Privacy policy
In short. offCrew evaluates how long you used which app on your phone and stores that there. There is no account, no mandatory email, no advertising, no tracking and no analytics services. Only when you join a crew do events you choose to share travel end-to-end encrypted through a server in the EU to your friends. The server sees ciphertext and technical metadata (see section 6), never plaintext.
1. Controller
Mignuti Media, Eduard Ditler. Address and further details: legal notice.
Email: media@mignuti.com
We have not appointed a data protection officer. For privacy questions, contact us at the email address above.
2. Minimum age
offCrew is intended for people aged 14 and over. Use is voluntary. offCrew is not parental control software and not a medical product.
3. What stays on your device
This data is processed locally only and is not transmitted to us or to any server:
- App usage statistics (Android “usage access”,
UsageStats): which app was in the foreground, when and for how long. offCrew uses it to notice when you open one of your distraction apps and to compute the daily pot. - Your selection of distraction apps, limits, settings, streaks, badges and statistics.
- Your reasons (“Why?” answers) as a local list. Free text can reveal health or personal circumstances; it stays local. Only if you share a reason with a crew when opening an app does it go to the crew, encrypted (section 5). Do not put anything sensitive there.
- Cryptographic keys of your crews (private signing and key-agreement keys, crew key) are stored on the device.
When you uninstall the app, Android removes this local data. In the app you can delete it any time under Settings → “Delete everything” (see Delete data).
4. Permissions and features
| Permission / feature | Purpose | What is read | Without it |
|---|---|---|---|
Usage access (PACKAGE_USAGE_STATS) | Detect which app is in the foreground; compute the daily pot | App package names and usage times, locally | offCrew cannot detect or lock apps |
Display over other apps (SYSTEM_ALERT_WINDOW) | “Why?” prompt with breathing pause and lock screen in front of your distraction apps | nothing; it only shows a screen | no prompt, no lock |
Foreground service (FOREGROUND_SERVICE_SPECIAL_USE) | Reliable background monitoring; fetching crew events; visible notification | as usage access | the system stops monitoring |
| Notifications | Crew alerts (nudges, requests, answers) | nothing | no alerts |
Start after reboot (RECEIVE_BOOT_COMPLETED) | Restart the service after a reboot | nothing | the service must be started manually |
List of launcher apps (<queries>) | Show the picker for your distraction apps | installed apps with a launcher icon, locally | limited picker |
offCrew does not use an accessibility service, device administration, location, contacts or messages. Optional attachments (voice message, photo) need the microphone or camera only when you trigger them yourself.
5. Crew features: what is shared
A crew has 2 to 6 people who invite each other by link or QR code. New members are only admitted after approval by the crew admin. The following content goes encrypted to all members of your crew:
- Name and emoji, crew name, your limit minutes and time used (every 3 minutes and on changes), number of opens and resisted attempts, streak, protection status;
- Events: “app opened” with the reason you give (the app name is only shared if you allow it), “Nope”, longer scrolling (15/30/60 minutes), emergency unlock, nudge, request for more time, answers to requests;
- optionally, as an attachment to a request for more time: a voice message or photo, also end-to-end encrypted. The server keeps such attachments for at most 24 hours (see section 8). This feature is being introduced now.
You control in the settings how much you share. A “totals only” mode is in progress. Crew members can save, copy or pass on content they received on their own devices; we have no influence on that. Only share what you are comfortable sharing with these people.
6. Server, encryption and an honest metadata list
The crew service is a Cloudflare Worker with Durable Objects created exclusively in the EU jurisdiction. Processing is based on a data processing agreement with Cloudflare, Inc. (USA).
Encryption. Every event is encrypted on your device with AES-256-GCM (crew key, derived via HKDF) and signed with your personal ECDSA P-256 key. Each member has their own keys. When someone leaves or is removed, the crew admin generates a new crew key; whoever is gone can no longer read along. The server does not know the crew key and cannot read content. The invite link carries the key in the part after “#”; browsers never send that part to a server.
What the server still sees (metadata):
- Crew ID and member IDs (random, pseudonymous), members' public keys, who belongs to which crew, who is admin, who is waiting for approval;
- Time of every request and event, size of the encrypted packets (padded to size classes), number and frequency of messages per member. This reveals when someone is active, not what they do;
- Hashes of credentials (crew token, member secret) instead of the plain values;
- the IP address of your connection. It is processed technically by Cloudflare and briefly used for abuse protection (rate limiting, IPv6 as /64). We do not store IP addresses.
