Privacy Policy

Effective date: September 6, 2026

1. Introduction

NopeMode ("we", "us", "our") provides a screen time management service that helps users control and monitor their device usage. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By creating an account or using our service, you agree to the collection and use of information as described in this policy.

Data Controller

The controller responsible for processing your personal data is:

  • Martin Ševela, OSVČ (sole trader)
  • IČO: 19236760
  • Sinkulova 1209, Praha 4, Czech Republic
  • Email: info@nopemode.com

2. Information We Collect

2.1 Account Information

When you register, we collect:

  • Email address (used as your username and for account recovery)
  • Password (stored as a cryptographic hash, never in plain text)

2.2 Device Information

When you connect a device, we collect:

  • Device name (chosen by you)
  • Device platform (Windows, Android)
  • Last seen timestamp

2.3 Usage Data

As a core part of the screen time management service, we track usage data on your managed devices. This data is essential for enforcing policies and providing usage reports. It includes:

  • Application usage: which apps are used, foreground time, active time, and media playback time per day
  • Website usage: domains visited, browser used, foreground and active time per day
  • Policy usage: time spent per policy category (e.g., social media, gaming) per day

This data is collected locally on the device and synced to your account on our server. It is only accessible to you (the account owner) and any manager accounts you have authorized.

2.4 Subscription & Payment Data

Payment processing is handled by our payment provider, Paddle. We store:

  • Your Paddle customer ID
  • Subscription tier, status, and billing period dates

We do not store your credit card number, bank details, or other payment credentials. These are handled entirely by Paddle. Please review Paddle's Privacy Policy for details on their data handling.

2.5 Temporary Account and Checkout Diagnostics

During limited troubleshooting periods, we record account creation, email verification, browser login, subscription-page and checkout steps, and categorized technical errors. These records are linked to your existing NopeMode account and may include timestamps, the selected plan, an opaque checkout-attempt or Paddle transaction reference, and the application version. They help us understand where signup or checkout stops working. Browser observations are not proof of payment or an explanation of why you stopped.

This is first-party troubleshooting data available only to authorized administrators. We do not record sessions, keystrokes, payment credentials, verification tokens, access-code contents, or raw payment-provider messages. We do not add cookies or persistent browser identifiers for these diagnostics, track anonymous visitors, or share these account-linked records with Google or other advertising services. Recording periods stop automatically after 30 days; each record expires after 30 days and is removed by scheduled cleanup. Retained records are included in your account data export and removed when your account is deleted.

2.6 Website Analytics and Advertising Measurement

On the public NopeMode landing page, we use Cloudflare Web Analytics to understand aggregate traffic such as page views, visits, referrers, device type, browser, country, and page performance. This analytics data is not connected to NopeMode accounts and does not use analytics cookies.

We also use the Google Ads tag on the public landing page and during subscription checkout in the production browser application to measure the aggregate effectiveness of advertising campaigns. The tag runs with all Google Consent Mode storage, advertising user data, and personalization settings permanently denied, and with advertising data redaction enabled. Google does not read or write advertising or analytics cookies for this tag. It may receive cookieless measurement signals such as the page URL with ad-click identifiers redacted, a timestamp, browser user agent, referrer, consent state, a random value, and a coarse indication of whether an ad click preceded the visit.

When a positive-value Paddle checkout completes in the production browser application, we hold the conversion until our server confirms the resulting self-managed subscription. We then send Google Ads a purchase conversion containing the opaque Paddle transaction ID, the transaction total, and its currency. We do not send the customer's email address, NopeMode account ID, Paddle customer ID, or other account data to Google Ads, and we do not enable enhanced conversions or account linkage.

To preserve a pending conversion if the checkout page is refreshed, the browser temporarily stores the transaction ID, total, currency, and the initiating NopeMode account ID in local storage for up to 24 hours. The account ID is used only to restore the conversion for the same signed-in account and is never sent to Google. This temporary record is removed after the conversion is queued or when it expires.

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the NopeMode service
  • Enforce screen time policies you have configured
  • Display usage reports and statistics in your dashboard
  • Understand aggregate traffic to the public landing page
  • Measure the aggregate effectiveness of advertising campaigns and paid subscription conversions using cookieless signals
  • Send transactional emails (account verification, password reset)
  • Process subscription payments
  • Diagnose and fix technical issues

We do not sell your personal data. We do not use NopeMode account, device, or usage data for advertising. Cookieless Google Ads measurement is used only to evaluate aggregate campaign effectiveness; we do not use personalized advertising or remarketing, build user profiles for marketing purposes, or engage in automated decision-making or profiling.

