Pinky ("pinky promise: put it down") is an app for Android and iPhone that tells the people in your promise when you open an app you asked it to watch, and vice versa. It is made by Sunday Labs Ltd, a company registered in England and Wales (company number 17555468).
What Pinky collects
We can't read anything you share. Pinky has no accounts and no analytics. Its only server is the relay that passes your promise's encrypted messages between phones (below).
What the app handles, and where it goes:
- App usage on your phone. With the usage access permission, Pinky checks every few seconds whether one of the apps you chose (Instagram by default) is on screen. It keeps only session start/end times and minutes for the apps you chose, for 30 days, on your phone.
- Screen Time on an iPhone. On an iPhone, Pinky uses Apple's Screen Time with your permission. You pick the apps in Apple's own picker; Pinky only learns how many minutes you spent on them today (in steps), never which of them, and Apple shows the stop screen. With "Share my minutes" off, your partners only hear when you break the promise.
- Browser address bar (optional). If you turn on the browser watch (an accessibility service), Pinky reads the address bar of supported browsers to see whether a watched website such as instagram.com is open. It reads nothing else on screen and stores no addresses; only "a watched site was opened/closed" is kept, like an app session.
- Events shared with your promise. Your minutes on the watched apps today (a total, never which app), the start and end of a session only when it breaks the promise (past the daily allowance or in sleep time), nudges (including any message you type into one), the penalty and goal, your chosen name, your time zone, the names of apps you add to or drop from your watched list, and a few settings (the promise's daily allowance and sleep time, the relay address) are sent to the other phones in your promise through Pinky's relay (run by us on Google Cloud in the United States), the public relay ntfy.sh for promises made before October 2026, or a server you configure. Every message is encrypted on your phone with a key derived from your promise code; the relay sees only an opaque topic name, ciphertext, size, timing and your IP address. It keeps messages for 12 hours and keeps no logs of their contents. Only people who know the promise code can read them.
- iPhone push. So an iPhone hears about the others at once, the Pinky app on an iPhone gives Pinky's relay its Apple push token, the promise's topic name and a one-way hash of a random device id. The relay uses them only to ask Apple to deliver the still-encrypted message to that iPhone, which decrypts it itself. A token unused for 60 days, or one Apple reports as no longer valid, is deleted; leaving the promise removes it.
- Purchases. Pinky Plus is sold by Google Play on Android and by the App Store on iPhone. Google or Apple handles payment and keeps the purchase record; the app only asks the store whether a subscription is active. We never see your payment details.
What Pinky does not do
- No advertising, no tracking, no crash reporting, no analytics SDKs.
- No data leaves your phone except the encrypted events above (and, on an iPhone, its push token), to the relay.
- Nothing is shared with third parties.
Permissions, and why
| Permission | Why |
|---|---|
| Usage access (Android) | To notice when a watched app is opened. |
| Screen Time (iPhone) | To count your minutes on the apps you picked and show the stop screen. |
| Notifications | To tell you when someone in your promise gets caught. |
| Run in the background / ignore battery optimisation | So the watching keeps working with the screen off. |
| Accessibility service (optional, Android) | The browser watch: address bar only, supported browsers only. |
| Internet | To exchange encrypted events through the relay and talk to Google Play or the App Store. |
Your control
- Leaving a promise (Home, Edit on the promise card, Break the promise) deletes the group's history on your phone and tells the others.
- Uninstalling removes everything.
- Relay messages expire after 12 hours and are unreadable without your promise code.
Children
Pinky is not directed at children under 13.
Contact
Questions about this policy: hello@sundaylabs.co.uk. This page is the policy's home; the earlier copy on Google Sites points here.