Privacy policy
Last updated: 4 July 2026
This policy explains what Broc collects, why, and what you can do about it. Broc ("we", "us") makes a habit app that blocks chosen apps on your phone until you finish your daily habits. Broc was previously published under the name Veto; this policy covers the same app and service.
If anything here is unclear, email us at developer@getbroc.app.
Who runs Broc
Broc is provided by Shay Gavan (Broc). We are the data controller for the information described below.
What we collect
Your account. When you sign in with email or Google, we store your email address and, if you use Google, your display name. This is how your habits sync across devices.
Your habits and progress. The habits you create, your daily completions, your streaks, and your settings (such as reward mode and which apps you block).
Your blocked-apps list. The package names and labels of the apps you choose to block.
Purchase status. If you subscribe to Broc Pro, our payments provider tells us whether your subscription is active. We never see your card details.
Diagnostics. If the app crashes, we receive a crash report so we can fix the problem. It does not contain your habit content.
Product analytics. We use PostHog, hosted in the EU, to understand how the app and our website are used: events such as "habit created" or "first unlock", plus device model and app version. This shows us where Broc confuses people so we can fix it. It never includes your habit names, your photos, or the content of anything you do inside other apps. The website also uses GoatCounter, a cookieless page-view counter.
We do not show ads and we do not sell your data.
The "Usage access" permission
Broc uses Android's Usage Access permission only to detect which app is open right now and compare it against your block list, on your device. We do not record, store, or send a history of the apps you use.
The "Appear on top" permission
This lets Broc show its lock screen over a blocked app.
Notifications
Broc runs a background service that watches for blocked apps. While that service is active, Android shows an ongoing notification so you always know Broc is running. We use the notification only to display this status. We do not send marketing or send your data through it.
Photos for AI verification (Pro)
If you turn on photo verification for a habit, the photo you take is sent securely to our server and then to our AI provider (OpenAI) to check whether it matches the habit. We use the result (a pass or fail) to mark the habit done. We do not save the photo on our servers after the check, and the AI provider does not use API images to train its models. If you would rather not share photos, simply leave photo verification off.
Where your data lives
Your account and habit data are stored with Google Firebase (Cloud Firestore, Authentication, Crashlytics) and may be processed on Google's servers. Subscription status is handled by RevenueCat and the app store. Analytics events are processed by PostHog on servers in the EU. These providers process data on our behalf under their own security and privacy terms.
How long we keep it
We keep your data while your account exists. If you delete your account, we remove your habits, completions, blocked-apps list, and settings. Crash reports and aggregate diagnostics may be retained for a limited period by our providers.
Your choices and rights
You can:
- See and change your habits and settings in the app at any time.
- Turn photo verification off.
- Ask us to export or delete your data by emailing developer@getbroc.app.
If you are in the UK or EU, you have rights under the UK GDPR / GDPR, including access, correction, deletion, and the right to complain to the ICO (or your local authority).
Children
Broc is not intended for children under 13 (or the minimum age in your country). We do not knowingly collect data from children.
Changes to this policy
If we change this policy, we will update the date above and, for significant changes, let you know in the app.
Contact
Questions or requests: developer@getbroc.app.