3.1 Legal Bases for Processing

Under the GDPR, we process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)) — account data, device data, usage tracking, policy enforcement, and transactional emails are necessary to provide the service you signed up for
  • Legal obligation (Art. 6(1)(c)) — subscription and payment records are retained as required by tax and accounting law
  • Legitimate interest (Art. 6(1)(f)) — error tracking, aggregate landing page analytics, cookieless advertising and purchase conversion measurement, and diagnostics help us maintain service quality, understand public website traffic, evaluate campaign effectiveness, and fix bugs; we limit the privacy impact by keeping all Google Consent Mode advertising and storage settings denied and enabling advertising data redaction

4. Third-Party Services

We use the following third-party services:

4.1 Paddle (Payment Processing)

Paddle handles all payment processing, invoicing, and tax compliance. When you subscribe, your payment details are provided directly to Paddle.

4.2 GlitchTip / Sentry (Error Tracking)

We use error tracking to identify and fix bugs. When an error occurs, technical information about the error (stack trace, device type, OS version) may be sent to our self-hosted GlitchTip instance. We do not send personally identifiable information (such as your email address) to error tracking services.

4.3 Email Provider

We use an SMTP email service to send transactional emails (account verification, password resets, support responses). We do not send marketing or promotional emails.

4.4 Cloudflare Web Analytics

We use Cloudflare Web Analytics on the public landing page to collect aggregate website traffic and performance statistics. Cloudflare Web Analytics does not use analytics cookies and is not used to track logged-in NopeMode application activity.

4.5 Google Ads (Cookieless Advertising Measurement)

We use a Google Ads tag on the public landing page and during paid subscription checkout in the production browser application to evaluate advertising campaign and purchase conversion effectiveness. All Google Consent Mode storage, advertising user data, and personalization settings are permanently denied, and advertising data redaction is enabled. The tag therefore does not read or write Google advertising or analytics cookies or use personalized advertising or remarketing. Google may receive the limited cookieless signals and purchase conversion fields described in Section 2.6, but not the customer's email address, NopeMode account ID, or Paddle customer ID. For more information, see Google's Privacy Policy.

4.6 International Data Transfers

Your data is primarily stored and processed within the European Union. Some of our third-party service providers may process data outside the EU/EEA:

  • Paddle is established in the United Kingdom, which benefits from an EU adequacy decision for data protection
  • Google may process cookieless website and purchase conversion measurement data outside the EU/EEA, including in the United States

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as EU adequacy decisions or Standard Contractual Clauses (SCCs), in accordance with GDPR Articles 44-49.

5. Data Storage & Security

Your data is stored on servers located in the European Union. We use industry-standard security measures including:

  • TLS encryption for all data in transit
  • Cryptographic password hashing
  • JWT-based authentication with token expiration
  • Access controls limiting data access to authorized users only

6. Data Retention

We retain your data for as long as your account is active:

  • Account and device data — retained for the lifetime of your account
  • Usage reports — retained for the lifetime of your account to provide historical statistics
  • Subscription and payment records — retained as required by applicable tax and accounting law (up to 10 years after the transaction)

When you delete your account, all associated data (devices, policies, usage reports) is permanently deleted. Subscription records may be retained for the legally required period for tax compliance purposes.

7. Your Rights

Under the General Data Protection Regulation (GDPR) and similar laws, you have the right to:

  • Access your personal data — you can view all your data in the NopeMode dashboard
  • Data portability — you can download a copy of your data in a structured, machine-readable format from your account settings
  • Erasure — you can delete your account and all associated data from your account settings
  • Rectification — you can update your email and other account details at any time
  • Restrict processing — you can request that we limit how we process your data in certain circumstances
  • Object to processing — where we process data based on legitimate interest, you have the right to object; we will stop processing unless we have compelling legitimate grounds
  • Withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@nopemode.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. For Czech Republic residents, this is the Office for Personal Data Protection (UOOU): www.uoou.cz.

8. Children's Privacy

NopeMode is designed as a screen time management tool for use by parents and guardians. We do not knowingly collect personal data directly from children. Children do not create their own accounts.

When used to manage a child's device, the parent or legal guardian creates and controls the account. Usage data collected from managed devices is processed under the parent's account based on their consent and authority as the child's legal guardian.

Parents and guardians may exercise data rights (access, export, deletion) on behalf of their children through their account settings or by contacting us.

Under the Czech implementation of GDPR, parental consent is required for processing personal data of children under 15 years of age in relation to information society services. NopeMode relies on the parent or guardian to provide this consent by creating and managing the account.

9. Cookies

The NopeMode web application uses local storage (not cookies) to maintain your login session and briefly retain a pending paid conversion as described in Section 2.6. The public landing page uses Cloudflare Web Analytics without analytics cookies. The Google Ads tag used on the public landing page and during production browser subscription checkout has all storage consent settings permanently denied and advertising data redaction enabled, so it does not read or write Google advertising or analytics cookies; it sends only the limited cookieless measurement signals and purchase conversion fields described in Section 2.6. We do not use tracking, analytics, or advertising cookies through these integrations.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email. The "Effective date" at the top of this page indicates when this policy was last updated.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: