which ones to guard. The list isn't sent to us.

Android backup

If you've turned on Android's backup, Android can save your Prove/n settings to your Google account, such as which apps you guard and your education and occupation answers. Your app usage, your focus-hours data and your sign-in session are always left out of backups and phone-to-phone transfers.

Uninstalling Prove/n deletes everything it stored on your phone. It doesn't delete your account on our server; see Your choices and rights for that.

3. What we collect and why

Your account

When you sign up, we collect your name, email address and password. We store your password only as a salted one-way hash, so nobody, including us, can read it. We use these to create your account and sign you in.

If you forget your password, we email you a 6-digit code, which expires after 15 minutes. We also count failed sign-in attempts, so we can lock out someone guessing your password.

How you use Prove/n

• Your answers. They're graded on our server, by checking them against the stored answer, and are never sent to an AI. We keep which questions you've answered and whether you got them right, not the text you typed.
• Your progress: the minutes you've earned and when you earned them, your correct and wrong answers at each difficulty, and your current and best run of correct answers (Genius Brain).
• Your Deep Focus streak: just your current and best streak in days, and the date it was last updated. Nothing else about your focus hours.
• Your question settings: your subjects, level and difficulty.
• Question reports you send, with the reason you picked from a list.
• Your username, if you set one. Other Prove/n users see it on the leaderboards, next to your Genius Brain run or Deep Focus streak. If you don't set a username, you don't appear on the leaderboards.

We use this to choose your questions, award your minutes, keep your progress when you change phones, show the leaderboards and fix questions that are wrong.

Your notes (optional)

With "My notes", you can upload a PDF, paste text or take photos of your notes, and Prove/n writes questions from them.

• Photos are read on your phone by Google's ML Kit text recognition. The photos themselves are never uploaded; only the text read from them is sent to us.
• A PDF is uploaded to our file storage and deleted as soon as its text has been read.
• Before any AI sees the text, we remove email addresses, phone numbers, web links, labelled ID numbers and dates of birth, and names in headings such as "Name: …" or "Prof. …". Names in the body of your notes may not be removed, so please don't upload notes that contain other people's personal information.
• The cleaned text is then sent to OpenAI, which checks it for harmful content, reads it and writes questions from it. If an upload fails the content check, it's refused.
• We keep the cleaned text, an outline of it and the questions written from it until you delete that upload or your account. Your notes questions are only shown to you. They're never shown to other users or added to the shared questions.
• We count the pages you upload each month, to apply the monthly limit.

Your subscription

Google Play handles payment, so we never see your card or bank details. The app sends us the purchase token Google Play gives it, and we check it with Google to get your subscription's details: which plan, its status, when it renews and whether it auto-renews. We use these to unlock Prove/n for you.

Security and abuse prevention

Our server sees the IP address of every request. We use it to limit how many requests one address can make, which stops scripts and attacks. These counters are deleted after about 3 days. Our database provider, Supabase, keeps logs that include IP addresses for up to 7 days. We keep our server's logs, on Amazon Web Services (AWS), for 30 days.

The website

• Contact forms: your name, email address, the topic you pick and your message. Formspree stores them and emails them to us, and we use them to reply to you.
• Google Analytics runs on the home page, the review page and the tester page. It records which pages you visit, how you got there, your approximate location, your device and browser type, and clicks on buttons such as "Apply" or "Get the app". When you send a contact form, Analytics records only the topic you picked, never your name, email address or message. It uses cookies.
• The site loads its fonts from Google Fonts, and the review page loads its math display from jsDelivr. Like any server your browser loads files from, they receive your IP address.
• This privacy page has no analytics and sets no cookies.

The beta test

If you apply to test Prove/n, we collect:

• Your registration form (Google Forms): your name, your email address, the Gmail address you use on Google Play, your age, your grade or year of study, and your province. If you're under 18, also your parent's or guardian's name and email address, and the consent form they signed.
• Your Gmail address goes on Prove/n's tester list on Google Play, so the app can be installed on your phone.
• Your check-in answers (days 1, 7 and 14). On day 14 you also give your Prove/n sign-in email, which we use to check which days your account earned minutes.
• Payment details: the email address or phone number you want your Interac e-transfer sent to.
• If you win the prize draw: your answer to the skill-testing question and a shipping address. For a winner under 18, the address comes from their parent or guardian.
• Bug reports and messages you send through the contact form or the tester Discord.

We use these to run the test, check who's eligible, pay testers and run the prize draw.