Limits. On first contact the client trusts the key directory supplied by the server (a malicious server could hand a new member wrong keys). Within a key epoch there is no forward secrecy: whoever steals the crew key can read events of that epoch.
7. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| local usage evaluation, pot, lock, “Why?” prompt | Providing the app | Art. 6(1)(b) GDPR (contract of use) |
| Crew operation: encrypted events, metadata, IP processing by Cloudflare, rate limiting | Sharing with your own crew; secure operation | Art. 6(1)(b) GDPR; for abuse protection also (f) (security of the service) |
| Report function (section 8) | Reviewing and handling abuse and violations | Art. 6(1)(f) GDPR (protecting users and the service) |
| Integrity check when joining a crew (section 8) | Protection against automated abuse | Art. 6(1)(f) GDPR |
| Website access (offcrew.mignuti.com) | Serving the pages | Art. 6(1)(f) GDPR |
We process nothing on the basis of consent, use no analytics, tracking or advertising services and build no profiles. There is no automated decision-making with legal effect. You are not obliged to provide data; without the described permissions the app only works in a limited way.
8. Recipients and other services
- Cloudflare, Inc. (USA; EU data centres, Durable Objects with EU jurisdiction): hosting of the crew service and this website, as processor. Cloudflare processes technically necessary connection data (including the IP address). Transfers to third countries rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Voice and photo attachments (new): If you add a voice message or photo to a request for more time, the attachment is encrypted on your device and cached on the server for at most 24 hours, then deleted automatically. The server cannot read the content.
- Report function (new): If you report a member or content, an email is sent to media@mignuti.com. It contains your report and technical details needed for assignment (e.g. crew ID, member IDs, time, app version); crew content is only included if you explicitly attach it. Sending is done via Resend, Inc. (USA) as processor on the basis of standard contractual clauses. We delete reports once handled and no legal follow-up is pending, after 12 months at the latest.
- Google Play Integrity (new): When joining a crew, offCrew uses the Google Play Integrity API to check that the request comes from the genuine, unmodified app on a certified device. Your device sends a token generated by Google to our server, which has it verified by Google. We do not store the token and use the result only for the joining process. Google's privacy notices apply (Google Ireland Limited / Google LLC).
- Google Play (Google Ireland Limited / Google LLC): obtaining and updating the app and, where applicable, payment processing under Google's own responsibility. We do not receive payment data.
- We only send crash reports if you explicitly enable them; they are transmitted without Firebase and without an advertising ID. Without opt-in, nothing is sent.
We do not pass data to other third parties and do not sell data. Members of your crew receive what you share with them (section 5).
9. Retention
- Local data: until you delete it in the app or uninstall the app.
- Crew events on the server: deleted automatically after 48 hours (cleanup every 6 hours, so at most about 54 hours), and only the latest 500 per crew are kept.
- Key-rotation packets (encrypted, latest 20): as long as the crew exists.
- Member entry (IDs, public keys, hashes) and associated events: until you leave the crew or are removed; then deleted immediately.
- Pending join requests: expire after 24 hours.
- Crew: dissolved when the last member leaves or after 30 days without activity. All content is deleted. A tombstone remains (only the random crew ID and the dissolution time, no content) so the ID cannot be reused.
- Rate-limit counters: minute window; timestamps are deleted continuously.
- Voice/photo attachments: at most 24 hours.
- Reports by email: see section 8.
10. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Most data exists only on your device, where you can view and delete it yourself. Send requests to media@mignuti.com.
Because offCrew works without an account, we can only match server data if you give us the crew ID or member ID (Art. 11 GDPR). The server does not know crew names or content. Deletion is also mostly done through the app (see Delete data).
Right to lodge a complaint: You can complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI), datenschutz.rlp.de, or the authority in your country of residence.
11. Website
This website uses no cookies, no trackers, no external fonts and no embedded third-party content. When you visit, Cloudflare as hosting provider processes technically necessary connection data (IP address, time, requested page). Invite links (/j/#…) carry the key in the fragment; it is never sent to the server and is removed from the address bar immediately.
12. Security and changes
We apply technical and organisational measures (encryption, signatures, rate limiting, minimal storage). We update this policy when features or the legal situation change; the current date is at the top. This policy is not legal advice.