4. What we don't do

• We don't sell or rent your personal information.
• We don't show ads. The app contains no advertising tools and no analytics of its own, and doesn't use your phone's advertising ID.
• We don't use your information to train AI models. OpenAI doesn't train its models on data sent through its API.
• We don't send marketing email. We only email you about your account, such as a password-reset code, or about the beta test if you're a tester.

5. Who we share it with

These companies run parts of Prove/n for us. Each one gets only what it needs for its job:

Supabase

Database and file storage: your account, progress, settings and notes. United States (Virginia)

Amazon Web Services (AWS)

Runs Prove/n's server; every request from the app passes through it. United States (Virginia)

OpenAI

The cleaned text of notes you upload, only if you use "My notes". United States

Resend

Your email address and your code, when you reset your password. United States

Google

Google Play handles subscription payments and the beta tester list. Google Analytics measures website visits. Google Forms and Google Drive hold beta registrations, check-ins and consent forms. ML Kit reads photos of notes on your phone, and sends Google performance and usage statistics about that feature, never your photos or their text. United States and other countries

Formspree

Messages you send through the website's contact forms. United States

Interac and our bank

The email address or phone number your $10 tester payment is sent to. Canada

Discord

Only if you join the tester Discord: what you post there. Discord's own privacy policy applies

Other Prove/n users see your username and streak on the leaderboards if you set a username, and nothing else about you.

We may also disclose information when the law requires it, such as a court order, or to protect someone's safety. If Prove/n is ever sold or merged, your information may move to the new owner, who must keep following this policy. We'll tell you before that happens.

6. Where your information is stored

Some of the companies above store information outside Canada, mainly in the United States. While it's there, the courts, law enforcement and national security authorities of that country may be able to access it under their laws.

7. How long we keep it

Your account, progress, settings, reports and subscription records

Until you delete your account. If you haven't used Prove/n for 12 months, we'll email you a reminder that your account still exists and how to delete it.

Your notes

Uploaded PDFs are deleted as soon as their text is read. The cleaned text, outline and questions are kept until you delete the upload or your account.

Password-reset codes

Expire after 15 minutes, and are deleted once used.

Sign-in sessions

End after 30 days without use.

Request counters with IP addresses

Deleted after about 3 days.

Logs that include IP addresses

Supabase's logs: up to 7 days. Our server's logs on AWS: 30 days.

Database backups

Information you delete can remain in Supabase's backups for up to 7 days, then it's gone.

Contact form messages

Up to 1 year.

Beta registrations, consent forms and check-ins

Deleted within 90 days after the test ends.

Tester payment records

Up to 6 years.

Google Analytics data

No more than 14 months.

Data on your phone

Until you uninstall Prove/n.

8. Teens and children

Prove/n is for people aged 13 and older. We don't knowingly collect information from children under 13. If we learn that we have, we delete it.

Beta testers under 18 need a parent or guardian's signed consent to take part. A parent or guardian can contact us at any time to see, correct or delete their teen's information.

If you set a username, it's shown on the leaderboards, so pick one that isn't your real name.

9. Your choices and rights

• Delete your account: in the app, go to Settings > Delete account and type your username or email to confirm. This permanently deletes your account and everything stored with it: your answers, progress, reports, notes and leaderboard spot. Any renewing Google Play subscription is cancelled first.
• Other deletions: if you can't open the app, or you want your beta registration or other information deleted, contact us.
• See or correct your information: ask us for a copy of the personal information we hold about you, or for a correction. We reply within 30 days.
• Change your mind: you can turn off the accessibility service, stop using "My notes", uninstall Prove/n, delete your account, or leave the beta test by opening the opt-in link again. Some features can't work without certain information; for example, you can't earn minutes without an account.
• Website analytics: you can block cookies in your browser, or install Google's Analytics opt-out add-on.
• Complaints: please contact us first, and we'll try to fix it. You can also complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

10. How we protect it

• All traffic between the app, the website and our server is encrypted (HTTPS).
• Passwords are stored as salted one-way hashes. Sign-in tokens and password-reset codes are also stored as hashes on our server.
• On your phone, your sign-in session is encrypted with a key kept in Android's secure key storage (the Keystore).
• Only Prove/n's server can read the database, and each account can reach only its own data and notes.
• Repeated failed sign-ins lock the account, and request limits slow down automated attacks.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada, as Canadian law requires.

11. Changes to this policy

When we change this policy, we update the date at the top. Before a significant change takes effect, we'll tell you in the app or by email.

12. Contact us

For questions, requests or complaints about your privacy, use the contact form on prove-n.app. During the beta test you can also use the form on the tester page and pick "Privacy or my data". We'll reply by email.